Vercel KMS Pricing and Limits

KMS is billed per signing operation. A signing operation is a single signJWT or signMessage call, and its rate depends on the key's algorithm. There is no per-key or per-issuer charge.

Signing operations are grouped into two algorithm tiers:

• Standard algorithms: RS256 and PS256.
• Advanced algorithms: every other supported algorithm, including RS384, RS512, PS384, PS512, and the ES* family.

The Hobby plan includes 5,000 signing operations per month at no charge. Pro and Enterprise teams are billed at the rates above.

• An issuer can have at most one pending key at a time during rotation.
• KMS supports RS256, RS384, RS512, the PS* and ES* families, and defaults to RS512.
• KMS does not support symmetric (HS*) keys.

You stop per-operation charges when you stop calling signJWT and signMessage. To remove an issuer entirely, delete it in the dashboard. A deleted issuer no longer publishes a JWKS, so relying parties can no longer verify tokens it signed.

• Key rotation
• SDK Reference