---
title: create-an-issuer-policy
product: vercel
url: /docs/rest-api/kms/create-an-issuer-policy
canonical_url: "https://vercel.com/docs/rest-api/kms/create-an-issuer-policy"
last_updated: 2026-09-08
type: reference
prerequisites:
  []
related:
  - /docs/rest-api
summary: Learn about create-an-issuer-policy on Vercel.
install_vercel_plugin: npx plugins add vercel/vercel-plugin
---

# Create an issuer policy

```http
POST /v1/kms/issuers/{issuerId}/policies
```

Attach a policy to a KMS issuer that grants a project's deployments permission to sign with it.

## Authentication

**bearerToken**: HTTP bearer

## Path parameters

| Name | Type | Required | Description |
|---|---|---|---|
| `issuerId` | string | Yes | The ID of the issuer. |


## Query parameters

| Name | Type | Required | Description |
|---|---|---|---|
| `teamId` | string | No | The Team identifier to perform the request on behalf of. |
| `slug` | string | No | The Team slug to perform the request on behalf of. |


## Request body

Required: No

Content-Type: `application/json`

```json
{
  "type": "object",
  "required": [
    "kind",
    "projectId",
    "environments"
  ],
  "properties": {
    "kind": {
      "type": "string",
      "enum": [
        "project-grant"
      ]
    },
    "projectId": {
      "type": "string",
      "description": "The project ID for the project grant policy."
    },
    "environments": {
      "type": "array",
      "description": "The environments for the project grant policy. Each entry is a system environment (production, preview, development) or a custom environment ID (env_...).",
      "items": {
        "type": "string",
        "pattern": "^(?:production|preview|development|env_.+)$"
      }
    },
    "tokenClaims": {
      "type": "object",
      "description": "The claims that KMS should include in signed JWTs for this policy.",
      "additionalProperties": true
    }
  }
}
```

## Example request

### TypeScript

```typescript
const response = await fetch('https://api.vercel.com/v1/kms/issuers/issuerId/policies?teamId=string&slug=string', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer YOUR_ACCESS_TOKEN',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "kind": "project-grant",
    "projectId": "example_id",
    "environments": [],
    "tokenClaims": "value"
  }),
});

const data = await response.json();
console.log(data);
```

### Next.js

```typescript
'use server';

export async function callEndpoint() {
  const response = await fetch('https://api.vercel.com/v1/kms/issuers/issuerId/policies?teamId=string&slug=string', {
    method: 'POST',
    headers: {
      'Authorization': `Bearer ${process.env.VERCEL_ACCESS_TOKEN}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({
      "kind": "project-grant",
      "projectId": "example_id",
      "environments": [],
      "tokenClaims": "value"
    }),
    next: { revalidate: 3600 }
  });

  if (!response.ok) {
    throw new Error('Request failed');
  }

  return response.json();
}
```

### cURL

```bash
curl -X POST 'https://api.vercel.com/v1/kms/issuers/issuerId/policies?teamId=string&slug=string' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
  -H 'Content-Type: application/json' \
  -d "{
    \"kind\": \"project-grant\",
    \"projectId\": \"example_id\",
    \"environments\": [],
    \"tokenClaims\": \"value\"
  }"
```

## Example response

```json
{
  "kind": "project-grant",
  "teamId": "example_id",
  "projectId": "example_id",
  "environments": [],
  "tokenClaims": "value",
  "createdAt": "string",
  "updatedAt": "string"
}
```

## Responses

### 201: No description

Content-Type: `application/json`

```json
{
  "oneOf": [
    {
      "type": "object",
      "required": [
        "createdAt",
        "environments",
        "kind",
        "projectId",
        "teamId",
        "updatedAt"
      ],
      "properties": {
        "kind": {
          "type": "string",
          "enum": [
            "project-grant"
          ]
        },
        "teamId": {
          "type": "string"
        },
        "projectId": {
          "type": "string"
        },
        "environments": {
          "type": "array",
          "description": "Environments whose OIDC tokens this grant authorizes. Each entry is either a system environment slug (`production`, `preview`, `development`) or a custom environment ID (prefixed `env_`). Custom environments are matched against the token's `custom_environment_id` claim (the stable ID); system environments against its `environment` claim.",
          "items": {
            "type": "string"
          }
        },
        "tokenClaims": {
          "type": "object",
          "additionalProperties": true
        },
        "createdAt": {
          "type": "string"
        },
        "updatedAt": {
          "type": "string"
        }
      }
    },
    {
      "type": "object",
      "required": [
        "clientId",
        "createdAt",
        "kind",
        "updatedAt"
      ],
      "properties": {
        "kind": {
          "type": "string",
          "enum": [
            "connex-grant"
          ]
        },
        "clientId": {
          "type": "string"
        },
        "tokenClaims": {
          "type": "object",
          "additionalProperties": true
        },
        "createdAt": {
          "type": "string"
        },
        "updatedAt": {
          "type": "string"
        }
      }
    }
  ]
}
```

### 400: One of the provided values in the request body is invalid.
One of the provided values in the request query is invalid.

### 401: The request is not authorized.

### 403: You do not have permission to access this resource.

### 404: No description

### 410: No description

---

## Related

- [kms endpoints](/docs/rest-api#kms)

- [REST API overview](/docs/rest-api)

- [OpenAPI spec](https://openapi.vercel.sh/) (machine-readable, all endpoints)

---

[View full sitemap](/docs/sitemap)