Founder Notes SaaS & B2B

Malte Ubl's post on X, curated on eChai

  • Curated from X →

    Malte Ubl is CTO of Vercel. After a week of leaked keys, Vercel is asking for an end to long-lived API keys: vendors on its marketplace now have to support OIDC, and by its count only 8% of cloud and SaaS vendors do.

    Malte Ubl Malte Ubl

    I've been cooking on this post for a bit, but with the cyber security events of this week I had to ship it:

    Long-live static credentials must die. We never want to rotate API keys again.

    Turns out only 8% of cloud and SaaS vendors support secure alternative. This is our call to action to change this AND our commitment to do our part:

    - We are requiring vendors on our marketplace to support OIDC
    - We shipped @shadcn components to make it easier to ship OIDC configuration
    - We are expanding OIDC support on our own platform

    The last generation got the web from HTTP to HTTPS. It is on us to move past API keys.

    vercel.com Death to long-lived static credentials
eChai Partner Brands The partnership →