Vercel API tokens are not stale or unused for over 90 days

​

What this check verifies

Vercel API tokens are assessed for staleness by checking whether each token has been active within the last 90 days. Stale tokens that remain unused for extended periods represent unnecessary access credentials that increase the attack surface. Tokens with no recorded activity are also flagged.

​

Risk

Stale tokens that have not been used for over 90 days may belong to decommissioned integrations, former team members, or forgotten automation. These tokens remain valid and could be compromised or misused without detection, as their inactivity makes suspicious usage harder to notice in access logs.

​

Recommendation

Regularly audit API tokens and revoke any that have not been used within 90 days. Implement a token lifecycle management process that includes periodic reviews, automatic expiration dates, and documentation of each token’s purpose and owner.

​

Remediation

Dashboard steps

1. Sign in to the Vercel dashboard
2. Navigate to Account Settings > Tokens
3. Review the last active date for each token
4. Revoke or delete tokens that have not been used in over 90 days
5. Contact token owners to confirm whether the token is still needed
6. Implement a regular token review process (e.g., quarterly)

​

References

• https://vercel.com/docs/rest-api#authentication

​

Where this check fires

This check runs on every scheduled scan against your Vercel account. Findings appear at Cloud Security → Findings filterable by Check ID = authentication_no_stale_tokens. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Vercel checks