Skip to content
Docs

Sign a message

POSThttps://api.vercel.com/v1/kms/issuers/{issuerId}/sign/message
Sign a raw message with a KMS issuer's active signing key. Authenticate the request with a Vercel OIDC token in the Authorization: Bearer header; the issuer's policies decide which workloads are allowed to sign. The response signature is standard-base64 of the raw signature over the decoded message bytes. keyId, algorithm, and fingerprint identify the signing key in the issuer's JWKS.
Request
import { Vercel } from "@vercel/sdk";


const vercel = new Vercel({
  bearerToken: "<YOUR_BEARER_TOKEN_HERE>",
});


async function run() {
  const result = await vercel.kms.signKmsMessage({
    issuerId: "<id>",
  });


  console.log(result);
}


run();
Response
{
  "algorithm": "string",
  "fingerprint": "string",
  "keyId": "example_id",
  "signature": "string"
}

Authentication

AuthorizationbearerToken

Default authentication mechanism

Path parameters

issuerIdstringRequired
The ID of the issuer.

Body

application/json
messagestringRequired
Base64-encoded message to be signed.

Response

200Success
algorithmstringRequired
Algorithm of the signing key.
fingerprintstringRequired
SHA-256 fingerprint of the signing key's public key (SHA256:<base64>).
keyIdstringRequired
Key id of the signing key. Matches the JWKS kid so verifiers can select the key after rotation without trial-verifying every published key.
signaturestringRequired
Standard-base64 encoding of the raw signature over the decoded message bytes.

Errors

400One of the provided values in the request body is invalid. One of the provided values in the request query is invalid.
401Error
403Error
404Error
429Error