Vercel Adds JWT signing without managing private keys to Functions.

Vercel is moving one of authentication’s more sensitive jobs out of application code. Its new JWT signing without managing private keys feature lets Vercel Functions issue signed tokens while the underlying private key remains inside the company’s managed key service.

The update, announced in Vercel’s changelog on August 18, uses Vercel KMS and the platform’s OpenID Connect authentication. It is designed to reduce the operational burden associated with storing, protecting and rotating cryptographic keys, particularly for small teams running authentication or service-to-service authorization from serverless functions.

Previously, developers commonly supplied a private signing key through an environment variable or connected their application to a separate key management system. The first approach can create a high-value secret that must be distributed across environments. The second is more robust, but adds configuration, permissions and infrastructure that smaller teams may not want to maintain.

A Vercel Function authenticates to the signing service using its Vercel OIDC token. Vercel KMS then signs the JWT without returning or exposing the private key to the function. Applications and external services can verify the resulting signature using the corresponding public key.

That separation is the core security improvement. If application code, logs or environment configuration are exposed, the signing key is not present in those locations. The key remains within Vercel’s key management service, while the function receives only the signed output it requested.

Vercel says developers can use the service to:

• Create and rotate issuers and signing keys through the dashboard or CLI
• Choose RSA, ECDSA or EdDSA asymmetric signing keys
• Add custom claims to JWTs
• Configure a token’s time to live
• Sign arbitrary raw bytes as well as JWTs

Support for raw messages broadens the feature beyond login sessions. A function could use managed signing for webhook payloads, short-lived access grants or messages exchanged between services, provided the receiving system can verify the signature with the public key.

JWT signing is straightforward at the API level, but the surrounding key lifecycle is not. A compromised private key can allow an attacker to mint apparently valid tokens until the key is revoked and every verifier is updated. Teams must also decide where keys are generated, who can access them and how rotation works without interrupting production traffic.

Vercel’s approach consolidates those responsibilities inside the deployment platform. Key creation and rotation are available from the CLI and dashboard, giving teams a managed path without embedding private material in source code or deployment settings. It also reduces the need to build a separate credentials flow between a Function and an external signing provider, since workload authentication uses Vercel OIDC.

The launch fits a wider effort to bring more application infrastructure into Vercel’s platform rather than leaving developers to assemble it separately. It follows updates such as user-owned GitHub deployments for Vercel for Platforms, another feature aimed at reducing the amount of sensitive credential handling required inside customer applications.

There are still implementation decisions for builders. Developers must define appropriate claims and token lifetimes, distribute public-key information to verifiers and plan how those verifiers respond to rotation. Managed signing protects the private key and simplifies its lifecycle, but it does not automatically make every JWT design secure. Short expiration periods, narrow permissions and careful validation remain important.

Vercel’s announcement does not specify separate pricing, plan requirements or usage limits for the feature. Teams considering it should therefore confirm current account availability and billing details in the dashboard or platform documentation before adopting it for production workloads.

What is Vercel JWT signing without managing private keys?

It is a Vercel KMS capability that lets Vercel Functions sign JWTs while the private signing key stays inside Vercel’s managed key service. Functions authenticate using Vercel OIDC, and receiving systems verify tokens with the associated public key.

Which signing algorithms does Vercel support?

Vercel says managed signing keys can use RSA, ECDSA and EdDSA. Developers can create and rotate issuers and keys through the Vercel CLI or dashboard.

Can it sign data other than JWTs?

Yes. In addition to JWTs with custom claims and configurable lifetimes, Vercel KMS can sign arbitrary raw bytes. The announcement does not provide separate pricing or plan requirements for either use case.