---
title: "Create Workspace Signing Key"
method: POST
path: "/v1/{workspace}/ws_signing_key/"
---

# Create Workspace Signing Key

`POST /v1/{workspace}/ws_signing_key/`

Create a signing key for this workspace.

The `private_key_pem` and `private_key_base64` fields are returned **only once** at creation. Store them securely - they cannot be retrieved later.

Only **one active** signing key is allowed per workspace. To replace an existing active key, use the [Roll Workspace Signing Key](#operation/roll-workspace-signing-key) endpoint instead.

## Path parameters

- `workspace` string, required

## Response `201`

Signing key created. Private key material is returned once in this response.

- ManagementWorkspaceSigningKeyCreateResponse — Signing key used to verify signed payloads.
  - `id` string — Unique identifier of the signing key.
  - `uid` string — Signing key uid used in path parameters for roll/delete.
  - `status` 'active' | 'rolled' — Status of the signing key.
  - `allowed_domains` string[], nullable — Domains allowed to use this signing key.
  - `expiry_at` string, date-time, nullable — Timestamp when the signing key expires.
  - `created_at` string, date-time — Timestamp when the signing key was created.
  - `created_by` ManagementActor, nullable — Identity that performed an action (created, updated, rolled, deleted, rotated).
    - `name` string — Display name of the actor.
    - `email` string — Email address of the actor.
  - `rolled_at` string, date-time, nullable — Timestamp when the signing key was rolled.
  - `rolled_by` ManagementActor, nullable — Identity that performed an action (created, updated, rolled, deleted, rotated).
    - `name` string — Display name of the actor.
    - `email` string — Email address of the actor.
  - `deleted_at` string, date-time, nullable — Timestamp when the signing key was deleted.
  - `deleted_by` ManagementActor, nullable — Identity that performed an action (created, updated, rolled, deleted, rotated).
    - `name` string — Display name of the actor.
    - `email` string — Email address of the actor.
  - `private_key_pem` string — PEM-encoded private key. Returned only at creation and on roll - store it securely and never commit to source control.
  - `private_key_base64` string — Base64-encoded private key. Returned only at creation and on roll.

## Other responses

- `400` — Validation error - for example, an active signing key already exists.
- `401` — Authentication failed
- `404` — Resource not found

---

[API](https://skmtc.net/suprsend/apis/suprsend-api.md) · [All operations](https://skmtc.net/suprsend/apis/suprsend-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/suprsend/suprsend-api/versions/8bd2574bd2c3/schema)