---
title: "Add a new client public key"
method: POST
path: "/v1/auth/jose/request/public-keys"
tags: ["jose"]
---

# Add a new client public key

`POST /v1/auth/jose/request/public-keys`

Upload a client public key for request payload signing or response payload encryption.

{% admonition type="warning" %}
  This endpoint requires a client credentials token, not a user level access token. Make sure you use your client details to fetch a valid [client credentials token](/api-reference/oauth-token/oauthtokencreate) before performing this call.
{% /admonition %}

## Headers

- `X-External-Correlation-Id` string, uuid

## Request body

- object
  - `keyId` string, uuid — Unique public key identifier in UUID format.
  - `validFrom` string — The key is valid from this date. Format: `yyyy-MM-dd HH:mm:ss` (UTC).
  - `validTill` string — The key is valid until this date. Format: `yyyy-MM-dd HH:mm:ss` (UTC).
  - `scope` 'PAYLOAD_SIGNING' | 'PAYLOAD_ENCRYPTION' — Scope of the payload operation.
  - `publicKeyMaterial` object
    - `algorithm` 'ES256' | 'ES384' | 'ES512' | 'PS256' | 'PS384' | 'PS512' | 'RSA_OAEP_256' — Algorithm to be used for: - Signature verification (Scope: `PAYLOAD_SIGNING`): `ES256`, `ES384`, `ES512`, `PS256`, `PS384`, `PS512` - Payload encryption (Scope: `PAYLOAD_ENCRYPTION`): `RSA_OAEP_256`
    - `keyMaterial` string — Public key material in DER (Distinguished Encoding Rules) format and base64 encoded.

## Response `201`

Public key created successfully.

- object
  - `clientId` string, nullable — This field is currently not in use and will always return `null`.
  - `keyId` string, uuid — Unique public key identifier in UUID format.
  - `scope` 'PAYLOAD_SIGNING' | 'PAYLOAD_ENCRYPTION' — Scope of the payload operation.
  - `validFrom` string — The key is valid from this date. Format: `yyyy-MM-dd HH:mm:ss` (UTC).
  - `validTill` string — The key is valid until this date. Format: `yyyy-MM-dd HH:mm:ss` (UTC).
  - `publicKeyMaterial` object
    - `algorithm` string — Algorithm to be used for request signature verification or for response payload encryption.
    - `keyMaterial` string — Public key material in DER (Distinguished Encoding Rules) format and base64 encoded.
  - `deactivationTimestamp` string, nullable — This field is currently not in use and will always return `null`.

## Other responses

- `429` — Rate limit exceeded. Retry after the number of seconds specified in the `Retry-After` header.

---

[API](https://skmtc.net/wise/apis/platform-api.md) · [All operations](https://skmtc.net/wise/apis/platform-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/wise/platform-api/revisions/4907a1d269ab/schema)