# Vercel KMS lets Functions sign JWTs without holding private keys Vercel has put managed asymmetric signing into beta on every plan, letting Functions mint JWTs and signatures through KMS while keeping private keys out of code and environment variables. Vercel KMS gives Functions OIDC-authenticated access to managed RSA, ECDSA and EdDSA signing keys. Builders can scope grants by project and environment, constrain JWT claims with JSON Schema, rotate keys centrally and publish standard OIDC/JWKS metadata for verification outside Vercel. - Status: Active - Published: 2026-08-19T06:23:55+12:00 - Updated: 2026-08-19T06:23:55+12:00 - Categories: Web Development, Cloud & Infrastructure, Cloud Platforms, Developer Tools - Tags: JWKS, JWT, key management, KMS, OIDC, serverless security, Vercel, Vercel Functions - Canonical HTML: https://beyondthe.news/dossiers/vercel-kms-functions-managed-jwt-signing ## What changed On August 18, Vercel added managed asymmetric signing to Vercel KMS in beta. Vercel Functions can now authenticate to KMS with their platform-issued OIDC identity and request JWT or raw-message signatures without receiving or storing the private signing key. ## Why it matters Private signing keys are a recurring secret-management liability in serverless applications: placing them in environment variables makes rotation, environment isolation and least-privilege access harder. Vercel's approach turns signing into an identity-authorized platform operation, while keeping verification standards-compatible through public OIDC discovery and JWKS endpoints. ## Signing moves from an application secret to a platform capability The important architectural change is not simply that Vercel can generate JWTs. A Function no longer needs a PEM or other private key in its deployment configuration. The Function authenticates using Vercel OIDC, KMS performs the signing operation, and the private key remains inside the managed service. That reduces the blast radius of leaked environment variables and removes private-key distribution from deployment workflows. ## Access can be narrowed by project, environment and claims KMS grants can authorize a specific project to sign only in production, preview, development or a custom environment. Vercel also lets teams constrain requested JWT claims and validate those claims against JSON Schema. That makes the signing boundary more useful than a generic secret because policy can be attached to the operation itself. ## Tokens remain portable outside Vercel Each issuer exposes an OpenID Connect discovery document and public JWKS endpoint. Downstream services can therefore validate tokens with standard JOSE or OIDC libraries rather than a Vercel-specific verifier. Vercel supports RSA, ECDSA and EdDSA keys, plus both JWT and arbitrary-byte signing. ## The beta status is the main constraint Vercel says KMS is available on all plans but remains beta, with features and behavior subject to change. The announcement does not state a separate KMS usage price, so builders should avoid assuming long-term free or bundled economics until Vercel documents billing explicitly. ## Key details - Announced August 18, 2026. - Vercel KMS is beta and available on all Vercel plans. - Functions authenticate to KMS with Vercel OIDC; private signing keys do not enter code or environment variables. - Supported key families include RSA, ECDSA and EdDSA. - The @vercel/kms package can sign JWTs with custom claims and TTLs or sign raw bytes. - Grants can be scoped by project and environment. - JWT claims can be constrained and validated against JSON Schema. - Each issuer exposes standard OIDC discovery metadata and a JWKS endpoint for external verification. - Vercel recommends a separate issuer per project and environment. - The CLI flow requires Vercel CLI 59.1.0 or later. ## Builder takeaways - Replace long-lived JWT private keys stored in Vercel environment variables with KMS-backed signing where the application only needs signing capability, not direct key export. - Create separate issuers for production and non-production workloads so rotation or revocation does not couple unrelated environments. - Use claim constraints and JSON Schema validation to prevent a compromised Function from minting broader tokens than its intended role permits. - Keep downstream verification standards-based by consuming the issuer's JWKS endpoint with a normal JOSE/OIDC library. - Treat the service as beta in production risk reviews and verify billing before designing very high-volume signing workloads around it. ## What to watch - Whether Vercel publishes dedicated KMS pricing or usage limits. - When KMS reaches general availability and whether the API or grant model changes before then. - Whether Vercel extends managed signing to encryption/decryption or additional hardware-backed key operations. - Whether audit-log and compliance controls become detailed enough for regulated workloads. ## Uncertainties - Vercel's announcement says KMS is available on all plans but does not specify separate usage pricing or long-term billing terms. - Because the service is beta, behavior and supported features may change before general availability. ## Timeline - **2026-08-18 — Managed signing announced:** Vercel announced KMS-backed JWT and arbitrary-message signing for Vercel Functions. ## Sources - [Sign JWTs from your Functions without managing private keys](https://vercel.com/changelog/sign-jwts-from-your-functions-without-managing-private-keys) — Vercel · primary · 2026-08-18T00:00:00+12:00. Primary launch announcement describing managed asymmetric signing, OIDC authentication, grants, claim constraints and JWKS/OIDC verification.