Vercel KMS Concepts

These pages explain the parts of Vercel KMS you configure once and rely on over time. Read them after the Quickstart, when you need to reason about how keys change and how requests are authorized.

• Key rotation: How KMS stages a new key, schedules its activation, and retires the previous key while already-issued tokens keep verifying.
• Authentication: How KMS authorizes signing requests with a deployment OIDC token, authorizes management requests with a Vercel access token, and how relying parties verify signatures against the published JWKS.
• Project grants: How a project grant authorizes a Vercel deployment to sign with an issuer, scoped to a project and its environments.
• Connect grants: How a Connect grant lets Vercel Connect provision and sign with an issuer on behalf of your team.
• Claims: How a grant sets KMS-owned token claims the caller cannot override, and how an issuer claims schema validates every token it signs.