Assign a new key
Creates a new key pair with the enclave, shards the private key, and securely stores the encrypted key shards. organisation and package are optional; key_environment defaults to HOT if omitted.
Authorizations
Bearer token authentication. Can be either a JWT token or API key.
Headers
Bearer token for authentication. Can be either a JWT token or API key.
Body
Key assignment details
Unique identifier of the user
Type of cryptographic key to generate. rsa4096 for encrypting recovery material; secp256k1 or ed25519 for a blockchain backup signer.
rsa4096, secp256k1, ed25519 Key environment specification - HOT (online generation) or COLD (offline generation)
HOT, COLD Optional organisation metadata
Optional package metadata
Optional list of context fields to bind into the enclave signature. When present, the enclave signs a JCS-canonical (RFC 8785) JSON payload built from these fields plus the public_key (always included), returned as signed_payload, so a verified signature attests to the business context the key was issued for — not just the key bytes. Do not list public_key here; it is included implicitly.
external_customer_id, external_package_id, pulled_by_id, pulled_by_type, user_id, key_id, key_fingerprint Response
Key successfully assigned
Unique identifier for the key
Public key in hex format. For rsa4096 this is the encryption public key; for secp256k1 or ed25519 this is the compressed public key.
Signature of the key in base64 format, produced by the generating enclave. Verify against your CoinCover verification key before relying on the key. When sign_with is supplied the signature is computed over signed_payload; otherwise it covers the public key.
JCS-canonical (RFC 8785) JSON string that was signed — object keys sorted, always including public_key alongside the requested context fields. Returned only when sign_with was supplied. Verify the signature over these exact bytes rather than a re-serialised copy.
The sign_with field names that were included, in the order requested (public_key is not listed). Confirm this contains every field you expected before trusting the binding.
External customer identifier (e.g. organisation customer ID)
External package identifier (e.g. workspace/package ID)
Optional metadata describing the associated organisation and package