---
title: Vercel KMS Project Grants
product: vercel
url: /docs/kms/concepts/project-grants
canonical_url: "https://vercel.com/docs/kms/concepts/project-grants"
last_updated: 2018-10-20
type: conceptual
prerequisites:
  - /docs/kms/concepts
  - /docs/kms
related:
  - /docs/oidc
  - /docs/kms/concepts/connect-grants
  - /docs/kms/concepts/authentication
summary: How a project grant authorizes a Vercel deployment to sign with a KMS issuer using its OIDC token, scoped to a team, project, and environments.
install_vercel_plugin: npx plugins add vercel/vercel-plugin
---

# Vercel KMS Project Grants

A project grant is an issuer policy (`project-grant`) that lets a Vercel deployment sign with the issuer using the deployment's [OIDC token](/docs/oidc). It scopes signing to one team, one project, and a set of environments.

## What a project grant authorizes

A project grant confers signing access and nothing more. A deployment whose OIDC token matches the grant can call `signToken` and `signMessage` for the issuer, but it cannot create or manage an issuer. Provisioning an issuer requires a [Connect grant](/docs/kms/concepts/connect-grants).

## Fields

| Field          | Description                                                                       |
| -------------- | --------------------------------------------------------------------------------- |
| `teamId`       | The team that owns both the issuer and the project.                               |
| `projectId`    | The project whose deployments may sign.                                           |
| `environments` | The deployment environments allowed to sign, for example `production`, `preview`. |

## How KMS verifies a project grant

When a deployment signs, KMS verifies its Vercel OIDC token, issued by `https://oidc.vercel.com`, and checks that:

- `owner_id` matches both the issuer's owning team and the grant's `teamId`.
- `project_id` matches the grant's `projectId`.
- `environment` is one of the grant's `environments`.

If any check fails, KMS rejects the signing request. Because Vercel mints the OIDC token per deployment, you manage no credentials. See [Authentication](/docs/kms/concepts/authentication) and [OIDC federation](/docs/oidc).

## Scope one grant per project and environment

Create a separate issuer, each with its own project grant, for every project and environment that signs. Scoping this way keeps each issuer's signing surface small, isolates its published JWKS, and lets you rotate or revoke one issuer's keys without affecting the others.

## Related

- [Connect grants](/docs/kms/concepts/connect-grants)
- [Authentication](/docs/kms/concepts/authentication)
- [OIDC federation](/docs/oidc)


---

[View full sitemap](/docs/sitemap)