> ## Documentation Index
> Fetch the complete documentation index at: https://keyring.docs.composio.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Deploy to Vercel

> Run Keyring as a managed Vercel function with project secrets and automatic scaling.

Vercel is useful when your organization already standardizes on its managed functions and wants a
low-operations deployment with automatic scaling. It is a supported source deployment and does not use
the `composiohq/keyring:alpha` container image.

<Warning>
  Vercel does not provide ECS- or Cloud Run-style KMS workload identity. Plan credential rotation
  and test provider streaming, timeout, header, and payload limits before production use.
</Warning>

## 1. Configure project variables

Set these values separately for each Vercel environment:

```bash theme={"theme":{"light":"github-light","dark":"github-dark"}}
APP_ENV=production
RUNTIME=vercel
AUTH_AUDIENCE=<COMPOSIO_ORG_ID>
AUTH_ISSUER=https://backend.composio.dev
AUTH_JWT_ALGORITHMS=RS256
AUTH_JWKS_URL=https://backend.composio.dev/.well-known/jwks.json
AUDIT_DURABILITY=required
OTEL_COLLECTOR_URL=https://otel.example.com
OTEL_COLLECTOR_HEADERS=Authorization=Bearer%20replace-me
LOG_LEVEL=info
ENCRYPTION_CONFIG={"credential":{...},"authorization_gate":{...},"secret_transfer":{...}}
```

`ENCRYPTION_CONFIG` must be inline JSON. Mark it and all collector or provider credentials as sensitive
project variables.

Vercel cannot run a collector sidecar. Choose a remote collector or compatible public endpoint using
the [telemetry delivery guide](/deployment/observability#direct-vendor-endpoint).

## 2. Choose KMS authentication

Vercel does not expose an ECS-compatible credential endpoint. For AWS, provide temporary or rotated
`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and optional `AWS_SESSION_TOKEN` values through Vercel
secrets.

For GCP or Vault, use a supported non-file authentication method and an external rotation process. The
preferred ECS and Cloud Run deployments are a better fit when infrastructure identity is mandatory.

## 3. Deploy with Node 24

```bash theme={"theme":{"light":"github-light","dark":"github-dark"}}
nvm use 24
vercel deploy
vercel deploy --prod
```

## 4. Verify and connect

```bash theme={"theme":{"light":"github-light","dark":"github-dark"}}
curl --fail https://keyring.example.vercel.app/healthz
curl --fail https://keyring.example.vercel.app/transfer-keys
```

Restrict the production endpoint to the [Composio egress addresses](/deployment/overview#network-access)
using your Vercel network controls or an approved upstream edge, then
[connect it to Composio](/deployment/overview#connect-keyring-to-composio).

## Platform limits

Vercel request size, response size, duration, and header limits apply around Keyring. Validate your
chosen plan against expected provider uploads, streaming responses, and slow token endpoints.

Keyring remains stateless on Vercel. Logs go to the configured Vercel log destination, while traces,
metrics, and required audit events are exported to your OTLP collector.