Skip to main content
POST
Sign a message
Requires the IAM action kms:Sign. See KMS permissions for the full list, what each one covers, and an example policy.

Authorizations

Authorization
string
header
required

An OAuth 2.0 bearer token, sent as Authorization: Bearer <token>. This is the recommended way to authenticate.

Get one by exchanging a service account's access key pair at POST /v1/oauth/token with grant_type=client_credentials. It is the standard client-credentials grant, so any OAuth-aware library will obtain and refresh it for you.

Tokens last an hour by default. The same access key pair is separately your AWS SigV4 credential for the S3-compatible object endpoint, which speaks nothing else.

Path Parameters

key_id
string<uuid>
required
Example:

"3f8a1c2e-9b47-4d6a-bc11-0e2f5a7d9c41"

Body

application/json
message
string<byte>
required

Base64-encoded message to sign. The service hashes it via SHA-256 server-side, so pass the raw payload — do not pre-hash.

Example:

"c2lnbi10aGlzLW1lc3NhZ2U="

signing_algorithm
enum<string>

Signing algorithm for asymmetric Sign / Verify. Optional in requests — when omitted, the service picks the default for the key spec (RSA → RSASSA_PSS_SHA_256, ECDSA → ECDSA_SHA_256). Must match the key spec: RSA keys accept the two RSASSA schemes, ECDSA keys accept ECDSA_SHA_256.

Available options:
RSASSA_PSS_SHA_256,
RSASSA_PKCS1_V1_5_SHA_256,
ECDSA_SHA_256

Response

Signature

key_version
integer

Material version that produced this signature. Persist with the signature for explicit verification and public-key retrieval.

Required range: x >= 1
Example:

2

signature
string<byte>

Base64-encoded signature. RSA-PSS: PKCS#1 octet string with saltLen=hashLen=32. ECDSA: ASN.1 DER (r,s) tuple per ANSI X9.62.

Example:

"MEUCIQDsignatureBytesBase64EncodedAAAA="

signing_algorithm
enum<string>

Signing algorithm for asymmetric Sign / Verify. Optional in requests — when omitted, the service picks the default for the key spec (RSA → RSASSA_PSS_SHA_256, ECDSA → ECDSA_SHA_256). Must match the key spec: RSA keys accept the two RSASSA schemes, ECDSA keys accept ECDSA_SHA_256.

Available options:
RSASSA_PSS_SHA_256,
RSASSA_PKCS1_V1_5_SHA_256,
ECDSA_SHA_256