What changed
On August 18, Vercel added managed asymmetric signing to Vercel KMS in beta. Vercel Functions can now authenticate to KMS with their platform-issued OIDC identity and request JWT or raw-message signatures without receiving or storing the private signing key.
Why it matters
Private signing keys are a recurring secret-management liability in serverless applications: placing them in environment variables makes rotation, environment isolation and least-privilege access harder. Vercel's approach turns signing into an identity-authorized platform operation, while keeping verification standards-compatible through public OIDC discovery and JWKS endpoints.
Signing moves from an application secret to a platform capability
The important architectural change is not simply that Vercel can generate JWTs. A Function no longer needs a PEM or other private key in its deployment configuration. The Function authenticates using Vercel OIDC, KMS performs the signing operation, and the private key remains inside the managed service. That reduces the blast radius of leaked environment variables and removes private-key distribution from deployment workflows.
Access can be narrowed by project, environment and claims
KMS grants can authorize a specific project to sign only in production, preview, development or a custom environment. Vercel also lets teams constrain requested JWT claims and validate those claims against JSON Schema. That makes the signing boundary more useful than a generic secret because policy can be attached to the operation itself.
Tokens remain portable outside Vercel
Each issuer exposes an OpenID Connect discovery document and public JWKS endpoint. Downstream services can therefore validate tokens with standard JOSE or OIDC libraries rather than a Vercel-specific verifier. Vercel supports RSA, ECDSA and EdDSA keys, plus both JWT and arbitrary-byte signing.
The beta status is the main constraint
Vercel says KMS is available on all plans but remains beta, with features and behavior subject to change. The announcement does not state a separate KMS usage price, so builders should avoid assuming long-term free or bundled economics until Vercel documents billing explicitly.