kms

Sign a message

Changed on

Sign a raw message with a KMS issuer's active signing key. Authenticate the request with a Vercel OIDC token in the Authorization: Bearer header; the issuer's policies decide which workloads are allowed to sign. The response signature is standard-base64 of the raw signature over the decoded message bytes. keyId, algorithm, and fingerprint identify the signing key in the issuer's JWKS.

post/v1/kms/issuers/{issuerId}/sign/message

Request

  • Base URL: https://api.vercel.com
  • URL: https://api.vercel.com/v1/kms/issuers/{issuerId}/sign/message
  • Auth: HTTP bearer

Path parameters

issuerIdstring required

The ID of the issuer.

Request body

messagestring required

Base64-encoded message to be signed.

Response

algorithmstring required

Algorithm of the signing key.

fingerprintstring required

SHA-256 fingerprint of the signing key's public key (SHA256:<base64>).

keyIdstring required

Key id of the signing key. Matches the JWKS kid so verifiers can select the key after rotation without trial-verifying every published key.

signaturestring required

Standard-base64 encoding of the raw signature over the decoded message bytes.

Changes

  • dd6a90982ed0Revision changes
    • info

      added the required property to the response with the status

  • dde5ea976005Revision changes
    • breaking

      the response's property type changed from object to string for status

    • breaking

      removed the required property / from the response with the status

    • breaking

      removed the required property / from the response with the status

    • warning

      removed the optional property / from the response with the status

    • warning

      removed the optional property / from the response with the status

    • info

      added the required property to the response with the status

    • info

      added the required property to the response with the status