Skip to main content
POST
Register Key
Creates a managed key or registers public-key material for the issuer identified by path parameter id.

Managed signing

Use provider: "KMS" and the desired alg. The configured signing provider must support that algorithm. Use the generated kid returned in the response; an arbitrary requested key ID is not retained in this mode.
Algorithm availability depends on the deployed provider. An algorithm name alone does not establish compliance with an industry or government standard.

Public-key registration

Import mode requires kid, alg, and public_key_b64url. algorithm and public_key are not substitutes. Encode the verifier-compatible public-key bytes as unpadded base64url. Registering a public key does not provision its private key, and is insufficient by itself for server-side minting. Never send private-key material in this request. The response includes issuer_id, kid, alg, public_key_b64url, provider, and created_at. Confirm signing availability before minting.

Authorizations

X-API-Key
string
header
required

API key for machine-to-machine authentication

Path Parameters

id
string<uuid>
required

Body

application/json
alg
string
kid
string
provider
string
public_key_b64url
string

Response

Key registered

kid
string

Key identifier

issuer_id
string<uuid>
algorithm
enum<string>

Signing algorithm for key generation

Available options:
Ed25519,
ES256,
ES384,
ES512,
RS256,
RS384,
RS512,
PS256,
PS384,
PS512
public_key
string

Base64-encoded public key

status
enum<string>
Available options:
ACTIVE,
DISABLED,
EXPIRED
not_before
string<date-time>
expires_at
string<date-time>