Vercel KMS Connect Grants
A Connect grant is an issuer policy (connex-grant) that lets Vercel Connect sign with the issuer on behalf of your team. Unlike a project grant, which only signs, a Connect grant also lets Connect provision the issuer.
A Connect grant is identified by a Vercel Connect client ID. A request that presents a valid Connect token for that client ID can both create the issuer and sign with it, so Connect can manage signing for your team without a deployment OIDC token.
Vercel Connect creates and manages Connect grants. You do not create or manage them directly; they exist on issuers that Connect provisions on your behalf.
| Field | Description |
|---|---|
clientId | The Vercel Connect client that may provision and sign with the issuer. |
KMS verifies a token issued by Vercel Connect, https://connect.vercel.com, and checks that:
- the token's client ID matches the grant's
clientId. - the token's team matches the issuer's owning team.
- the token's audience matches the issuer URL (
https://kms.vercel.com/<issuerId>) when signing, or the KMS host (https://kms.vercel.com) when provisioning a new issuer.
If any check fails, KMS rejects the request.
Was this helpful?