Description

Ensure no expired Vercel access tokens are left on user accounts, and that tokens used by active tools are replaced before they expire. New tokens should always be created with an expiration date and the narrowest scope possible, such as a single team or project.

Rationale

Expired tokens no longer work, but leaving them in place makes the token list harder to review and can hide tools that are silently failing. Tokens without any expiration are worse, because they stay valid forever. Cleaning up expired tokens and always setting an expiration keeps credentials short-lived and easy to manage.

Impact

  • Keeps the token list clean and easy to review

  • Makes sure active tools use valid tokens

  • Tools using an expired token must be updated

Default Value

By default, you choose an expiration when creating a token, and you can also choose no expiration. Expired tokens remain listed until they are deleted.

Pre-Requisites

  • Access to your own Vercel account (tokens are managed per user)

Test Plan

  1. Sign in to Vercel at https://vercel.com.

  2. Open the Account Tokens page at https://vercel.com/account/tokens (make sure your personal account is selected in the scope selector).

  3. Review each token's expiration and check for expired tokens.

  4. Also check for tokens that have no expiration date.

  5. If expired tokens or tokens with no expiration exist, follow the implementation steps.

Implementation Steps

  1. Sign in to Vercel at https://vercel.com.

  2. Open the Account Tokens page at https://vercel.com/account/tokens (make sure your personal account is selected in the scope selector).

  3. Delete each expired token.

  4. For tools that still need access, create a new token with an expiration date and the narrowest scope, and update the tool.

  5. Replace tokens with no expiration with new tokens that have one.

Backout Plan

  1. Sign in to Vercel at https://vercel.com.

  2. Open the Account Tokens page at https://vercel.com/account/tokens (make sure your personal account is selected in the scope selector).

  3. Create a new token for any tool that lost access, and update the tool with it.

Reference