> ## Documentation Index > Fetch the complete documentation index at: https://developer.coincover.com/llms.txt > Use this file to discover all available pages before exploring further. # Assign a new key > Creates a new key pair with the enclave, shards the private key, and securely stores the encrypted key shards. organisation and package are optional; key_environment defaults to HOT if omitted. ## OpenAPI ````yaml /specs/institutional.openapi.json post /v1/keys openapi: 3.0.0 info: title: Recover for Institutions API description: >- Direct integration for institutions backing up their own digital asset wallets. Uses the standard /v1/* endpoints: organisation and package are optional, and key_environment selects HOT (online) or COLD (offline) generation and storage. HOT vs COLD is a request parameter, not a URL path segment. Self-service verification endpoints are available for keys and backups. Key generation and storage use AWS Nitro Enclaves for hardware-isolated cryptographic operations. version: 1.0.0 servers: - url: https://service.uat-keys.coincover.com description: Sandbox (UAT) - url: https://service.keys.coincover.com description: Production — confirm host with your account manager security: - bearerAuth: [] tags: - name: Keys description: Generate, assign, and verify cryptographic keys. - name: Backups description: Store and verify encrypted backup data and files. paths: /v1/keys: post: tags: - Keys summary: Assign a new key description: >- Creates a new key pair with the enclave, shards the private key, and securely stores the encrypted key shards. organisation and package are optional; key_environment defaults to HOT if omitted. operationId: assignKey parameters: - name: Authorization in: header description: >- Bearer token for authentication. Can be either a JWT token or API key. required: true schema: $ref: '#/components/schemas/Authorization' requestBody: description: Key assignment details required: true content: application/json: schema: $ref: '#/components/schemas/AssignKeyRequest' responses: '200': description: Key successfully assigned content: application/json: schema: $ref: '#/components/schemas/AssignKeyResponse' '400': description: Invalid request parameters content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '500': description: Internal server error content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' components: schemas: Authorization: type: string AssignKeyRequest: type: object required: - user_identifier - key_type properties: user_identifier: type: string description: Unique identifier of the user key_type: type: string enum: - rsa4096 - secp256k1 - ed25519 description: >- Type of cryptographic key to generate. rsa4096 for encrypting recovery material; secp256k1 or ed25519 for a blockchain backup signer. key_environment: type: string enum: - HOT - COLD default: HOT description: >- Key environment specification - HOT (online generation) or COLD (offline generation) organisation: type: object description: Optional organisation metadata properties: customer_id: type: string description: Unique identifier for the organisation customer_name: type: string description: Name of the organisation customer package: type: object description: Optional package metadata properties: package_id: type: string description: External package ID assigned to the key package_name: type: string description: Name of the package sign_with: type: array description: >- Optional list of context fields to bind into the enclave signature. When present, the enclave signs a JCS-canonical (RFC 8785) JSON payload built from these fields plus the public_key (always included), returned as signed_payload, so a verified signature attests to the business context the key was issued for — not just the key bytes. Do not list public_key here; it is included implicitly. items: type: string enum: - external_customer_id - external_package_id - pulled_by_id - pulled_by_type - user_id - key_id - key_fingerprint AssignKeyResponse: type: object properties: key_id: type: string format: uuid description: Unique identifier for the key public_key: type: string description: >- Public key in hex format. For rsa4096 this is the encryption public key; for secp256k1 or ed25519 this is the compressed public key. signature: type: string description: >- Signature of the key in base64 format, produced by the generating enclave. Verify against your CoinCover verification key before relying on the key. When sign_with is supplied the signature is computed over signed_payload; otherwise it covers the public key. signed_payload: type: string description: >- JCS-canonical (RFC 8785) JSON string that was signed — object keys sorted, always including public_key alongside the requested context fields. Returned only when sign_with was supplied. Verify the signature over these exact bytes rather than a re-serialised copy. signed_fields: type: array description: >- The sign_with field names that were included, in the order requested (public_key is not listed). Confirm this contains every field you expected before trusting the binding. items: type: string customer_id: type: string nullable: true description: External customer identifier (e.g. organisation customer ID) package_id: type: string nullable: true description: External package identifier (e.g. workspace/package ID) metadata: type: object description: Optional metadata describing the associated organisation and package properties: customer_name: type: string nullable: true description: Human-readable name of the customer or organisation package_name: type: string nullable: true description: Human-readable name of the associated package or workspace ErrorResponse: type: object properties: message: type: string description: Error message error: type: string description: Error type securitySchemes: bearerAuth: description: Bearer token authentication. Can be either a JWT token or API key. type: http scheme: bearer ````