Sign in

v2

latestOpenAPI 3.1.12026-07-2613060964.2 KB

Create Workspace Signing Key

Create a signing key for this workspace.

The private_key_pem and private_key_base64 fields are returned only once at creation. Store them securely - they cannot be retrieved later.

Only one active signing key is allowed per workspace. To replace an existing active key, use the Roll Workspace Signing Key endpoint instead.

post/v1/{workspace}/ws_signing_key/

Path parameters

workspacestring required

Workspace slug (e.g. staging, production).

Response

Signing key created. Private key material is returned once in this response.

idstring

Unique identifier of the signing key.

uidstring

Signing key uid used in path parameters for roll/delete.

status'active' | 'rolled'

Status of the signing key.

allowed_domainsstring[] nullable

Domains allowed to use this signing key.

expiry_atstring date-time nullable

Timestamp when the signing key expires.

created_atstring date-time

Timestamp when the signing key was created.

rolled_atstring date-time nullable

Timestamp when the signing key was rolled.

deleted_atstring date-time nullable

Timestamp when the signing key was deleted.

private_key_pemstring

PEM-encoded private key. Returned only at creation and on roll - store it securely and never commit to source control.

private_key_base64string

Base64-encoded private key. Returned only at creation and on roll.

Example response

{
  "id": "ws_signk_exampleId01",
  "uid": "signing_key_exampleUid01",
  "created_by": {
    "name": "System User",
    "email": "user@example.com"
  },
  "rolled_by": {
    "name": "System User",
    "email": "user@example.com"
  },
  "deleted_by": {
    "name": "System User",
    "email": "user@example.com"
  },
  "private_key_pem": "-----BEGIN PRIVATE KEY-----\n...redacted...\n-----END PRIVATE KEY-----\n",
  "private_key_base64": "LS0tLS1CRUdJTi...redacted..."
}