kms

Create a signing key

Changed on

Create a new signing key for a KMS issuer. Depending on the activation mode, the key is activated automatically once its public key has propagated, or manually via the activate endpoint.

post/v1/kms/issuers/{issuerId}/keys

Request

  • Base URL: https://api.vercel.com
  • URL: https://api.vercel.com/v1/kms/issuers/{issuerId}/keys
  • Auth: HTTP bearer

Path parameters

issuerIdstring required

The ID of the issuer.

Query parameters

teamIdstring
Example:team_1a2b3c4d5e6f7g8h9i0j1k2l

The Team identifier to perform the request on behalf of.

slugstring
Example:my-team-url-slug

The Team slug to perform the request on behalf of.

Request body

activation'automatic' | 'manual'

Whether the new key is activated automatically after its public key has propagated, or manually via the activate endpoint. Defaults to automatic.

revokePreviousAfterHoursnumber

For automatic activation, how many hours after activation the previous signing key should stop being used. Defaults to a 1 hour grace period so already-issued tokens keep verifying.

importKeystring

The PEM-encoded private key to use for the issuer.

importKeyIdstring

The key id to use as the imported key's JWT/JWKS kid. Only allowed when importKey is provided. Not required to be unique; the addressable key id is the server-minted keyId returned in the response.

Response

activateAtstring
activatedAtstring

When the key became the active signer. Present for active and revoking keys (and absent for pending keys and rows predating this field).

algorithmstring required
certificatePemstring

The stored X.509 certificate (from publicKey.x5c[0]) in PEM form, ready to render. Present only for keys created with a stored certificate; omitted for keys created before certificates were stored.

createdAtstring required
importKeyIdstring

The caller-supplied key id (imported keys only), used as the JWT/JWKS kid. Not unique across an issuer's keys; omitted for generated keys.

issuerIdstring required
keyIdstring required

The server-minted, unique record identifier. Use this to address the key on the activate / certificate endpoints.

publicKeyFingerprintstring required
publicKeyPemstring

The public key in SPKI PEM form, ready to render. Present whenever the key has public key material. Derived from publicKey; the embedded certificate members (x5c/x5t#S256) do not affect it.

revokeAtstring
status'active' | 'pending' | 'revoking' required
updatedAtstring required

Changes