Vercel Blob OIDC Drops Long-Lived Tokens for Auto-Rotating Credentials
Vercel Blob OIDC is now the default authentication method for all newly connected projects. As of June 1, 2026, the platform eliminates the need for long-lived credentials, replacing them with short-lived, auto-rotating tokens.
Until now, developers relied on a static BLOB_READ_WRITE_TOKEN to authenticate storage requests. Long-lived tokens carry real risk. They never expire on their own. If leaked, they grant persistent access until someone manually revokes them.
Vercel Blob OIDC solves this. Vercel issues tokens that are short-lived and scoped to each project. They rotate automatically. There is no static secret to manage, store, or accidentally expose.
Functions running on Vercel receive the OIDC token automatically. Developers call the SDK exactly as before. Authentication happens in the background. No code changes are required for new projects.
The Vercel CLI picks up the same setup. Link a project, pull environment variables via vercel env pull, then read and write to a private Blob store straight from the terminal, no long-lived token needed. This is especially useful in local development and CI/CD pipelines where secret sprawl is a constant risk.
Existing projects can upgrade too. First, update to the latest @vercel/blob. Then go to the Projects tab under the relevant Blob store in the Vercel dashboard. Select Upgrade to OIDC from the project’s context menu.
This update aligns Vercel with industry-standard credential practices. OIDC (OpenID Connect) already powers workload identity in GitHub Actions and major cloud providers. Ephemeral credentials replace static secrets, and Vercel’s storage layer now works the same way.
