Request body
json
{} (no request body)API Endpoint
POST /management/offline/signing-keys/{id}/activate
Promote one signing key to active so it signs new offline JWTs.
POST /management/offline/signing-keys/{id}/activate
Endpoint context
Use these endpoints from internal tooling or your frontend backend to inspect licenses, manage slug policy templates, provisioning API keys, webhook endpoint configuration/logs, and offline JWT signing keys. Management routes require the management bootstrap key configured via MANAGEMENT_API_KEYS or MANAGEMENT_API_KEY.
- Requires management API key auth.
- Only one signing key can be active at a time.
- The previously active key is moved to verify_only so older tokens can continue validating until retired.
bash
curl -sS -X POST http://localhost:8080/management/offline/signing-keys/1/activate -H "Authorization: Bearer management_key_dev_123456"Response body
json
{
"id": 1,
"name": "desktop-app-2026",
"kid": "61426d843cf40341f68a3053",
"algorithm": "Ed25519",
"status": "active",
"public_key_pem": "-----BEGIN PUBLIC KEY-----
...
-----END PUBLIC KEY-----
",
"created_at": "2026-04-21T12:00:00Z",
"activated_at": "2026-04-21T12:05:00Z",
"retired_at": null
}Response field types
status
"active"
The key is now used for newly issued/refreshed offline JWTs.
activated_at
string
RFC3339 timestamp when the key first became active.
Error codes
400
Invalid key id.
401
Missing or invalid management API key.
404
Signing key not found.
409
Retired signing key cannot be activated.
500
Unexpected server or storage error.