PLATFORMS Signal 288
Sign JWTs from your Functions without managing private keys
↗
Vercel KMS lets Functions sign JWTs and arbitrary messages using managed asymmetric keys, keeping private keys inside Vercel's service rather than in code or environment variables.
Developers no longer need to store or rotate private signing keys in their codebase or environment variables. Any standard OIDC or JOSE library can verify the signed tokens via the public JWKS endpoint, requiring no Vercel-specific verification code.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
Vercel KMS supports RSA, ECDSA, and EdDSA algorithms with key creation and rotation from the CLI and dashboard.
Signing access is granted per project and environment, with claims constrainable via JSON Schema per grant.
Vercel KMS is in beta on all plans and requires Vercel CLI 59.1.0 or later.
THE CLUSTER