Skip to main content
POST
Register Key
Registers a new cryptographic signing key for an issuer. Keys start in ACTIVE status and can be used immediately for signing attestations.

Supported Algorithms

Ed25519 is the default and recommended for new projects. Use ES384 for government/regulated industries. Use PS256 over RS256 for new RSA deployments. RS256 is available for backward compatibility only.

Parameters

string
required
The UUID of the issuer to register the key for
string
required
Unique key identifier (e.g., “ed-key-1”)
string
required
Signing algorithm. One of: Ed25519, ES256, ES384, ES512, RS256, RS384, RS512, PS256, PS384, PS512.
string
required
Base64-encoded public key

Responses

Authorizations

X-API-Key
string
header
required

API key for machine-to-machine authentication

Path Parameters

id
string<uuid>
required

Body

application/json
kid
string
required
algorithm
enum<string>
required

Signing algorithm for key generation

Available options:
Ed25519,
ES256,
ES384,
ES512,
RS256,
RS384,
RS512,
PS256,
PS384,
PS512
public_key
string
required

Base64-encoded public key

expires_at
string<date-time>

Response

Key registered

kid
string

Key identifier

issuer_id
string<uuid>
algorithm
enum<string>

Signing algorithm for key generation

Available options:
Ed25519,
ES256,
ES384,
ES512,
RS256,
RS384,
RS512,
PS256,
PS384,
PS512
public_key
string

Base64-encoded public key

status
enum<string>
Available options:
ACTIVE,
DISABLED,
EXPIRED
not_before
string<date-time>
expires_at
string<date-time>