---
title: "Activate a signing key"
method: POST
path: "/v1/kms/issuers/{issuerId}/keys/{keyId}/activate"
tags: ["kms"]
---

# Activate a signing key

`POST /v1/kms/issuers/{issuerId}/keys/{keyId}/activate`

Activate a pending signing key so the issuer starts signing with it.

## Path parameters

- `issuerId` string, required — The ID of the issuer.
- `keyId` string, required — The ID of the pending signing key to activate.

## Query parameters

- `teamId` string
- `slug` string

## Request body

- object
  - `revokePreviousAfterHours` number — How many hours after activation the previously-active key should stop being used. Defaults to a 1 hour grace period so already-issued tokens keep verifying.

## Response `200`

- object
  - `keyId` string, required — The server-minted, unique record identifier. Use this to address the key on the activate / certificate endpoints.
  - `importKeyId` string — The caller-supplied key id (imported keys only), used as the JWT/JWKS `kid`. Not unique across an issuer's keys; omitted for generated keys.
  - `issuerId` string, required
  - `algorithm` string, required
  - `status` 'active' | 'pending' | 'revoking', required
  - `publicKey` object
    - `kty` string
    - `kid` string
    - `alg` string
    - `use` string
    - `key_ops` string[]
    - `x5c` string[] — The X.509 certificate chain (RFC 7517 §4.7). Each entry is the base64 DER (not base64url) of a certificate. For keys minted with a stored certificate this holds the single self-signed cert as `[x5c]`.
    - `x5t#S256` string — The base64url SHA-256 thumbprint of the DER certificate in `x5c[0]` (RFC 7517 §4.9).
  - `publicKeyFingerprint` string
  - `publicKeyPem` string — The public key in SPKI PEM form, ready to render. Present whenever the key has public key material. Derived from `publicKey`; the embedded certificate members (`x5c`/`x5t#S256`) do not affect it.
  - `certificatePem` string — The stored X.509 certificate (from `publicKey.x5c[0]`) in PEM form, ready to render. Present only for keys created with a stored certificate; omitted for keys created before certificates were stored.
  - `createdAt` string, required
  - `updatedAt` string, required
  - `revokeAt` string
  - `activateAt` string
  - `activatedAt` string — When the key became the active signer. Present for active and revoking keys (and absent for pending keys and rows predating this field).

## Other responses

- `400` — One of the provided values in the request body is invalid. One of the provided values in the request query is invalid.
- `401` — The request is not authorized.
- `403` — You do not have permission to access this resource.
- `404`
- `409`
- `410`

---

[API](https://skmtc.net/vercel/apis/api.md) · [All operations](https://skmtc.net/vercel/apis/api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/vercel/api/revisions/915cc4809c98/schema)