---
title: sign-a-message
product: vercel
url: /docs/rest-api/kms/sign-a-message
canonical_url: "https://vercel.com/docs/rest-api/kms/sign-a-message"
last_updated: 2026-08-19
type: reference
prerequisites:
  []
related:
  - /docs/rest-api
summary: Learn about sign-a-message on Vercel.
install_vercel_plugin: npx plugins add vercel/vercel-plugin
---

# Sign a message

```http
POST /v1/kms/issuers/{issuerId}/sign/message
```

Sign a raw message with a KMS issuer's active signing key. Authenticate the request with a Vercel OIDC token in the `Authorization: Bearer` header; the issuer's policies decide which workloads are allowed to sign.

## Authentication

**bearerToken**: HTTP bearer

## Path parameters

| Name | Type | Required | Description |
|---|---|---|---|
| `issuerId` | string | Yes | The ID of the issuer. |


## Request body

Required: No

Content-Type: `application/json`

```json
{
  "type": "object",
  "required": [
    "message"
  ],
  "properties": {
    "message": {
      "type": "string",
      "description": "Base64-encoded message to be signed.",
      "pattern": "^[A-Za-z0-9+/]*={0,2}$",
      "maxLength": 44000
    }
  }
}
```

## Responses

### 200: No description

Content-Type: `application/json`

```json
{
  "type": "object",
  "required": [
    "signature"
  ],
  "properties": {
    "signature": {
      "type": "object",
      "description": "Flattened JWS JSON Serialization Syntax token. Payload is returned as an empty string when JWS Unencoded Payload ({@link https://www.rfc-editor.org/rfc/rfc7797 RFC7797}) is used.",
      "required": [
        "payload",
        "signature"
      ],
      "properties": {
        "payload": {
          "type": "string"
        },
        "signature": {
          "type": "string"
        },
        "header": {
          "type": "object",
          "description": "The \"header\" member MUST be present and contain the value JWS Unprotected Header when the JWS Unprotected Header value is non- empty; otherwise, it MUST be absent. This value is represented as an unencoded JSON object, rather than as a string. These Header Parameter values are not integrity protected.",
          "properties": {
            "alg": {
              "type": "string",
              "description": "JWS \"alg\" (Algorithm) Header Parameter"
            },
            "b64": {
              "type": "boolean",
              "description": "This JWS Extension Header Parameter modifies the JWS Payload representation and the JWS Signing Input computation as per {@link https://www.rfc-editor.org/rfc/rfc7797 RFC7797}.",
              "enum": [
                false,
                true
              ]
            },
            "crit": {
              "type": "array",
              "description": "JWS \"crit\" (Critical) Header Parameter"
            },
            "kid": {
              "type": "string",
              "description": "\"kid\" (Key ID) Header Parameter"
            },
            "x5t": {
              "type": "string",
              "description": "\"x5t\" (X.509 Certificate SHA-1 Thumbprint) Header Parameter"
            },
            "x5c": {
              "type": "array",
              "description": "\"x5c\" (X.509 Certificate Chain) Header Parameter"
            },
            "x5u": {
              "type": "string",
              "description": "\"x5u\" (X.509 URL) Header Parameter"
            },
            "jku": {
              "type": "string",
              "description": "\"jku\" (JWK Set URL) Header Parameter"
            },
            "jwk": {
              "type": "object",
              "description": "\"jwk\" (JSON Web Key) Header Parameter"
            },
            "typ": {
              "type": "string",
              "description": "\"typ\" (Type) Header Parameter"
            },
            "cty": {
              "type": "string",
              "description": "\"cty\" (Content Type) Header Parameter"
            }
          }
        },
        "protected": {
          "type": "string",
          "description": "The \"protected\" member MUST be present and contain the value BASE64URL(UTF8(JWS Protected Header)) when the JWS Protected Header value is non-empty; otherwise, it MUST be absent. These Header Parameter values are integrity protected."
        }
      }
    }
  }
}
```

### 400: One of the provided values in the request body is invalid.
One of the provided values in the request query is invalid.

### 401: No description

### 403: No description

### 404: No description

### 429: No description

---

## Related

- [kms endpoints](/docs/rest-api#kms)

- [REST API overview](/docs/rest-api)

- [OpenAPI spec](https://openapi.vercel.sh/) (machine-readable, all endpoints)

---

[View full sitemap](/docs/sitemap)