Vercel registry pushes can use short-lived GitHub identity

Vercel’s new registry login action exchanges a GitHub Actions identity token for a short-lived Vercel token. The workflow can then push container images without storing a long-lived registry credential in repository secrets. When the job finishes, the action logs out and revokes its token. Access is controlled by a Vercel policy matching the repository and workflow.

Vercel · Sep 25, 2026

Why it matters

This reduces persistent credentials in deployment pipelines while keeping access tied to a specific workflow.

More context

Try vercel/vcr-action/login with a Vercel team OIDC policy granting the required registry access. The GitHub job needs id-token: write and the relevant team and image-tag variables.

Keep in mind

An identity policy that is too broad still grants too much access. This requires the Vercel registry and team setup; 1min has not tested the integration or verified plan-specific costs.

Original read