Partner - Assign a new key with environment specification
Creates a new key pair with the enclave, shards the private key, and securely stores the encrypted key shards. Includes key environment specification: HOT (online generation/storage) or COLD (offline generation/storage). Partner-only endpoint.
Authorizations
Bearer token authentication. Can be either a JWT token or API key.
Headers
Bearer token for authentication. Can be either a JWT token or API key.
Body
Key assignment details with key environment specification
Unique identifier of the user
Type of cryptographic key to generate. rsa4096 for encryption of recovery material; secp256k1 or ed25519 for blockchain backup signers.
rsa4096, secp256k1, ed25519 Key environment specification - HOT (online generation) or COLD (offline generation)
HOT, COLD Organisation metadata
Package metadata
Optional list of context fields to bind into the enclave signature. When present, the enclave signs a JCS-canonical (RFC 8785) JSON payload built from these fields plus the public_key (always included), returned as signed_payload, so a verified signature attests to the business context the key was issued for — not just the key bytes. Do not list public_key here; it is included implicitly.
external_customer_id, external_package_id, pulled_by_id, pulled_by_type, user_id, key_id, key_fingerprint Response
Key successfully assigned
Unique identifier for the key
Public key in hex format
Signature of the key in base64 format, produced by the generating enclave. Verify against your CoinCover verification key before encrypting recovery material. When sign_with is supplied the signature is computed over signed_payload; otherwise it covers the public key.
JCS-canonical (RFC 8785) JSON string that was signed — object keys sorted, always including public_key alongside the requested context fields. Returned only when sign_with was supplied. Verify the signature over these exact bytes rather than a re-serialised copy.
The sign_with field names that were included, in the order requested (public_key is not listed). Confirm this contains every field you expected before trusting the binding.
External customer identifier (e.g. organisation customer ID)
External package identifier (e.g. workspace/package ID)
Optional metadata describing the associated organisation and package