Vercel KMS Project Grants
A project grant is an issuer policy (project-grant) that lets a Vercel deployment sign with the issuer using the deployment's OIDC token. It scopes signing to one team, one project, and a set of environments.
A project grant confers signing access and nothing more. A deployment whose OIDC token matches the grant can call signJWT and signMessage for the issuer, but it cannot create or manage an issuer. Provisioning an issuer requires a Connect grant.
| Field | Description |
|---|---|
teamId | The team that owns both the issuer and the project. |
projectId | The project whose deployments may sign. |
environments | The deployment environments allowed to sign, for example production, preview. |
When a deployment signs, KMS verifies its Vercel OIDC token, issued by https://oidc.vercel.com, and checks that:
owner_idmatches both the issuer's owning team and the grant'steamId.project_idmatches the grant'sprojectId.environmentis one of the grant'senvironments.
If any check fails, KMS rejects the signing request. Because Vercel mints the OIDC token per deployment, you manage no credentials. See Authentication and OIDC federation.
Create a separate issuer, each with its own project grant, for every project and environment that signs. Scoping this way keeps each issuer's signing surface small, isolates its published JWKS, and lets you rotate or revoke one issuer's keys without affecting the others.
Was this helpful?