Generate the public key file

⚠️ iOS/iPadOS/tvOS only.

Generates and downloads the Esper public key file (.pem) required to register an MDM server entry and create a DEP token in Apple Business Manager.

This is the first step in the DEP token setup workflow: the returned public key file must be uploaded to Apple Business Manager to generate the encrypted server token (.p7m) that is then uploaded back to Esper.

About Generate DEP Public Key

Device Enrollment Program (DEP) tokens allow Esper to communicate with Apple Business Manager (ABM) to automatically enroll DEP-provisioned iOS devices. The process begins with generating an Esper public key, which ABM uses to encrypt the server token it returns. This key exchange is required by Apple as a security measure in the MDM server registration flow. The response is a plain-text PEM file delivered as an attachment (Esper_Public_Key.pem), not a JSON object. The resulting DEP token record is created in state CSR_GENERATED until the server token is uploaded via PUT /api/tenant/v0/deptokens/{id}/.Key Fields / Query Parameters

Request body is optional (DEP_Token_POST schema is an empty object). Response is a text/plain PEM-formatted public key file with Content-Disposition: attachment; filename="Esper_Public_Key.pem".

Common Use Cases

Initial DEP token setup for a new Esper tenant provisioning iOS devices through Apple Business

Regenerating a public key when rotating DEP credentials

Starting the renewal process for an expiring DEP token

Best Practices

Upload the public key to ABM promptly; do not share the file externally.

After uploading to ABM and downloading the resulting server token, proceed to PUT /api/tenant/v0/deptokens/{id}/ to complete the registration — use GET /api/tenant/v0/deptokens/ to retrieve the id of the newly created CSR_GENERATED record.

Use a consistent Apple Business account across all DEP token operations to avoid mismatch errors.

Workflow

Call POST /api/tenant/v0/deptokens/ to generate and download Esper_Public_Key.pem.

In Apple Business Manager, go to Devices > Management > Add device management service and upload the Esper public key.

Save the MDM server entry, then download the resulting server token (.p7m) via the ellipsis menu.

Upload the .p7m to Esper via PUT /api/tenant/v0/deptokens/{id}/ using the id of the CSR_GENERATED record.