---
title: create-an-issuer
product: vercel
url: /docs/rest-api/kms/create-an-issuer
canonical_url: "https://vercel.com/docs/rest-api/kms/create-an-issuer"
last_updated: 2026-08-19
type: reference
prerequisites:
  []
related:
  - /docs/rest-api
summary: Learn about create-an-issuer on Vercel.
install_vercel_plugin: npx plugins add vercel/vercel-plugin
---

# Create an issuer

```http
POST /v1/kms/issuers
```

Create a new KMS issuer for the authenticated team. An issuer owns the asymmetric signing keys that are used to sign tokens and messages.

## Authentication

**bearerToken**: HTTP bearer

## Query parameters

| Name | Type | Required | Description |
|---|---|---|---|
| `teamId` | string | No | The Team identifier to perform the request on behalf of. |
| `slug` | string | No | The Team slug to perform the request on behalf of. |


## Request body

Required: No

Content-Type: `application/json`

```json
{
  "type": "object",
  "required": [
    "name"
  ],
  "properties": {
    "name": {
      "type": "string",
      "description": "The name of the issuer."
    },
    "algorithm": {
      "type": "string",
      "description": "The signing algorithm to use for the issuer.",
      "enum": [
        "RS256",
        "RS384",
        "RS512",
        "PS256",
        "PS384",
        "PS512",
        "ES256",
        "ES384",
        "ES512",
        "EdDSA"
      ],
      "default": "RS512"
    },
    "claimsSchema": {
      "type": "object",
      "description": "A JSON Schema used to validate the resolved token claims when signing tokens for this issuer.",
      "additionalProperties": true
    },
    "policy": {
      "oneOf": [
        {
          "type": "object",
          "required": [
            "kind",
            "teamId",
            "projectId",
            "environments"
          ],
          "properties": {
            "kind": {
              "type": "string",
              "enum": [
                "project-grant"
              ]
            },
            "teamId": {
              "type": "string",
              "description": "The team ID for the project grant policy."
            },
            "projectId": {
              "type": "string",
              "description": "The project ID for the project grant policy."
            },
            "environments": {
              "type": "array",
              "description": "The environments for the project grant policy. Each entry is a system environment (production, preview, development) or a custom environment ID (env_...)."
            },
            "tokenClaims": {
              "type": "object",
              "description": "The claims that KMS should include in signed JWTs for this policy."
            }
          }
        },
        {
          "type": "object",
          "required": [
            "kind",
            "clientId"
          ],
          "properties": {
            "kind": {
              "type": "string",
              "enum": [
                "connex-grant"
              ]
            },
            "clientId": {
              "type": "string",
              "description": "The Connex client ID for the Connex grant policy."
            },
            "tokenClaims": {
              "type": "object",
              "description": "The claims that KMS should include in signed JWTs for this policy."
            }
          }
        }
      ]
    },
    "importKey": {
      "type": "string",
      "description": "The PEM-encoded private key to use for the issuer."
    },
    "importKeyId": {
      "type": "string",
      "description": "The key id to use as the imported key's JWT/JWKS `kid`. Only allowed when `importKey` is provided. Not required to be unique; the addressable key id is the server-minted `keyId` returned in the response.",
      "pattern": "^[A-Za-z0-9._-]+$",
      "maxLength": 128
    }
  }
}
```

## Responses

### 201: No description

Content-Type: `application/json`

```json
{
  "type": "object",
  "required": [
    "algorithm",
    "createdAt",
    "id",
    "name",
    "origin",
    "ownerId",
    "policies",
    "signingKeys",
    "updatedAt"
  ],
  "properties": {
    "id": {
      "type": "string"
    },
    "ownerId": {
      "type": "string"
    },
    "name": {
      "type": "string"
    },
    "algorithm": {
      "type": "string",
      "enum": [
        "ES256",
        "ES384",
        "ES512",
        "EdDSA",
        "PS256",
        "PS384",
        "PS512",
        "RS256",
        "RS384",
        "RS512"
      ]
    },
    "origin": {
      "type": "string",
      "enum": [
        "external",
        "vercel"
      ]
    },
    "managedBy": {
      "type": "string"
    },
    "claimsSchema": {
      "type": "object",
      "additionalProperties": true
    },
    "createdAt": {
      "type": "string"
    },
    "updatedAt": {
      "type": "string"
    },
    "signingKeys": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "algorithm",
          "createdAt",
          "issuerId",
          "keyId",
          "status",
          "updatedAt"
        ],
        "properties": {
          "keyId": {
            "type": "string",
            "description": "The server-minted, unique record identifier. Use this to address the key on the activate / certificate endpoints."
          },
          "importKeyId": {
            "type": "string",
            "description": "The caller-supplied key id (imported keys only), used as the JWT/JWKS `kid`. Not unique across an issuer's keys; omitted for generated keys."
          },
          "issuerId": {
            "type": "string"
          },
          "algorithm": {
            "type": "string"
          },
          "status": {
            "type": "string",
            "enum": [
              "active",
              "pending",
              "revoking"
            ]
          },
          "publicKey": {
            "type": "object"
          },
          "publicKeyFingerprint": {
            "type": "string"
          },
          "publicKeyPem": {
            "type": "string",
            "description": "The public key in SPKI PEM form, ready to render. Present whenever the key has public key material. Derived from `publicKey`; the embedded certificate members (`x5c`/`x5t#S256`) do not affect it."
          },
          "certificatePem": {
            "type": "string",
            "description": "The stored X.509 certificate (from `publicKey.x5c[0]`) in PEM form, ready to render. Present only for keys created with a stored certificate; omitted for keys created before certificates were stored."
          },
          "createdAt": {
            "type": "string"
          },
          "updatedAt": {
            "type": "string"
          },
          "revokeAt": {
            "type": "string"
          },
          "activateAt": {
            "type": "string"
          },
          "activatedAt": {
            "type": "string",
            "description": "When the key became the active signer. Present for active and revoking keys (and absent for pending keys and rows predating this field)."
          }
        }
      }
    },
    "policies": {
      "type": "array",
      "items": {
        "oneOf": [
          {
            "type": "object",
            "required": [
              "createdAt",
              "environments",
              "kind",
              "projectId",
              "teamId",
              "updatedAt"
            ]
          },
          {
            "type": "object",
            "required": [
              "clientId",
              "createdAt",
              "kind",
              "updatedAt"
            ]
          }
        ]
      }
    }
  }
}
```

### 400: One of the provided values in the request body is invalid.

### 401: The request is not authorized.

### 403: You do not have permission to access this resource.

### 404: No description

### 410: No description

---

## Related

- [kms endpoints](/docs/rest-api#kms)

- [REST API overview](/docs/rest-api)

- [OpenAPI spec](https://openapi.vercel.sh/) (machine-readable, all endpoints)

---

[View full sitemap](/docs/sitemap)