Vercel API tokens have not expired

​

What this check verifies

Vercel API tokens are assessed for expiration status to identify expired tokens or those about to expire within a configurable threshold (default: 7 days). Tokens about to expire are flagged proactively so they can be rotated before causing disruptions. Tokens without an expiration date are considered valid.

​

Risk

Expired tokens indicate poor token lifecycle management. Tokens about to expire risk imminent service disruption if not rotated in time. Integrations or CI/CD pipelines relying on expired or soon-to-expire tokens will fail silently.

​

Recommendation

Remove expired tokens and create new ones with appropriate expiration dates. Implement a token rotation schedule to ensure tokens are refreshed before they expire. Update all integrations and automation that depend on the replaced tokens.

​

Remediation

Dashboard steps

1. Sign in to the Vercel dashboard
2. Navigate to Account Settings > Tokens
3. Identify any expired tokens
4. Delete expired tokens that are no longer needed
5. Create new tokens with appropriate expiration dates to replace expired ones
6. Update any integrations or CI/CD pipelines that used the expired tokens

​

References

• https://vercel.com/docs/rest-api#authentication

​

Where this check fires

This check runs on every scheduled scan against your Vercel account. Findings appear at Cloud Security → Findings filterable by Check ID = authentication_token_not_expired. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Vercel checks