signing_keys

Creates, updates, deletes, gets or lists a signing_keys resource.

Overview

Name	signing_keys
Type	Resource
Id	vercel.kms.signing_keys

Fields

The following fields are returned by SELECT queries:

SELECT not supported for this resource, use SHOW METHODS to view available operations for the resource.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
create	insert	issuer_id	team_id, slug	Create a new signing key for a KMS issuer. Depending on the activation mode, the key is activated automatically once its public key has propagated, or manually via the activate endpoint.
activate	exec	issuer_id, key_id	teamId, slug	Activate a pending signing key so the issuer starts signing with it.
revoke	exec	issuer_id, key_id	teamId, slug	Immediately revoke a signing key that is already scheduled for revocation.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
issuer_id	string	The ID of the issuer.
key_id	string	The ID of the signing key to revoke immediately. The key must already be scheduled for revocation.
slug	string	The Team slug to perform the request on behalf of.
teamId	string	The Team identifier to perform the request on behalf of.
team_id	string	The Team identifier to perform the request on behalf of. (wire: teamId)

INSERT examples

create

Create a new signing key for a KMS issuer. Depending on the activation mode, the key is activated automatically once its public key has propagated, or manually via the activate endpoint.

INSERT INTO vercel.kms.signing_keys (
activation,
revoke_previous_after_hours,
revoke_previous_at,
import_key,
import_key_id,
issuer_id,
team_id,
slug
)
SELECT 
'{{ activation }}',
{{ revoke_previous_after_hours }},
'{{ revoke_previous_at }}',
'{{ import_key }}',
'{{ import_key_id }}',
'{{ issuer_id }}',
'{{ team_id }}',
'{{ slug }}'
RETURNING
import_key_id,
issuer_id,
key_id,
activate_at,
activated_at,
algorithm,
certificate_pem,
created_at,
public_key,
public_key_fingerprint,
public_key_pem,
revoke_at,
status,
updated_at
;

Manifest

# Description fields are for documentation purposes
- name: signing_keys
props:
  - name: issuer_id
    value: "{{ issuer_id }}"
    description: Required parameter for the signing_keys resource.
  - name: activation
    value: "{{ activation }}"
    description: |
      Whether the new key is activated automatically after its public key has propagated, or manually via the activate endpoint. Defaults to `automatic`.
    valid_values: ['automatic', 'manual']
  - name: revoke_previous_after_hours
    value: {{ revoke_previous_after_hours }}
    description: |
      For automatic activation, how many hours after activation the previous signing key should stop being used. Defaults to a 1 hour grace period so already-issued tokens keep verifying.
  - name: revoke_previous_at
    value: "{{ revoke_previous_at }}"
    description: |
      Deprecated. The ISO date string or timestamp when the previous signing key should stop being used. Converted to a relative grace and applied at activation, not creation. Prefer revokePreviousAfterHours.
  - name: import_key
    value: "{{ import_key }}"
    description: |
      The PEM-encoded private key to use for the issuer.
  - name: import_key_id
    value: "{{ import_key_id }}"
    description: |
      The key id to use as the imported key's JWT/JWKS `kid`. Only allowed when `importKey` is provided. Not required to be unique; the addressable key id is the server-minted `keyId` returned in the response.
  - name: team_id
    value: "{{ team_id }}"
    description: The Team identifier to perform the request on behalf of.
    description: The Team identifier to perform the request on behalf of.
  - name: slug
    value: "{{ slug }}"
    description: The Team slug to perform the request on behalf of.
    description: The Team slug to perform the request on behalf of.

Lifecycle Methods

EXEC variables use wire (API) names.

activate

Activate a pending signing key so the issuer starts signing with it.

EXEC vercel.kms.signing_keys.activate 
@issuer_id='{{ issuer_id }}' --required, 
@key_id='{{ key_id }}' --required, 
@teamId='{{ teamId }}', 
@slug='{{ slug }}' 
@@json=
'{
"revokePreviousAfterHours": {{ revokePreviousAfterHours }}
}'
;

revoke

Immediately revoke a signing key that is already scheduled for revocation.

EXEC vercel.kms.signing_keys.revoke 
@issuer_id='{{ issuer_id }}' --required, 
@key_id='{{ key_id }}' --required, 
@teamId='{{ teamId }}', 
@slug='{{ slug }}'
;