Signing JWTs in Vercel Functions Without Private Key Management

Vercel KMS provides the ability to sign JWTs and arbitrary messages in Vercel Functions using managed asymmetric signing keys. This allows you to maintain security without directly exposing private keys in code or environment variables. Functions authenticate with Vercel OIDC tokens, and private keys are securely stored within Vercel's key management service.

Key features include:

• Creation and rotation of Issuers and signing keys (RSA, ECDSA, EdDSA) via CLI and dashboard
• Custom claims, TTL configuration, and raw byte signing using the @vercel/kms package
• Project signing permissions per environment (production, preview, development)
• Token claim validation and request throttling via JSON Schema
• Token verification from anywhere using standard OIDC and JOSE libraries (JWKS provided)

For security, it is recommended to create separate issuers for each project and environment. This clearly distinguishes the Audience for each token and isolates environments so that rotating or revoking specific keys does not affect others.

Currently, Vercel KMS is in beta and available on all plans.