---
title: activate-a-signing-key
product: vercel
url: /docs/rest-api/kms/activate-a-signing-key
canonical_url: "https://vercel.com/docs/rest-api/kms/activate-a-signing-key"
last_updated: 2026-09-08
type: reference
prerequisites:
  []
related:
  - /docs/rest-api
summary: Learn about activate-a-signing-key on Vercel.
install_vercel_plugin: npx plugins add vercel/vercel-plugin
---

# Activate a signing key

```http
POST /v1/kms/issuers/{issuerId}/keys/{keyId}/activate
```

Activate a pending signing key so the issuer starts signing with it.

## Authentication

**bearerToken**: HTTP bearer

## Path parameters

| Name | Type | Required | Description |
|---|---|---|---|
| `issuerId` | string | Yes | The ID of the issuer. |
| `keyId` | string | Yes | The ID of the pending signing key to activate. |


## Query parameters

| Name | Type | Required | Description |
|---|---|---|---|
| `teamId` | string | No | The Team identifier to perform the request on behalf of. |
| `slug` | string | No | The Team slug to perform the request on behalf of. |


## Request body

Required: No

Content-Type: `application/json`

```json
{
  "type": "object",
  "properties": {
    "revokePreviousAfterHours": {
      "type": "number",
      "description": "How many hours after activation the previously-active key should stop being used. Defaults to a 1 hour grace period so already-issued tokens keep verifying.",
      "minimum": 0
    }
  }
}
```

## Example request

### TypeScript

```typescript
const response = await fetch('https://api.vercel.com/v1/kms/issuers/issuerId/keys/keyId/activate?teamId=string&slug=string', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer YOUR_ACCESS_TOKEN',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "revokePreviousAfterHours": "123"
  }),
});

const data = await response.json();
console.log(data);
```

### Next.js

```typescript
'use server';

export async function callEndpoint() {
  const response = await fetch('https://api.vercel.com/v1/kms/issuers/issuerId/keys/keyId/activate?teamId=string&slug=string', {
    method: 'POST',
    headers: {
      'Authorization': `Bearer ${process.env.VERCEL_ACCESS_TOKEN}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({
      "revokePreviousAfterHours": "123"
    }),
    next: { revalidate: 3600 }
  });

  if (!response.ok) {
    throw new Error('Request failed');
  }

  return response.json();
}
```

### cURL

```bash
curl -X POST 'https://api.vercel.com/v1/kms/issuers/issuerId/keys/keyId/activate?teamId=string&slug=string' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
  -H 'Content-Type: application/json' \
  -d "{
    \"revokePreviousAfterHours\": \"123\"
  }"
```

## Example response

```json
{
  "keyId": "example_id",
  "importKeyId": "example_id",
  "issuerId": "example_id",
  "algorithm": "string",
  "status": "active",
  "publicKey": {
    "kty": "string",
    "kid": "example_id",
    "alg": "string",
    "use": "string",
    "key_ops": [],
    "x5c": [],
    "x5t#S256": "string"
  },
  "publicKeyFingerprint": "string",
  "publicKeyPem": "string",
  "certificatePem": "string",
  "createdAt": "string",
  "updatedAt": "string",
  "revokeAt": "string",
  "activateAt": "string",
  "activatedAt": "string"
}
```

## Responses

### 200: No description

Content-Type: `application/json`

```json
{
  "type": "object",
  "required": [
    "algorithm",
    "createdAt",
    "issuerId",
    "keyId",
    "status",
    "updatedAt"
  ],
  "properties": {
    "keyId": {
      "type": "string",
      "description": "The server-minted, unique record identifier. Use this to address the key on the activate / certificate endpoints."
    },
    "importKeyId": {
      "type": "string",
      "description": "The caller-supplied key id (imported keys only), used as the JWT/JWKS `kid`. Not unique across an issuer's keys; omitted for generated keys."
    },
    "issuerId": {
      "type": "string"
    },
    "algorithm": {
      "type": "string"
    },
    "status": {
      "type": "string",
      "enum": [
        "active",
        "pending",
        "revoking"
      ]
    },
    "publicKey": {
      "type": "object",
      "properties": {
        "kty": {
          "type": "string"
        },
        "kid": {
          "type": "string"
        },
        "alg": {
          "type": "string"
        },
        "use": {
          "type": "string"
        },
        "key_ops": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "x5c": {
          "type": "array",
          "description": "The X.509 certificate chain (RFC 7517 §4.7). Each entry is the base64 DER (not base64url) of a certificate. For keys minted with a stored certificate this holds the single self-signed cert as `[x5c]`.",
          "items": {
            "type": "string"
          }
        },
        "x5t#S256": {
          "type": "string",
          "description": "The base64url SHA-256 thumbprint of the DER certificate in `x5c[0]` (RFC 7517 §4.9)."
        }
      }
    },
    "publicKeyFingerprint": {
      "type": "string"
    },
    "publicKeyPem": {
      "type": "string",
      "description": "The public key in SPKI PEM form, ready to render. Present whenever the key has public key material. Derived from `publicKey`; the embedded certificate members (`x5c`/`x5t#S256`) do not affect it."
    },
    "certificatePem": {
      "type": "string",
      "description": "The stored X.509 certificate (from `publicKey.x5c[0]`) in PEM form, ready to render. Present only for keys created with a stored certificate; omitted for keys created before certificates were stored."
    },
    "createdAt": {
      "type": "string"
    },
    "updatedAt": {
      "type": "string"
    },
    "revokeAt": {
      "type": "string"
    },
    "activateAt": {
      "type": "string"
    },
    "activatedAt": {
      "type": "string",
      "description": "When the key became the active signer. Present for active and revoking keys (and absent for pending keys and rows predating this field)."
    }
  }
}
```

### 400: One of the provided values in the request body is invalid.
One of the provided values in the request query is invalid.

### 401: The request is not authorized.

### 403: You do not have permission to access this resource.

### 404: No description

### 409: No description

### 410: No description

---

## Related

- [kms endpoints](/docs/rest-api#kms)

- [REST API overview](/docs/rest-api)

- [OpenAPI spec](https://openapi.vercel.sh/) (machine-readable, all endpoints)

---

[View full sitemap](/docs/sitemap)