Death to long-lived static credentials

The article argues that long-lived static credentials, such as API keys and database passwords, remain a widespread security risk in machine-to-machine authentication despite existing standards like OAuth and OIDC. Vercel is addressing this by promoting short-lived, dynamically issued tokens through expanded OIDC support and tooling in its Marketplace, aiming to make secure authentication the default. The shift is driven by the increasing risk of credential exposure via code repositories, supply-chain compromises, or prompt injection attacks.