Sign JWTs from your Functions without managing private keys
Vercel KMS: sign JWTs from Functions without touching private keys—managed asymmetric signing built in.
Why it matters
A developer infrastructure feature that reduces key management burden for Function-based auth workflows. Practitioners deploying serverless auth can simplify ops; enthusiasts see the platform consolidation trend continuing.
The key facts
14 to knowVercel KMS signs JWTs and arbitrary messages from Vercel Functions
Private keys managed by Vercel's key management service, never in code or env vars
Supports RSA, ECDSA, and EdDSA signing algorithms
Per-project and per-environment access grants
Public JWKS and OpenID Connect Discovery endpoints for standard verification
Custom claims, configurable TTL, and JSON Schema claim validation
CLI and dashboard management for issuers and key rotation
Vercel KMS enables JWT signing from Functions without private keys in code or env vars
Supports RSA, ECDSA, and EdDSA key algorithms
Keys managed per project and environment (production, preview, development, custom)
Public JWKS and OIDC Discovery endpoints for standard token verification
Claims can be constrained per grant and validated against JSON Schema
Accessible via CLI and team dashboard
@vercel/kms package for signing; any JOSE/OIDC library for verification
Go to the source
Vercel Blogvercel.com
Publisher excerpt: Vercel KMS lets you sign JWTs and arbitrary messages from your Vercel Functions using managed asymmetric signing keys, so private keys never live in your code or environment variables. Your function authenticates with its token, and the private key stays inside Vercel's key management service while…