Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. Vercel Provider
  4. API Docs
  5. KmsIssuer
Viewing docs for Vercel v5.21.1
published on Thursday, Oct 15, 2026 by Pulumiverse
Schema (JSON)
pulumiverse/pulumi-vercel

vercel.KmsIssuer

vercel logo vercel logo
Viewing docs for Vercel v5.21.1
published on Thursday, Oct 15, 2026 by Pulumiverse
Schema (JSON)
pulumiverse/pulumi-vercel

    Provides a Vercel KMS Issuer resource.

    Note: Vercel KMS is currently in beta. Its resources, data sources, and the underlying API may change in backwards-incompatible ways in future releases of the provider.

    A KMS Issuer signs JSON Web Tokens (JWTs) and exposes a JWKS endpoint at https://kms.vercel.com/{id}/jwks.json. An initial signing key is created automatically; use vercel.KmsSigningKey to rotate keys and vercel.KmsProjectGrant to grant projects the ability to sign tokens.

    Create KmsIssuer Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new KmsIssuer(name: string, args?: KmsIssuerArgs, opts?: CustomResourceOptions);
    @overload
def KmsIssuer(resource_name: str,
              args: Optional[KmsIssuerArgs] = None,
              opts: Optional[ResourceOptions] = None)

@overload
def KmsIssuer(resource_name: str,
              opts: Optional[ResourceOptions] = None,
              algorithm: Optional[str] = None,
              import_key: Optional[str] = None,
              import_key_id: Optional[str] = None,
              name: Optional[str] = None,
              team_id: Optional[str] = None)
    func NewKmsIssuer(ctx *Context, name string, args *KmsIssuerArgs, opts ...ResourceOption) (*KmsIssuer, error)
    public KmsIssuer(string name, KmsIssuerArgs? args = null, CustomResourceOptions? opts = null)
    public KmsIssuer(String name, KmsIssuerArgs args)
public KmsIssuer(String name, KmsIssuerArgs args, CustomResourceOptions options)

    type: vercel:KmsIssuer
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "vercel_kms_issuer" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args KmsIssuerArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args KmsIssuerArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args KmsIssuerArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args KmsIssuerArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args KmsIssuerArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var kmsIssuerResource = new Vercel.KmsIssuer("kmsIssuerResource", new()
{
    Algorithm = "string",
    ImportKey = "string",
    ImportKeyId = "string",
    Name = "string",
    TeamId = "string",
});

    example, err := vercel.NewKmsIssuer(ctx, "kmsIssuerResource", &vercel.KmsIssuerArgs{
	Algorithm:   pulumi.String("string"),
	ImportKey:   pulumi.String("string"),
	ImportKeyId: pulumi.String("string"),
	Name:        pulumi.String("string"),
	TeamId:      pulumi.String("string"),
})

    resource "vercel_kms_issuer" "kmsIssuerResource" {
  lifecycle {
    create_before_destroy = true
  }
  algorithm     = "string"
  import_key    = "string"
  import_key_id = "string"
  name          = "string"
  team_id       = "string"
}

    var kmsIssuerResource = new KmsIssuer("kmsIssuerResource", KmsIssuerArgs.builder()
    .algorithm("string")
    .importKey("string")
    .importKeyId("string")
    .name("string")
    .teamId("string")
    .build());

    kms_issuer_resource = vercel.KmsIssuer("kmsIssuerResource",
    algorithm="string",
    import_key="string",
    import_key_id="string",
    name="string",
    team_id="string")

    const kmsIssuerResource = new vercel.KmsIssuer("kmsIssuerResource", {
    algorithm: "string",
    importKey: "string",
    importKeyId: "string",
    name: "string",
    teamId: "string",
});

    type: vercel:KmsIssuer
properties:
    algorithm: string
    importKey: string
    importKeyId: string
    name: string
    teamId: string

    KmsIssuer Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The KmsIssuer resource accepts the following input properties:

    Algorithm string
    The signing algorithm to use for the issuer. Defaults to RS512. Changing this forces a new issuer to be created.
    ImportKey string
    A PEM-encoded private key to import for the issuer. When provided, the issuer's origin becomes external and the algorithm is inferred from the key. Changing this forces a new issuer to be created. This value is never returned by the API and cannot be recovered on import.
    ImportKeyId string
    The key ID (kid) to assign to the imported key. Only valid when import_key is set. Changing this forces a new issuer to be created.
    Name string
    The name of the issuer.
    TeamId string
    The ID of the team the issuer should be created under. Required when configuring a team resource if a default team has not been set in the provider.
    Algorithm string
    The signing algorithm to use for the issuer. Defaults to RS512. Changing this forces a new issuer to be created.
    ImportKey string
    A PEM-encoded private key to import for the issuer. When provided, the issuer's origin becomes external and the algorithm is inferred from the key. Changing this forces a new issuer to be created. This value is never returned by the API and cannot be recovered on import.
    ImportKeyId string
    The key ID (kid) to assign to the imported key. Only valid when import_key is set. Changing this forces a new issuer to be created.
    Name string
    The name of the issuer.
    TeamId string
    The ID of the team the issuer should be created under. Required when configuring a team resource if a default team has not been set in the provider.
    algorithm string
    The signing algorithm to use for the issuer. Defaults to RS512. Changing this forces a new issuer to be created.
    import_key string
    A PEM-encoded private key to import for the issuer. When provided, the issuer's origin becomes external and the algorithm is inferred from the key. Changing this forces a new issuer to be created. This value is never returned by the API and cannot be recovered on import.
    import_key_id string
    The key ID (kid) to assign to the imported key. Only valid when import_key is set. Changing this forces a new issuer to be created.
    name string
    The name of the issuer.
    team_id string
    The ID of the team the issuer should be created under. Required when configuring a team resource if a default team has not been set in the provider.
    algorithm String
    The signing algorithm to use for the issuer. Defaults to RS512. Changing this forces a new issuer to be created.
    importKey String
    A PEM-encoded private key to import for the issuer. When provided, the issuer's origin becomes external and the algorithm is inferred from the key. Changing this forces a new issuer to be created. This value is never returned by the API and cannot be recovered on import.
    importKeyId String
    The key ID (kid) to assign to the imported key. Only valid when import_key is set. Changing this forces a new issuer to be created.
    name String
    The name of the issuer.
    teamId String
    The ID of the team the issuer should be created under. Required when configuring a team resource if a default team has not been set in the provider.
    algorithm string
    The signing algorithm to use for the issuer. Defaults to RS512. Changing this forces a new issuer to be created.
    importKey string
    A PEM-encoded private key to import for the issuer. When provided, the issuer's origin becomes external and the algorithm is inferred from the key. Changing this forces a new issuer to be created. This value is never returned by the API and cannot be recovered on import.
    importKeyId string
    The key ID (kid) to assign to the imported key. Only valid when import_key is set. Changing this forces a new issuer to be created.
    name string
    The name of the issuer.
    teamId string
    The ID of the team the issuer should be created under. Required when configuring a team resource if a default team has not been set in the provider.
    algorithm str
    The signing algorithm to use for the issuer. Defaults to RS512. Changing this forces a new issuer to be created.
    import_key str
    A PEM-encoded private key to import for the issuer. When provided, the issuer's origin becomes external and the algorithm is inferred from the key. Changing this forces a new issuer to be created. This value is never returned by the API and cannot be recovered on import.
    import_key_id str
    The key ID (kid) to assign to the imported key. Only valid when import_key is set. Changing this forces a new issuer to be created.
    name str
    The name of the issuer.
    team_id str
    The ID of the team the issuer should be created under. Required when configuring a team resource if a default team has not been set in the provider.
    algorithm String
    The signing algorithm to use for the issuer. Defaults to RS512. Changing this forces a new issuer to be created.
    importKey String
    A PEM-encoded private key to import for the issuer. When provided, the issuer's origin becomes external and the algorithm is inferred from the key. Changing this forces a new issuer to be created. This value is never returned by the API and cannot be recovered on import.
    importKeyId String
    The key ID (kid) to assign to the imported key. Only valid when import_key is set. Changing this forces a new issuer to be created.
    name String
    The name of the issuer.
    teamId String
    The ID of the team the issuer should be created under. Required when configuring a team resource if a default team has not been set in the provider.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the KmsIssuer resource produces the following output properties:

    CreatedAt string
    The time the issuer was created.
    Id string
    The provider-assigned unique ID for this managed resource.
    ManagedBy string
    Identifies the policy that manages this issuer, if any.
    Origin string
    The origin of the issuer's key material, either vercel or external.
    OwnerId string
    The ID of the team that owns the issuer.
    SigningKeys List<Pulumiverse.Vercel.Outputs.KmsIssuerSigningKey>
    The signing keys belonging to the issuer. Keys are created automatically and can be rotated with the vercel.KmsSigningKey resource.
    UpdatedAt string
    The time the issuer was last updated.
    CreatedAt string
    The time the issuer was created.
    Id string
    The provider-assigned unique ID for this managed resource.
    ManagedBy string
    Identifies the policy that manages this issuer, if any.
    Origin string
    The origin of the issuer's key material, either vercel or external.
    OwnerId string
    The ID of the team that owns the issuer.
    SigningKeys []KmsIssuerSigningKey
    The signing keys belonging to the issuer. Keys are created automatically and can be rotated with the vercel.KmsSigningKey resource.
    UpdatedAt string
    The time the issuer was last updated.
    created_at string
    The time the issuer was created.
    id string
    The provider-assigned unique ID for this managed resource.
    managed_by string
    Identifies the policy that manages this issuer, if any.
    origin string
    The origin of the issuer's key material, either vercel or external.
    owner_id string
    The ID of the team that owns the issuer.
    signing_keys list(object)
    The signing keys belonging to the issuer. Keys are created automatically and can be rotated with the vercel.KmsSigningKey resource.
    updated_at string
    The time the issuer was last updated.
    createdAt String
    The time the issuer was created.
    id String
    The provider-assigned unique ID for this managed resource.
    managedBy String
    Identifies the policy that manages this issuer, if any.
    origin String
    The origin of the issuer's key material, either vercel or external.
    ownerId String
    The ID of the team that owns the issuer.
    signingKeys List<KmsIssuerSigningKey>
    The signing keys belonging to the issuer. Keys are created automatically and can be rotated with the vercel.KmsSigningKey resource.
    updatedAt String
    The time the issuer was last updated.
    createdAt string
    The time the issuer was created.
    id string
    The provider-assigned unique ID for this managed resource.
    managedBy string
    Identifies the policy that manages this issuer, if any.
    origin string
    The origin of the issuer's key material, either vercel or external.
    ownerId string
    The ID of the team that owns the issuer.
    signingKeys KmsIssuerSigningKey[]
    The signing keys belonging to the issuer. Keys are created automatically and can be rotated with the vercel.KmsSigningKey resource.
    updatedAt string
    The time the issuer was last updated.
    created_at str
    The time the issuer was created.
    id str
    The provider-assigned unique ID for this managed resource.
    managed_by str
    Identifies the policy that manages this issuer, if any.
    origin str
    The origin of the issuer's key material, either vercel or external.
    owner_id str
    The ID of the team that owns the issuer.
    signing_keys Sequence[KmsIssuerSigningKey]
    The signing keys belonging to the issuer. Keys are created automatically and can be rotated with the vercel.KmsSigningKey resource.
    updated_at str
    The time the issuer was last updated.
    createdAt String
    The time the issuer was created.
    id String
    The provider-assigned unique ID for this managed resource.
    managedBy String
    Identifies the policy that manages this issuer, if any.
    origin String
    The origin of the issuer's key material, either vercel or external.
    ownerId String
    The ID of the team that owns the issuer.
    signingKeys List<Property Map>
    The signing keys belonging to the issuer. Keys are created automatically and can be rotated with the vercel.KmsSigningKey resource.
    updatedAt String
    The time the issuer was last updated.

    Look up Existing KmsIssuer Resource

    Get an existing KmsIssuer resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: KmsIssuerState, opts?: CustomResourceOptions): KmsIssuer
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        algorithm: Optional[str] = None,
        created_at: Optional[str] = None,
        import_key: Optional[str] = None,
        import_key_id: Optional[str] = None,
        managed_by: Optional[str] = None,
        name: Optional[str] = None,
        origin: Optional[str] = None,
        owner_id: Optional[str] = None,
        signing_keys: Optional[Sequence[KmsIssuerSigningKeyArgs]] = None,
        team_id: Optional[str] = None,
        updated_at: Optional[str] = None) -> KmsIssuer
    func GetKmsIssuer(ctx *Context, name string, id IDInput, state *KmsIssuerState, opts ...ResourceOption) (*KmsIssuer, error)
    public static KmsIssuer Get(string name, Input<string> id, KmsIssuerState? state, CustomResourceOptions? opts = null)
    public static KmsIssuer get(String name, Output<String> id, KmsIssuerState state, CustomResourceOptions options)
    resources:  _:    type: vercel:KmsIssuer    get:      id: ${id}
    import {
  to = vercel_kms_issuer.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Algorithm string
    The signing algorithm to use for the issuer. Defaults to RS512. Changing this forces a new issuer to be created.
    CreatedAt string
    The time the issuer was created.
    ImportKey string
    A PEM-encoded private key to import for the issuer. When provided, the issuer's origin becomes external and the algorithm is inferred from the key. Changing this forces a new issuer to be created. This value is never returned by the API and cannot be recovered on import.
    ImportKeyId string
    The key ID (kid) to assign to the imported key. Only valid when import_key is set. Changing this forces a new issuer to be created.
    ManagedBy string
    Identifies the policy that manages this issuer, if any.
    Name string
    The name of the issuer.
    Origin string
    The origin of the issuer's key material, either vercel or external.
    OwnerId string
    The ID of the team that owns the issuer.
    SigningKeys List<Pulumiverse.Vercel.Inputs.KmsIssuerSigningKey>
    The signing keys belonging to the issuer. Keys are created automatically and can be rotated with the vercel.KmsSigningKey resource.
    TeamId string
    The ID of the team the issuer should be created under. Required when configuring a team resource if a default team has not been set in the provider.
    UpdatedAt string
    The time the issuer was last updated.
    Algorithm string
    The signing algorithm to use for the issuer. Defaults to RS512. Changing this forces a new issuer to be created.
    CreatedAt string
    The time the issuer was created.
    ImportKey string
    A PEM-encoded private key to import for the issuer. When provided, the issuer's origin becomes external and the algorithm is inferred from the key. Changing this forces a new issuer to be created. This value is never returned by the API and cannot be recovered on import.
    ImportKeyId string
    The key ID (kid) to assign to the imported key. Only valid when import_key is set. Changing this forces a new issuer to be created.
    ManagedBy string
    Identifies the policy that manages this issuer, if any.
    Name string
    The name of the issuer.
    Origin string
    The origin of the issuer's key material, either vercel or external.
    OwnerId string
    The ID of the team that owns the issuer.
    SigningKeys []KmsIssuerSigningKeyArgs
    The signing keys belonging to the issuer. Keys are created automatically and can be rotated with the vercel.KmsSigningKey resource.
    TeamId string
    The ID of the team the issuer should be created under. Required when configuring a team resource if a default team has not been set in the provider.
    UpdatedAt string
    The time the issuer was last updated.
    algorithm string
    The signing algorithm to use for the issuer. Defaults to RS512. Changing this forces a new issuer to be created.
    created_at string
    The time the issuer was created.
    import_key string
    A PEM-encoded private key to import for the issuer. When provided, the issuer's origin becomes external and the algorithm is inferred from the key. Changing this forces a new issuer to be created. This value is never returned by the API and cannot be recovered on import.
    import_key_id string
    The key ID (kid) to assign to the imported key. Only valid when import_key is set. Changing this forces a new issuer to be created.
    managed_by string
    Identifies the policy that manages this issuer, if any.
    name string
    The name of the issuer.
    origin string
    The origin of the issuer's key material, either vercel or external.
    owner_id string
    The ID of the team that owns the issuer.
    signing_keys list(object)
    The signing keys belonging to the issuer. Keys are created automatically and can be rotated with the vercel.KmsSigningKey resource.
    team_id string
    The ID of the team the issuer should be created under. Required when configuring a team resource if a default team has not been set in the provider.
    updated_at string
    The time the issuer was last updated.
    algorithm String
    The signing algorithm to use for the issuer. Defaults to RS512. Changing this forces a new issuer to be created.
    createdAt String
    The time the issuer was created.
    importKey String
    A PEM-encoded private key to import for the issuer. When provided, the issuer's origin becomes external and the algorithm is inferred from the key. Changing this forces a new issuer to be created. This value is never returned by the API and cannot be recovered on import.
    importKeyId String
    The key ID (kid) to assign to the imported key. Only valid when import_key is set. Changing this forces a new issuer to be created.
    managedBy String
    Identifies the policy that manages this issuer, if any.
    name String
    The name of the issuer.
    origin String
    The origin of the issuer's key material, either vercel or external.
    ownerId String
    The ID of the team that owns the issuer.
    signingKeys List<KmsIssuerSigningKey>
    The signing keys belonging to the issuer. Keys are created automatically and can be rotated with the vercel.KmsSigningKey resource.
    teamId String
    The ID of the team the issuer should be created under. Required when configuring a team resource if a default team has not been set in the provider.
    updatedAt String
    The time the issuer was last updated.
    algorithm string
    The signing algorithm to use for the issuer. Defaults to RS512. Changing this forces a new issuer to be created.
    createdAt string
    The time the issuer was created.
    importKey string
    A PEM-encoded private key to import for the issuer. When provided, the issuer's origin becomes external and the algorithm is inferred from the key. Changing this forces a new issuer to be created. This value is never returned by the API and cannot be recovered on import.
    importKeyId string
    The key ID (kid) to assign to the imported key. Only valid when import_key is set. Changing this forces a new issuer to be created.
    managedBy string
    Identifies the policy that manages this issuer, if any.
    name string
    The name of the issuer.
    origin string
    The origin of the issuer's key material, either vercel or external.
    ownerId string
    The ID of the team that owns the issuer.
    signingKeys KmsIssuerSigningKey[]
    The signing keys belonging to the issuer. Keys are created automatically and can be rotated with the vercel.KmsSigningKey resource.
    teamId string
    The ID of the team the issuer should be created under. Required when configuring a team resource if a default team has not been set in the provider.
    updatedAt string
    The time the issuer was last updated.
    algorithm str
    The signing algorithm to use for the issuer. Defaults to RS512. Changing this forces a new issuer to be created.
    created_at str
    The time the issuer was created.
    import_key str
    A PEM-encoded private key to import for the issuer. When provided, the issuer's origin becomes external and the algorithm is inferred from the key. Changing this forces a new issuer to be created. This value is never returned by the API and cannot be recovered on import.
    import_key_id str
    The key ID (kid) to assign to the imported key. Only valid when import_key is set. Changing this forces a new issuer to be created.
    managed_by str
    Identifies the policy that manages this issuer, if any.
    name str
    The name of the issuer.
    origin str
    The origin of the issuer's key material, either vercel or external.
    owner_id str
    The ID of the team that owns the issuer.
    signing_keys Sequence[KmsIssuerSigningKeyArgs]
    The signing keys belonging to the issuer. Keys are created automatically and can be rotated with the vercel.KmsSigningKey resource.
    team_id str
    The ID of the team the issuer should be created under. Required when configuring a team resource if a default team has not been set in the provider.
    updated_at str
    The time the issuer was last updated.
    algorithm String
    The signing algorithm to use for the issuer. Defaults to RS512. Changing this forces a new issuer to be created.
    createdAt String
    The time the issuer was created.
    importKey String
    A PEM-encoded private key to import for the issuer. When provided, the issuer's origin becomes external and the algorithm is inferred from the key. Changing this forces a new issuer to be created. This value is never returned by the API and cannot be recovered on import.
    importKeyId String
    The key ID (kid) to assign to the imported key. Only valid when import_key is set. Changing this forces a new issuer to be created.
    managedBy String
    Identifies the policy that manages this issuer, if any.
    name String
    The name of the issuer.
    origin String
    The origin of the issuer's key material, either vercel or external.
    ownerId String
    The ID of the team that owns the issuer.
    signingKeys List<Property Map>
    The signing keys belonging to the issuer. Keys are created automatically and can be rotated with the vercel.KmsSigningKey resource.
    teamId String
    The ID of the team the issuer should be created under. Required when configuring a team resource if a default team has not been set in the provider.
    updatedAt String
    The time the issuer was last updated.

    Supporting Types

    KmsIssuerSigningKey, KmsIssuerSigningKeyArgs

    Algorithm string
    The signing algorithm of the key.
    CertificatePem string
    The key's self-signed X.509 certificate in PEM form.
    CreatedAt string
    The time the key was created.
    ImportKeyId string
    The caller-supplied key ID (kid) for an imported key, or null for keys generated by Vercel. This is the value that appears in the JWKS and signed-token headers for imported keys.
    IssuerId string
    The ID of the issuer the key belongs to.
    KeyId string
    The server-minted addressable ID of the signing key. For keys generated by Vercel this is also the JWT/JWKS kid; for an imported key the kid may differ from this addressable ID.
    PublicKeyFingerprint string
    The fingerprint of the public key.
    PublicKeyJwk string
    The public key as a JSON-encoded JWK.
    PublicKeyPem string
    The public key in SPKI PEM form.
    RevokeAt string
    The time at which the key is scheduled to be revoked, if any.
    Status string
    The status of the key, one of pending, active, or revoking. A newly rotated key is pending until its public key propagates, then becomes active.
    UpdatedAt string
    The time the key was last updated.
    Algorithm string
    The signing algorithm of the key.
    CertificatePem string
    The key's self-signed X.509 certificate in PEM form.
    CreatedAt string
    The time the key was created.
    ImportKeyId string
    The caller-supplied key ID (kid) for an imported key, or null for keys generated by Vercel. This is the value that appears in the JWKS and signed-token headers for imported keys.
    IssuerId string
    The ID of the issuer the key belongs to.
    KeyId string
    The server-minted addressable ID of the signing key. For keys generated by Vercel this is also the JWT/JWKS kid; for an imported key the kid may differ from this addressable ID.
    PublicKeyFingerprint string
    The fingerprint of the public key.
    PublicKeyJwk string
    The public key as a JSON-encoded JWK.
    PublicKeyPem string
    The public key in SPKI PEM form.
    RevokeAt string
    The time at which the key is scheduled to be revoked, if any.
    Status string
    The status of the key, one of pending, active, or revoking. A newly rotated key is pending until its public key propagates, then becomes active.
    UpdatedAt string
    The time the key was last updated.
    algorithm string
    The signing algorithm of the key.
    certificate_pem string
    The key's self-signed X.509 certificate in PEM form.
    created_at string
    The time the key was created.
    import_key_id string
    The caller-supplied key ID (kid) for an imported key, or null for keys generated by Vercel. This is the value that appears in the JWKS and signed-token headers for imported keys.
    issuer_id string
    The ID of the issuer the key belongs to.
    key_id string
    The server-minted addressable ID of the signing key. For keys generated by Vercel this is also the JWT/JWKS kid; for an imported key the kid may differ from this addressable ID.
    public_key_fingerprint string
    The fingerprint of the public key.
    public_key_jwk string
    The public key as a JSON-encoded JWK.
    public_key_pem string
    The public key in SPKI PEM form.
    revoke_at string
    The time at which the key is scheduled to be revoked, if any.
    status string
    The status of the key, one of pending, active, or revoking. A newly rotated key is pending until its public key propagates, then becomes active.
    updated_at string
    The time the key was last updated.
    algorithm String
    The signing algorithm of the key.
    certificatePem String
    The key's self-signed X.509 certificate in PEM form.
    createdAt String
    The time the key was created.
    importKeyId String
    The caller-supplied key ID (kid) for an imported key, or null for keys generated by Vercel. This is the value that appears in the JWKS and signed-token headers for imported keys.
    issuerId String
    The ID of the issuer the key belongs to.
    keyId String
    The server-minted addressable ID of the signing key. For keys generated by Vercel this is also the JWT/JWKS kid; for an imported key the kid may differ from this addressable ID.
    publicKeyFingerprint String
    The fingerprint of the public key.
    publicKeyJwk String
    The public key as a JSON-encoded JWK.
    publicKeyPem String
    The public key in SPKI PEM form.
    revokeAt String
    The time at which the key is scheduled to be revoked, if any.
    status String
    The status of the key, one of pending, active, or revoking. A newly rotated key is pending until its public key propagates, then becomes active.
    updatedAt String
    The time the key was last updated.
    algorithm string
    The signing algorithm of the key.
    certificatePem string
    The key's self-signed X.509 certificate in PEM form.
    createdAt string
    The time the key was created.
    importKeyId string
    The caller-supplied key ID (kid) for an imported key, or null for keys generated by Vercel. This is the value that appears in the JWKS and signed-token headers for imported keys.
    issuerId string
    The ID of the issuer the key belongs to.
    keyId string
    The server-minted addressable ID of the signing key. For keys generated by Vercel this is also the JWT/JWKS kid; for an imported key the kid may differ from this addressable ID.
    publicKeyFingerprint string
    The fingerprint of the public key.
    publicKeyJwk string
    The public key as a JSON-encoded JWK.
    publicKeyPem string
    The public key in SPKI PEM form.
    revokeAt string
    The time at which the key is scheduled to be revoked, if any.
    status string
    The status of the key, one of pending, active, or revoking. A newly rotated key is pending until its public key propagates, then becomes active.
    updatedAt string
    The time the key was last updated.
    algorithm str
    The signing algorithm of the key.
    certificate_pem str
    The key's self-signed X.509 certificate in PEM form.
    created_at str
    The time the key was created.
    import_key_id str
    The caller-supplied key ID (kid) for an imported key, or null for keys generated by Vercel. This is the value that appears in the JWKS and signed-token headers for imported keys.
    issuer_id str
    The ID of the issuer the key belongs to.
    key_id str
    The server-minted addressable ID of the signing key. For keys generated by Vercel this is also the JWT/JWKS kid; for an imported key the kid may differ from this addressable ID.
    public_key_fingerprint str
    The fingerprint of the public key.
    public_key_jwk str
    The public key as a JSON-encoded JWK.
    public_key_pem str
    The public key in SPKI PEM form.
    revoke_at str
    The time at which the key is scheduled to be revoked, if any.
    status str
    The status of the key, one of pending, active, or revoking. A newly rotated key is pending until its public key propagates, then becomes active.
    updated_at str
    The time the key was last updated.
    algorithm String
    The signing algorithm of the key.
    certificatePem String
    The key's self-signed X.509 certificate in PEM form.
    createdAt String
    The time the key was created.
    importKeyId String
    The caller-supplied key ID (kid) for an imported key, or null for keys generated by Vercel. This is the value that appears in the JWKS and signed-token headers for imported keys.
    issuerId String
    The ID of the issuer the key belongs to.
    keyId String
    The server-minted addressable ID of the signing key. For keys generated by Vercel this is also the JWT/JWKS kid; for an imported key the kid may differ from this addressable ID.
    publicKeyFingerprint String
    The fingerprint of the public key.
    publicKeyJwk String
    The public key as a JSON-encoded JWK.
    publicKeyPem String
    The public key in SPKI PEM form.
    revokeAt String
    The time at which the key is scheduled to be revoked, if any.
    status String
    The status of the key, one of pending, active, or revoking. A newly rotated key is pending until its public key propagates, then becomes active.
    updatedAt String
    The time the key was last updated.

    Import

    The pulumi import command can be used, for example:

    If importing into a personal account, or with a team configured on the provider, simply use the issuer id.

    • issuer_id can be found via the vercel.KmsIssuer data source or the API.
    $ pulumi import vercel:index/kmsIssuer:KmsIssuer example iss_xxxxxxxxxxxxxxxxxxxxxxxxxxxx

    Alternatively, you can import via the team_id and issuer id.

    • team_id can be found in the team settings tab in the Vercel UI.
    $ pulumi import vercel:index/kmsIssuer:KmsIssuer example team_xxxxxxxxxxxxxxxxxxxxxxxx/iss_xxxxxxxxxxxxxxxxxxxxxxxxxxxx

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    vercel pulumiverse/pulumi-vercel
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the vercel Terraform Provider.
    vercel logo vercel logo
    Viewing docs for Vercel v5.21.1
    published on Thursday, Oct 15, 2026 by Pulumiverse
    Schema (JSON)
    pulumiverse/pulumi-vercel

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial