Sign JWTs from your Functions without managing private keys
By Steven Van ·
Vercel KMS lets you sign JWTs and arbitrary messages from your Vercel Functions using managed asymmetric signing keys, so private keys never live in your…
Vercel now lets Functions sign JWTs and raw messages with managed asymmetric keys, so private keys never live in code or environment variables. A function authenticates with its Vercel OIDC token, the private key stays inside Vercel's key management service, and verifiers use only the public key.
- Create and rotate issuers and signing keys (RSA, ECDSA, and EdDSA) from the CLI or dashboard.
- Sign JWTs with custom claims and a configurable TTL, or sign raw bytes, using the @vercel/kms package.
- Grant a project signing access per environment, including production, preview, development, and custom environments.
- Constrain the claims a project can request per grant, and validate token claims against a JSON Schema.
- Verify signed tokens anywhere: each issuer publishes a public OpenID Connect Discovery document and a JWK set, so any standard OIDC or JOSE library can validate tokens without Vercel-specific code.
Vercel KMS requires Vercel CLI 59.1.0 or later. It is in beta and available on all plans, with features and behavior subject to change before general availability.
Vercel
The platform for frontend developers — deploy, preview, and scale web apps and AI agents with zero config.
View Vercel →