Skip to content
Docs

Sign a token

POSThttps://api.vercel.com/v1/kms/issuers/{issuerId}/sign/token
Sign a JWT with a KMS issuer's active signing key. Authenticate the request with a Vercel OIDC token in the Authorization: Bearer header; the issuer's policies decide which workloads are allowed to sign. keyId, algorithm, and fingerprint identify the signing key in the issuer's JWKS.
https://api.vercel.com/v1/kms/issuers/{issuerId}/sign/token
const response = await fetch('https://api.vercel.com/v1/kms/issuers/issuerId/sign/token', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer YOUR_ACCESS_TOKEN',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "claims": "value",
    "headers": "value",
    "ttl": "123"
  }),
});


const data = await response.json();
console.log(data);
Response
{
  "algorithm": "string",
  "fingerprint": "string",
  "keyId": "example_id",
  "token": "string"
}

Authentication

AuthorizationbearerToken

Default authentication mechanism

Path parameters

issuerIdstringRequired
The ID of the issuer.

Body

application/json
claimsobjectOptional
The claims to include in the token.
headersobjectOptional
Additional headers to include in the token.
ttlnumberOptional
The time-to-live for the token, in seconds.

Response

200Success
algorithmstringRequired
Algorithm of the signing key.
fingerprintstringRequired
SHA-256 fingerprint of the signing key's public key (SHA256:<base64>).
keyIdstringRequired
Key id of the signing key. Matches the JWKS kid so verifiers can select the key after rotation without trial-verifying every published key.
tokenstringRequired
Compact JWT signed by the issuer's active signing key.

Errors

400One of the provided values in the request body is invalid. One of the provided values in the request query is invalid.
401Error
403Error
404Error
429Error