Sign JWTs from your Functions without managing private keys
Vercel has introduced Vercel KMS, a managed service allowing JWT signing from Functions without exposing private keys, using asymmetric keys stored in Vercel’s key management system and accessible via OIDC tokens.
Vercel KMS enables developers to sign JSON Web Tokens (JWTs) and arbitrary messages directly from Vercel Functions without handling private keys locally. The service uses Vercel’s OpenID Connect (OIDC) token for authentication, ensuring private keys remain within Vercel’s managed key management service while only the public key is exposed to verifiers. This approach eliminates the risk of private key exposure in code or environment variables, addressing a common security concern in token generation workflows.
The new service supports multiple key types, including RSA, ECDSA, and EdDSA, and allows for key creation, rotation, and management via both the Vercel CLI and dashboard. Developers can configure custom claims, set token expiration times (TTL), and sign raw bytes using the @vercel/kms package. Access can be granted to projects on a per-environment basis, including production, preview, development, and custom environments, with granular control over allowed claims.
Vercel KMS provides standardized verification mechanisms by publishing public OpenID Connect Discovery documents and JSON Web Key Sets (JWKS) at dedicated endpoints. These resources enable any standard OIDC or JOSE-compliant library to validate tokens without requiring Vercel-specific code. The service recommends creating separate issuers for each project and environment to isolate token audiences, restrict signing access, and allow independent key rotation or revocation without cross-project impact.
Vercel KMS is currently available in beta across all plans, with features and behavior subject to change before general availability. Usage is governed by the Beta Agreement, and developers are advised to consult the official documentation or access the Key Management section in their team’s dashboard to begin implementation. The service aims to simplify secure token signing while maintaining compatibility with existing authentication and authorization workflows.