Skip to content
Docs

Create a signing key

POSThttps://api.vercel.com/v1/kms/issuers/{issuerId}/keys
Create a new signing key for a KMS issuer. Depending on the activation mode, the key is activated automatically once its public key has propagated, or manually via the activate endpoint.
https://api.vercel.com/v1/kms/issuers/{issuerId}/keys
const response = await fetch('https://api.vercel.com/v1/kms/issuers/issuerId/keys?teamId=string&slug=string', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer YOUR_ACCESS_TOKEN',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "activation": "automatic",
    "revokePreviousAfterHours": "123",
    "revokePreviousAt": "string",
    "importKey": "string",
    "importKeyId": "example_id"
  }),
});


const data = await response.json();
console.log(data);
Response
{
  "activateAt": "string",
  "activatedAt": "string",
  "algorithm": "string",
  "certificatePem": "string",
  "createdAt": "string",
  "importKeyId": "example_id",
  "issuerId": "example_id",
  "keyId": "example_id",
  "publicKey": {
    "alg": "string",
    "key_ops": [],
    "kid": "example_id",
    "kty": "string",
    "use": "string",
    "x5c": [],
    "x5t#S256": "string"
  },
  "publicKeyFingerprint": "string",
  "publicKeyPem": "string",
  "revokeAt": "string",
  "status": "active",
  "updatedAt": "string"
}

Authentication

AuthorizationbearerToken

Default authentication mechanism

Path parameters

issuerIdstringRequired
The ID of the issuer.

Query parameters

teamIdstringOptional
The Team identifier to perform the request on behalf of.
slugstringOptional
The Team slug to perform the request on behalf of.

Body

application/json
activationstringOptional
Whether the new key is activated automatically after its public key has propagated, or manually via the activate endpoint. Defaults to automatic.
revokePreviousAfterHoursnumberOptional
For automatic activation, how many hours after activation the previous signing key should stop being used. Defaults to a 1 hour grace period so already-issued tokens keep verifying.
revokePreviousAtobjectOptional2 variants
importKeystringOptional
The PEM-encoded private key to use for the issuer.
importKeyIdstringOptional
The key id to use as the imported key's JWT/JWKS kid. Only allowed when importKey is provided. Not required to be unique; the addressable key id is the server-minted keyId returned in the response.

Response

200Success
activateAtstringOptional
activatedAtstringOptional
When the key became the active signer. Present for active and revoking keys (and absent for pending keys and rows predating this field).
algorithmstringRequired
certificatePemstringOptional
The stored X.509 certificate (from publicKey.x5c[0]) in PEM form, ready to render. Present only for keys created with a stored certificate; omitted for keys created before certificates were stored.
createdAtstringRequired
importKeyIdstringOptional
The caller-supplied key id (imported keys only), used as the JWT/JWKS kid. Not unique across an issuer's keys; omitted for generated keys.
issuerIdstringRequired
keyIdstringRequired
The server-minted, unique record identifier. Use this to address the key on the activate / certificate endpoints.
publicKeyobjectOptional
publicKeyFingerprintstringRequired
publicKeyPemstringOptional
The public key in SPKI PEM form, ready to render. Present whenever the key has public key material. Derived from publicKey; the embedded certificate members (x5c/x5t#S256) do not affect it.
revokeAtstringOptional
statusstringRequired
updatedAtstringRequired

Errors

400One of the provided values in the request body is invalid. One of the provided values in the request query is invalid.
401The request is not authorized.
403You do not have permission to access this resource.
404Error
409Error
410Error