---
title: "Sign a token"
method: POST
path: "/v1/kms/issuers/{issuerId}/sign/token"
tags: ["kms"]
---

# Sign a token

`POST /v1/kms/issuers/{issuerId}/sign/token`

Sign a JWT with a KMS issuer's active signing key. Authenticate the request with a Vercel OIDC token in the `Authorization: Bearer` header; the issuer's policies decide which workloads are allowed to sign.

## Path parameters

- `issuerId` string, required — The ID of the issuer.

## Request body

- object
  - `claims` object — The claims to include in the token.
  - `headers` object — Additional headers to include in the token.
  - `ttl` number, nullable — The time-to-live for the token, in seconds.

## Response `200`

- object
  - `token` string, required

## Other responses

- `400` — One of the provided values in the request body is invalid. One of the provided values in the request query is invalid.
- `401`
- `403`
- `404`
- `429`

---

[API](https://skmtc.net/vercel/apis/api.md) · [All operations](https://skmtc.net/vercel/apis/api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/vercel/api/revisions/915cc4809c98/schema)