---
title: "Sign a message"
method: POST
path: "/v1/kms/issuers/{issuerId}/sign/message"
tags: ["kms"]
---

# Sign a message

`POST /v1/kms/issuers/{issuerId}/sign/message`

## Request

- Base URL: `https://api.vercel.com`
- URL: `https://api.vercel.com/v1/kms/issuers/{issuerId}/sign/message`
- Auth: HTTP bearer

Sign a raw message with a KMS issuer's active signing key. Authenticate the request with a Vercel OIDC token in the `Authorization: Bearer` header; the issuer's policies decide which workloads are allowed to sign. The response `signature` is standard-base64 of the raw signature over the decoded message bytes. `keyId`, `algorithm`, and `fingerprint` identify the signing key in the issuer's JWKS.

## Path parameters

- `issuerId` string, required: The ID of the issuer.

## Request body

- object
  - `message` string, required: Base64-encoded message to be signed.

## Response `200`

- object
  - `algorithm` string, required: Algorithm of the signing key.
  - `fingerprint` string, required: SHA-256 fingerprint of the signing key's public key (`SHA256:<base64>`).
  - `keyId` string, required: Key id of the signing key. Matches the JWKS `kid` so verifiers can select the key after rotation without trial-verifying every published key.
  - `signature` string, required: Standard-base64 encoding of the raw signature over the decoded message bytes.

## Other responses

- `400`: One of the provided values in the request body is invalid. One of the provided values in the request query is invalid.
- `401`
- `403`
- `404`
- `429`

## Changes

- **2026-09-24** `dd6a90982ed0`: 1 info
  - added the required property `fingerprint` to the response with the `200` status
- **2026-09-15** `dde5ea976005`: 3 breaking, 2 warning, 2 info
  - the `signature` response's property type changed from `object` to `string` for status `200`
  - removed the required property `signature/payload` from the response with the `200` status
  - removed the required property `signature/signature` from the response with the `200` status
  - removed the optional property `signature/header` from the response with the `200` status
  - …3 more
- **2026-08-19** `6b6e0450635c`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/vercel/apis/vercel-api/changes/v1/kms/issuers/:issuerId/sign/message/post.md)

---

[API](https://skmtc.dev/vercel/apis/vercel-api.md) - [All operations](https://skmtc.dev/vercel/apis/vercel-api/llms.txt) - [OpenAPI document](https://skmtc.dev/vercel/apis/vercel-api/revisions/60686c0e1f6a?raw)