Skip to content
Docs

Create an issuer

POST/__remote/api.vercel.com/v1/kms/issuers
Create a new KMS issuer for the authenticated team, or for the team or organization identified by a Connect policy token. An issuer owns the asymmetric signing keys used to sign tokens and messages.
/__remote/api.vercel.com/v1/kms/issuers
const response = await fetch('/__remote/api.vercel.com/v1/kms/issuers?teamId=string&slug=string', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer YOUR_ACCESS_TOKEN',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "name": "Example Name",
    "algorithm": "RS256",
    "claimsSchema": "value",
    "policy": {
      "kind": "project-grant",
      "teamId": "example_id",
      "projectId": "example_id",
      "environments": [],
      "tokenClaims": "value"
    },
    "importKey": "string",
    "importKeyId": "example_id"
  }),
});


const data = await response.json();
console.log(data);
Response
{
  "algorithm": "ES256",
  "claimsSchema": "value",
  "createdAt": "string",
  "id": "icfg_1234567890",
  "managedBy": "string",
  "name": "Example Name",
  "origin": "external",
  "ownerId": "example_id",
  "policies": [
    {
      "createdAt": "string",
      "environments": [],
      "kind": "project-grant",
      "projectId": "example_id",
      "teamId": "example_id",
      "tokenClaims": "value",
      "updatedAt": "string"
    }
  ],
  "signingKeys": [
    {
      "activateAt": "string",
      "activatedAt": "string",
      "algorithm": "string",
      "certificatePem": "string",
      "createdAt": "string",
      "importKeyId": "example_id",
      "issuerId": "example_id",
      "keyId": "example_id",
      "publicKey": {
        "alg": "string",
        "key_ops": [],
        "kid": "example_id",
        "kty": "string",
        "use": "string",
        "x5c": [],
        "x5t#S256": "string"
      },
      "publicKeyFingerprint": "string",
      "publicKeyPem": "string",
      "revokeAt": "string",
      "status": "active",
      "updatedAt": "string"
    }
  ],
  "updatedAt": "string"
}

Authentication

AuthorizationbearerToken

Default authentication mechanism

Query parameters

teamIdstringOptional
The Team identifier to perform the request on behalf of.
slugstringOptional
The Team slug to perform the request on behalf of.

Body

application/json
namestringRequired
The name of the issuer.
algorithmstringOptional
The signing algorithm to use for the issuer.
claimsSchemaobjectOptional
A JSON Schema used to validate the resolved token claims when signing tokens for this issuer.
policyobjectOptional2 variants
importKeystringOptional
The PEM-encoded private key to use for the issuer.
importKeyIdstringOptional
The key id to use as the imported key's JWT/JWKS kid. Only allowed when importKey is provided. Not required to be unique; the addressable key id is the server-minted keyId returned in the response.

Response

201Success
algorithmstringRequired
claimsSchemaobjectOptional
createdAtstringRequired
idstringRequired
managedBystringOptional
namestringRequired
originstringRequired
ownerIdstringRequired
policiesarrayRequired
signingKeysarrayRequired
updatedAtstringRequired

Errors

400One of the provided values in the request body is invalid.
401The request is not authorized.
403You do not have permission to access this resource.
404Error
410Error