Summary
On August 18, 2026, Vercel introduced KMS (public beta), a managed key service that lets Vercel Functions sign JWTs and messages with managed keys while keeping private keys out of application code and preserving OIDC authentication.
What changed
Vercel released KMS in public beta: sign JWTs and messages from Vercel Functions using managed keys, with private keys kept out of app code and OIDC auth maintained.
Why it matters
As agents and functions increasingly mint signed tokens and machine credentials, a managed signing service reduces secret-handling risk and supports agent identity and auth patterns without custom key infrastructure.
Evidence excerpt
Sign JWTs and messages from your Vercel Functions with managed keys.