Skip to content
Docs

Activate a signing key

POSThttps://api.vercel.com/v1/kms/issuers/{issuerId}/keys/{keyId}/activate
Activate a pending signing key so the issuer starts signing with it.
Request
import { Vercel } from "@vercel/sdk";


const vercel = new Vercel({
  bearerToken: "<YOUR_BEARER_TOKEN_HERE>",
});


async function run() {
  const result = await vercel.kms.activateKmsSigningKey({
    issuerId: "<id>",
    keyId: "<id>",
    teamId: "team_1a2b3c4d5e6f7g8h9i0j1k2l",
    slug: "my-team-url-slug",
  });


  console.log(result);
}


run();
Response
{
  "activateAt": "string",
  "activatedAt": "string",
  "algorithm": "string",
  "certificatePem": "string",
  "createdAt": "string",
  "importKeyId": "example_id",
  "issuerId": "example_id",
  "keyId": "example_id",
  "publicKey": {
    "alg": "string",
    "key_ops": [],
    "kid": "example_id",
    "kty": "string",
    "use": "string",
    "x5c": [],
    "x5t#S256": "string"
  },
  "publicKeyFingerprint": "string",
  "publicKeyPem": "string",
  "revokeAt": "string",
  "status": "active",
  "updatedAt": "string"
}

Authentication

AuthorizationbearerToken

Default authentication mechanism

Path parameters

issuerIdstringRequired
The ID of the issuer.
keyIdstringRequired
The ID of the pending signing key to activate.

Query parameters

teamIdstringOptional
The Team identifier to perform the request on behalf of.
slugstringOptional
The Team slug to perform the request on behalf of.

Body

application/json
revokePreviousAfterHoursnumberOptional
How many hours after activation the previously-active key should stop being used. Defaults to a 1 hour grace period so already-issued tokens keep verifying.

Response

200Success
activateAtstringOptional
activatedAtstringOptional
When the key became the active signer. Present for active and revoking keys (and absent for pending keys and rows predating this field).
algorithmstringRequired
certificatePemstringOptional
The stored X.509 certificate (from publicKey.x5c[0]) in PEM form, ready to render. Present only for keys created with a stored certificate; omitted for keys created before certificates were stored.
createdAtstringRequired
importKeyIdstringOptional
The caller-supplied key id (imported keys only), used as the JWT/JWKS kid. Not unique across an issuer's keys; omitted for generated keys.
issuerIdstringRequired
keyIdstringRequired
The server-minted, unique record identifier. Use this to address the key on the activate / certificate endpoints.
publicKeyobjectOptional
publicKeyFingerprintstringRequired
publicKeyPemstringOptional
The public key in SPKI PEM form, ready to render. Present whenever the key has public key material. Derived from publicKey; the embedded certificate members (x5c/x5t#S256) do not affect it.
revokeAtstringOptional
statusstringRequired
updatedAtstringRequired

Errors

400One of the provided values in the request body is invalid. One of the provided values in the request query is invalid.
401The request is not authorized.
403You do not have permission to access this resource.
404Error
409Error
410Error