Vercel KMS lets Functions sign JWTs with private keys that never enter your code or env vars

Vercel Changelog·medium signalXBlueskyLinkedInCopy link

Now in beta on all plans, Vercel KMS provides managed asymmetric signing over RSA, ECDSA, and EdDSA via the @vercel/kms package: sign JWTs with custom claims and TTL, sign raw bytes, and create or rotate issuers and keys from the CLI or dashboard, with verification through standard OIDC or JOSE libraries. The documented pattern is minting a short-lived JWT in a Function and passing it as a Bearer token to a downstream API, with a separate issuer per project and environment to isolate audiences. This removes one of the most common secret-sprawl footguns in serverless deployments — a long-lived private key sitting in an environment variable.