Skip to main content
POST
Assign a new key

Authorizations

Authorization
string
header
required

Bearer token authentication. Can be either a JWT token or API key.

Headers

Authorization
string
required

Bearer token for authentication. Can be either a JWT token or API key.

Body

application/json

Key assignment details

user_identifier
string
required

Unique identifier of the user

key_type
enum<string>
required

Type of cryptographic key to generate. rsa4096 for encrypting recovery material; secp256k1 or ed25519 for a blockchain backup signer.

Available options:
rsa4096,
secp256k1,
ed25519
key_environment
enum<string>
default:HOT

Key environment specification - HOT (online generation) or COLD (offline generation)

Available options:
HOT,
COLD
organisation
object

Optional organisation metadata

package
object

Optional package metadata

sign_with
enum<string>[]

Optional list of context fields to bind into the enclave signature. When present, the enclave signs a JCS-canonical (RFC 8785) JSON payload built from these fields plus the public_key (always included), returned as signed_payload, so a verified signature attests to the business context the key was issued for — not just the key bytes. Do not list public_key here; it is included implicitly.

Available options:
external_customer_id,
external_package_id,
pulled_by_id,
pulled_by_type,
user_id,
key_id,
key_fingerprint

Response

Key successfully assigned

key_id
string<uuid>

Unique identifier for the key

public_key
string

Public key in hex format. For rsa4096 this is the encryption public key; for secp256k1 or ed25519 this is the compressed public key.

signature
string

Signature of the key in base64 format, produced by the generating enclave. Verify against your CoinCover verification key before relying on the key. When sign_with is supplied the signature is computed over signed_payload; otherwise it covers the public key.

signed_payload
string

JCS-canonical (RFC 8785) JSON string that was signed — object keys sorted, always including public_key alongside the requested context fields. Returned only when sign_with was supplied. Verify the signature over these exact bytes rather than a re-serialised copy.

signed_fields
string[]

The sign_with field names that were included, in the order requested (public_key is not listed). Confirm this contains every field you expected before trusting the binding.

customer_id
string | null

External customer identifier (e.g. organisation customer ID)

package_id
string | null

External package identifier (e.g. workspace/package ID)

metadata
object

Optional metadata describing the associated organisation and package