# Sign JWTs from your Functions without managing private keys

DevFeed: [Sign JWTs from your Functions without managing private keys](<https://devfeed.tech/articles/sign-jwts-from-your-functions-without-managing-private-keys-1097.md>)

Original publisher: [Read original article](<https://vercel.com/changelog/sign-jwts-from-your-functions-without-managing-private-keys>)

Author: Jeff Pope

Published: 2026-08-18T00:00:00Z

Content type: release

Language: en

Sources: [Vercel News](<https://devfeed.tech/sources/vercel-news.md>)

Topics: [Vercel](<https://devfeed.tech/topics/vercel.md>), [JSON Web Tokens](<https://devfeed.tech/topics/jwt.md>), [OpenID connect (OIDC)](<https://devfeed.tech/topics/oidc.md>), [JSON Schema](<https://devfeed.tech/topics/json-schema.md>), [Command-line interface](<https://devfeed.tech/topics/cli.md>), [dashboards](<https://devfeed.tech/topics/dashboards.md>)

Tags: [cli](<https://devfeed.tech/tags/cli.md>), [configuration](<https://devfeed.tech/tags/configuration.md>), [jwks](<https://devfeed.tech/tags/jwks.md>), [oidc](<https://devfeed.tech/tags/oidc.md>), [openid-connect](<https://devfeed.tech/tags/openid-connect.md>), [rsa](<https://devfeed.tech/tags/rsa.md>), [tokens](<https://devfeed.tech/tags/tokens.md>), [vercel](<https://devfeed.tech/tags/vercel.md>)

## AI overview

Vercel KMS enables Vercel Functions to sign JWTs and arbitrary messages with managed asymmetric keys, keeping private keys out of application code and environment variables. It supports issuer and key management, environment-specific access grants, claim constraints, JSON Schema validation, and standard OIDC and JWKS-based verification.

## Source excerpt

Vercel KMS lets you sign JWTs and arbitrary messages from your Vercel Functions using managed asymmetric signing keys, so private keys never live in your code or environment variables. Your function authenticates with its Vercel OIDC token, and the private key stays inside Vercel's key management service while verifiers use only the public key. With Vercel KMS you can: Create and rotate issuers and signing keys (RSA, ECDSA, and EdDSA) from the CLI and dashboard. Sign JWTs with custom claims and a configurable TTL, or sign raw bytes, using the @vercel/kms package. Grant a project signing access per environment, including production, preview, development, and custom environments. Constrain the claims a project can request per grant, and validate token claims against a JSON Schema. Verify signed tokens anywhere. Each issuer publishes a public OpenID Connect Discovery document at https://kms.vercel.com/<issuerId>/.well-known/openid-configuration and a JWK set at https://kms.vercel.com/<issuerId>/jwks.json, so any standard OIDC or JOSE library can validate tokens without Vercel-specific code. Sign a token inside a function: Verify a token anywhere with a standard JOSE library, using the issuer's public JWKS: Set up an issuer and grant a project access from the CLI: As a best practice, create a separate issuer per project and environment. Isolating issuers keeps each token audience distinct, scopes signing access to exactly one project and environment, and lets you rotate or revoke keys for one without affecting the others. To get started, read the docs or open Key Management in your team's dashboard. Read more