---
title: sign-a-token
product: vercel
url: /docs/rest-api/kms/sign-a-token
canonical_url: "https://vercel.com/docs/rest-api/kms/sign-a-token"
last_updated: 2026-08-19
type: reference
prerequisites:
  []
related:
  - /docs/rest-api
summary: Learn about sign-a-token on Vercel.
install_vercel_plugin: npx plugins add vercel/vercel-plugin
---

# Sign a token

```http
POST /v1/kms/issuers/{issuerId}/sign/token
```

Sign a JWT with a KMS issuer's active signing key. Authenticate the request with a Vercel OIDC token in the `Authorization: Bearer` header; the issuer's policies decide which workloads are allowed to sign.

## Authentication

**bearerToken**: HTTP bearer

## Path parameters

| Name | Type | Required | Description |
|---|---|---|---|
| `issuerId` | string | Yes | The ID of the issuer. |


## Request body

Required: No

Content-Type: `application/json`

```json
{
  "type": "object",
  "properties": {
    "claims": {
      "type": "object",
      "description": "The claims to include in the token."
    },
    "headers": {
      "type": "object",
      "description": "Additional headers to include in the token."
    },
    "ttl": {
      "type": "number",
      "description": "The time-to-live for the token, in seconds.",
      "default": 300,
      "nullable": true
    }
  }
}
```

## Responses

### 200: No description

Content-Type: `application/json`

```json
{
  "type": "object",
  "required": [
    "token"
  ],
  "properties": {
    "token": {
      "type": "string"
    }
  }
}
```

### 400: One of the provided values in the request body is invalid.
One of the provided values in the request query is invalid.

### 401: No description

### 403: No description

### 404: No description

### 429: No description

---

## Related

- [kms endpoints](/docs/rest-api#kms)

- [REST API overview](/docs/rest-api)

- [OpenAPI spec](https://openapi.vercel.sh/) (machine-readable, all endpoints)

---

[View full sitemap](/docs/sitemap)