Register Key
curl --request POST \
--url https://api.truthlocks.com/v1/issuers/{id}/keys \
--header 'Content-Type: application/json' \
--header 'X-API-Key: <api-key>' \
--data '
{
"alg": "<string>",
"kid": "<string>",
"provider": "<string>",
"public_key_b64url": "<string>"
}
'const options = {
method: 'POST',
headers: {'X-API-Key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({
alg: '<string>',
kid: '<string>',
provider: '<string>',
public_key_b64url: '<string>'
})
};
fetch('https://api.truthlocks.com/v1/issuers/{id}/keys', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.truthlocks.com/v1/issuers/{id}/keys"
payload = {
"alg": "<string>",
"kid": "<string>",
"provider": "<string>",
"public_key_b64url": "<string>"
}
headers = {
"X-API-Key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.truthlocks.com/v1/issuers/{id}/keys"
payload := strings.NewReader("{\n \"alg\": \"<string>\",\n \"kid\": \"<string>\",\n \"provider\": \"<string>\",\n \"public_key_b64url\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("X-API-Key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"kid": "<string>",
"issuer_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"algorithm": "Ed25519",
"public_key": "<string>",
"status": "ACTIVE",
"not_before": "2023-11-07T05:31:56Z",
"expires_at": "2023-11-07T05:31:56Z"
}{
"code": "VALIDATION_ERROR",
"message": "Unsupported algorithm. Must be one of: ES256, ES384, ES512, RS256, RS384, RS512, PS256, PS384, PS512, Ed25519",
"http_status": 400
}Issuers
Create or Register an Issuer Key
Registers a new cryptographic key for an issuer. Supports ES256, ES384, ES512, RS256, RS384, RS512, PS256, PS384, PS512, and Ed25519.
POST
/
v1
/
issuers
/
{id}
/
keys
Register Key
curl --request POST \
--url https://api.truthlocks.com/v1/issuers/{id}/keys \
--header 'Content-Type: application/json' \
--header 'X-API-Key: <api-key>' \
--data '
{
"alg": "<string>",
"kid": "<string>",
"provider": "<string>",
"public_key_b64url": "<string>"
}
'const options = {
method: 'POST',
headers: {'X-API-Key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({
alg: '<string>',
kid: '<string>',
provider: '<string>',
public_key_b64url: '<string>'
})
};
fetch('https://api.truthlocks.com/v1/issuers/{id}/keys', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.truthlocks.com/v1/issuers/{id}/keys"
payload = {
"alg": "<string>",
"kid": "<string>",
"provider": "<string>",
"public_key_b64url": "<string>"
}
headers = {
"X-API-Key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.truthlocks.com/v1/issuers/{id}/keys"
payload := strings.NewReader("{\n \"alg\": \"<string>\",\n \"kid\": \"<string>\",\n \"provider\": \"<string>\",\n \"public_key_b64url\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("X-API-Key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"kid": "<string>",
"issuer_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"algorithm": "Ed25519",
"public_key": "<string>",
"status": "ACTIVE",
"not_before": "2023-11-07T05:31:56Z",
"expires_at": "2023-11-07T05:31:56Z"
}{
"code": "VALIDATION_ERROR",
"message": "Unsupported algorithm. Must be one of: ES256, ES384, ES512, RS256, RS384, RS512, PS256, PS384, PS512, Ed25519",
"http_status": 400
}Creates a managed key or registers public-key material for the issuer identified by path parameter
Algorithm availability depends on the deployed provider. An algorithm name alone does not establish compliance with an industry or government standard.
id.
Managed signing
Useprovider: "KMS" and the desired alg. The configured signing provider must support that algorithm. Use the generated kid returned in the response; an arbitrary requested key ID is not retained in this mode.
{"provider": "KMS", "alg": "Ed25519"}
Public-key registration
Import mode requireskid, alg, and public_key_b64url. algorithm and public_key are not substitutes. Encode the verifier-compatible public-key bytes as unpadded base64url.
Registering a public key does not provision its private key, and is insufficient by itself for server-side minting. Never send private-key material in this request.
The response includes issuer_id, kid, alg, public_key_b64url, provider, and created_at. Confirm signing availability before minting.Authorizations
APIKeyBearerAuth
API key for machine-to-machine authentication
Path Parameters
Response
Key registered
Key identifier
Signing algorithm for key generation
Available options:
Ed25519, ES256, ES384, ES512, RS256, RS384, RS512, PS256, PS384, PS512 Base64-encoded public key
Available options:
ACTIVE, DISABLED, EXPIRED 
