# Sign JWTs from your Functions without managing private keys By Steven Van · 2026-08-18 Vercel KMS lets you sign JWTs and arbitrary messages from your Vercel Functions using managed asymmetric signing keys, so private keys never live in your… [Vercel]() now lets Functions sign JWTs and raw messages with managed asymmetric keys, so private keys never live in code or environment variables. A function authenticates with its Vercel OIDC token, the private key stays inside Vercel's key management service, and verifiers use only the public key. - Create and rotate issuers and signing keys (RSA, ECDSA, and EdDSA) from the CLI or dashboard. - Sign JWTs with custom claims and a configurable TTL, or sign raw bytes, using the **@vercel/kms** package. - Grant a project signing access per environment, including production, preview, development, and custom environments. - Constrain the claims a project can request per grant, and validate token claims against a JSON Schema. - Verify signed tokens anywhere: each issuer publishes a public OpenID Connect Discovery document and a JWK set, so any standard OIDC or JOSE library can validate tokens without Vercel-specific code. Vercel KMS requires Vercel CLI 59.1.0 or later. It is in [beta and available on all plans](), with features and behavior subject to change before general availability. [![]()]() ![Vercel]() Vercel The platform for frontend developers — deploy, preview, and scale web apps and AI agents with zero config. [View Vercel →]() Sources [Original source]() [Read Sign JWTs from your Functions without managing private keys on Creators Toolbox]() --- Canonical source: https://creatorstoolbox.com/blog/vercel-sign-jwts-from-your-functions-without-managing-private-keys