---
title: "Sign a message"
method: POST
path: "/v1/kms/issuers/{issuerId}/sign/message"
tags: ["kms"]
---

# Sign a message

`POST /v1/kms/issuers/{issuerId}/sign/message`

Sign a raw message with a KMS issuer's active signing key. Authenticate the request with a Vercel OIDC token in the `Authorization: Bearer` header; the issuer's policies decide which workloads are allowed to sign.

## Path parameters

- `issuerId` string, required — The ID of the issuer.

## Request body

- object
  - `message` string, required — Base64-encoded message to be signed.

## Response `200`

- object
  - `signature` object, required — Flattened JWS JSON Serialization Syntax token. Payload is returned as an empty string when JWS Unencoded Payload ({@link https://www.rfc-editor.org/rfc/rfc7797 RFC7797}) is used.
    - `payload` string, required
    - `signature` string, required
    - `header` object — The "header" member MUST be present and contain the value JWS Unprotected Header when the JWS Unprotected Header value is non- empty; otherwise, it MUST be absent. This value is represented as an unencoded JSON object, rather than as a string. These Header Parameter values are not integrity protected.
      - `alg` string — JWS "alg" (Algorithm) Header Parameter
      - `b64` false | true — This JWS Extension Header Parameter modifies the JWS Payload representation and the JWS Signing Input computation as per {@link https://www.rfc-editor.org/rfc/rfc7797 RFC7797}.
      - `crit` string[] — JWS "crit" (Critical) Header Parameter
      - `kid` string — "kid" (Key ID) Header Parameter
      - `x5t` string — "x5t" (X.509 Certificate SHA-1 Thumbprint) Header Parameter
      - `x5c` string[] — "x5c" (X.509 Certificate Chain) Header Parameter
      - `x5u` string — "x5u" (X.509 URL) Header Parameter
      - `jku` string — "jku" (JWK Set URL) Header Parameter
      - `jwk` object — "jwk" (JSON Web Key) Header Parameter
        - `kty` string — JWK "kty" (Key Type) Parameter
        - `crv` string — - EC JWK "crv" (Curve) Parameter - OKP JWK "crv" (The Subtype of Key Pair) Parameter
        - `x` string — - EC JWK "x" (X Coordinate) Parameter - OKP JWK "x" (The public key) Parameter
        - `y` string — EC JWK "y" (Y Coordinate) Parameter
        - `e` string — RSA JWK "e" (Exponent) Parameter
        - `n` string — RSA JWK "n" (Modulus) Parameter
        - `alg` string — JWK "alg" (Algorithm) Parameter
        - `pub` string — AKP JWK "pub" (Public Key) Parameter
      - `typ` string — "typ" (Type) Header Parameter
      - `cty` string — "cty" (Content Type) Header Parameter
    - `protected` string — The "protected" member MUST be present and contain the value BASE64URL(UTF8(JWS Protected Header)) when the JWS Protected Header value is non-empty; otherwise, it MUST be absent. These Header Parameter values are integrity protected.

## Other responses

- `400` — One of the provided values in the request body is invalid. One of the provided values in the request query is invalid.
- `401`
- `403`
- `404`
- `429`

---

[API](https://skmtc.net/vercel/apis/api.md) · [All operations](https://skmtc.net/vercel/apis/api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/vercel/api/revisions/915cc4809c98/schema)