> ## Documentation Index > Fetch the complete documentation index at: https://developer.coincover.com/llms.txt > Use this file to discover all available pages before exploring further. # Partner - Assign a new key with environment specification > Creates a new key pair with the enclave, shards the private key, and securely stores the encrypted key shards. Includes key environment specification: HOT (online generation/storage) or COLD (offline generation/storage). Partner-only endpoint. ## OpenAPI ````yaml /specs/wallet-provider.openapi.json post /v1/partner/keys openapi: 3.0.0 info: title: Recover for Wallet Providers — Partner Key Service API description: >- Partner Key Service for wallet providers integrating CoinCover under the hood of their platform to back up their customers' wallets. All endpoints live under /v1/partner/* and require organisation and package metadata. HOT vs COLD is selected with the key_environment parameter at assignment time, not via the URL path. Key generation and storage use AWS Nitro Enclaves for hardware-isolated cryptographic operations. version: 1.0.0 servers: - url: https://service.uat-keys.coincover.com description: Sandbox (UAT) - url: https://service.keys.coincover.com description: Production — confirm host with your account manager security: - bearerAuth: [] tags: - name: Keys description: Generate, assign, and verify cryptographic keys. - name: Backups description: Store and verify encrypted backup data and files. paths: /v1/partner/keys: post: tags: - Keys summary: Partner - Assign a new key with environment specification description: >- Creates a new key pair with the enclave, shards the private key, and securely stores the encrypted key shards. Includes key environment specification: HOT (online generation/storage) or COLD (offline generation/storage). Partner-only endpoint. operationId: partnerAssignKey parameters: - name: Authorization in: header description: >- Bearer token for authentication. Can be either a JWT token or API key. required: true schema: $ref: '#/components/schemas/Authorization' requestBody: description: Key assignment details with key environment specification required: true content: application/json: schema: $ref: '#/components/schemas/PartnerAssignKeyRequest' responses: '200': description: Key successfully assigned content: application/json: schema: $ref: '#/components/schemas/PartnerAssignKeyResponse' '400': description: Invalid request parameters content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '403': description: Token lacks partner-endpoint scope content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '409': description: Key already assigned for this user and organisation content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '500': description: Internal server error content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' components: schemas: Authorization: type: string PartnerAssignKeyRequest: type: object required: - user_identifier - key_type - key_environment - organisation - package properties: user_identifier: type: string description: Unique identifier of the user key_type: type: string enum: - rsa4096 - secp256k1 - ed25519 description: >- Type of cryptographic key to generate. rsa4096 for encryption of recovery material; secp256k1 or ed25519 for blockchain backup signers. key_environment: type: string enum: - HOT - COLD description: >- Key environment specification - HOT (online generation) or COLD (offline generation) organisation: type: object description: Organisation metadata properties: customer_id: type: string description: Unique identifier for the organisation customer_name: type: string description: Name of the organisation customer package: type: object description: Package metadata properties: package_id: type: string description: External package ID assigned to the key package_name: type: string description: Name of the package sign_with: type: array description: >- Optional list of context fields to bind into the enclave signature. When present, the enclave signs a JCS-canonical (RFC 8785) JSON payload built from these fields plus the public_key (always included), returned as signed_payload, so a verified signature attests to the business context the key was issued for — not just the key bytes. Do not list public_key here; it is included implicitly. items: type: string enum: - external_customer_id - external_package_id - pulled_by_id - pulled_by_type - user_id - key_id - key_fingerprint PartnerAssignKeyResponse: type: object properties: key_id: type: string format: uuid description: Unique identifier for the key public_key: type: string description: Public key in hex format signature: type: string description: >- Signature of the key in base64 format, produced by the generating enclave. Verify against your CoinCover verification key before encrypting recovery material. When sign_with is supplied the signature is computed over signed_payload; otherwise it covers the public key. signed_payload: type: string description: >- JCS-canonical (RFC 8785) JSON string that was signed — object keys sorted, always including public_key alongside the requested context fields. Returned only when sign_with was supplied. Verify the signature over these exact bytes rather than a re-serialised copy. signed_fields: type: array description: >- The sign_with field names that were included, in the order requested (public_key is not listed). Confirm this contains every field you expected before trusting the binding. items: type: string customer_id: type: string nullable: true description: External customer identifier (e.g. organisation customer ID) package_id: type: string nullable: true description: External package identifier (e.g. workspace/package ID) metadata: type: object description: Optional metadata describing the associated organisation and package properties: customer_name: type: string nullable: true description: Human-readable name of the customer or organisation package_name: type: string nullable: true description: Human-readable name of the associated package or workspace ErrorResponse: type: object properties: message: type: string description: Error message error: type: string description: Error type securitySchemes: bearerAuth: description: Bearer token authentication. Can be either a JWT token or API key. type: http scheme: bearer ````