What shipped?
Vercel KMS entered public beta — a managed key management service that lets your Functions sign JWTs and arbitrary messages without ever storing private keys in code or environment variables.
What changed?
You can now create and rotate issuers and signing keys (RSA, ECDSA, and EdDSA) from the Vercel CLI and dashboard. Your function authenticates using its OIDC token, and the private key stays inside Vercel's key management service. Verifiers receive only the public key. Keys never touch your deployment artifacts, env files, or secret store.
Why does a builder care?
Every project that issues custom JWTs — for OIDC integration, service-to-service auth, or webhook signing — has been doing key management manually: generate, store, rotate, hope nothing leaks. Vercel KMS eliminates that entire surface. One CLI command, and your function can sign arbitrary payloads with a managed key that rotates without a redeploy. The OIDC auth flow means even the function identity is tied to the deployment, not a shared secret.