VEvercel
kms

Sign a token

Changed on

Sign a JWT with a KMS issuer's active signing key. Authenticate the request with a Vercel OIDC token in the Authorization: Bearer header; the issuer's policies decide which workloads are allowed to sign. keyId, algorithm, and fingerprint identify the signing key in the issuer's JWKS.

post/v1/kms/issuers/{issuerId}/sign/token

Request

  • Base URL
    https://api.vercel.com
  • URL
    https://api.vercel.com/v1/kms/issuers/{issuerId}/sign/token
  • Auth
    HTTP bearer

Path parameters

issuerIdstring required

The ID of the issuer.

Request body

claimsobject

The claims to include in the token.

headersobject

Additional headers to include in the token.

ttlnumber nullable

The time-to-live for the token, in seconds.

Response

algorithmstring required

Algorithm of the signing key.

fingerprintstring required

SHA-256 fingerprint of the signing key's public key (SHA256:<base64>).

keyIdstring required

Key id of the signing key. Matches the JWKS kid so verifiers can select the key after rotation without trial-verifying every published key.

tokenstring required

Compact JWT signed by the issuer's active signing key.

Changes

  • dd6a90982ed0Revision changes
    • info

      added the required property to the response with the status

    • info

      added the required property to the response with the status

    • info

      added the required property to the response with the status

  • 6b6e0450635cRevision changes
    • info

      endpoint added