Vercel KMS lets you sign JWTs and arbitrary messages from your Vercel Functions using managed asymmetric signing keys, so private keys never live in your code or environment variables. Your function authenticates with its Vercel OIDC token, and the private key stays inside Vercel's key management service while verifiers use only the public key.

With Vercel KMS you can:

Create and rotate issuers and signing keys (RSA and ECDSA) from the CLI and dashboard.

Sign JWTs with custom claims and a configurable TTL, or sign raw bytes, using the @vercel/kms package.

Grant a project signing access per environment, including production, preview, development, and custom environments.

Constrain the claims a project can request per grant, and validate token claims against a JSON Schema.

Verify signed tokens anywhere.…