---
title: "Create Security Key"
method: POST
path: "/api/{serviceId}/hsk/create"
tags: ["Hardware Security Key"]
---

# Create Security Key

`POST /api/{serviceId}/hsk/create`

## Path parameters

- `serviceId` string, required

## Request body

- HskCreateRequest
  - `kty` string — The key type (EC or RSA)
  - `use` string — The key on the HSM. When the key use is "sig" (signature), the private key on the HSM is used to sign data and the corresponding public key is used to verify the signature. When the key use is "enc" (encryption), the private key on the HSM is used to decrypt encrypted data which have been encrypted with the corresponding public key
  - `kid` string — Key ID for the key on the HSM.
  - `hsmName` string — The name of the HSM. The identifier for the HSM that sits behind the Authlete server. For example, "google".
  - `alg` string — The algorithm of the key on the HSM. When the key use is `"sig"`, the algorithm represents a signing algorithm such as `"ES256"`. When the key use is `"enc"`, the algorithm represents an encryption algorithm such as `"RSA-OAEP-256"`. It is rare that HSMs support all the algorithms listed in [RFC 7518 JSON Web Algorithms (JWA)](https://www.rfc-editor.org/rfc/rfc7518.html). When the specified algorithm is not supported by the HSM, the request to the `/hsk/create` API fails.

## Response `200`

HSK created successfully

- HskCreateResponse
  - `resultCode` string — The code which represents the result of the API call.
  - `resultMessage` string — A short message which explains the result of the API call.
  - `action` 'SUCCESS' | 'INVALID_REQUEST' | 'NOT_FOUND' | 'SERVER_ERROR' — Result of the API call.
  - `hsk` Hsk — Holds information about a key managed in an HSM (Hardware Security Module)
    - `kty` string — The key type (EC or RSA)
    - `use` string — Get the use of the key on the HSM. When the key use is "sig" (signature), the private key on the HSM is used to sign data and the corresponding public key is used to verify the signature. When the key use is "enc" (encryption), the private key on the HSM is used to decrypt encrypted data which have been encrypted with the corresponding public key
    - `kid` string — Key ID for the key on the HSM.
    - `hsmName` string — The name of the HSM. The identifier for the HSM that sits behind the Authlete server. For example, "google".
    - `handle` string — The handle for the key on the HSM. A handle is a base64url-encoded 256-bit random value (43 letters) which is assigned by Authlete on the call of the /api/hsk/create API
    - `publicKey` string — The public key that corresponds to the key on the HSM.
    - `alg` string — The algorithm of the key on the HSM. When the key use is `"sig"`, the algorithm represents a signing algorithm such as `"ES256"`. When the key use is `"enc"`, the algorithm represents an encryption algorithm such as `"RSA-OAEP-256"`.

## Other responses

- `400`
- `401`
- `403`
- `429` — The request exceeded the request rate permitted for the endpoint.
- `500`

---

[API](https://skmtc.net/authlete/apis/authlete-api.md) · [All operations](https://skmtc.net/authlete/apis/authlete-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/authlete/authlete-api/versions/7ad74ab64749/schema)