API Endpoint

POST /management/offline/signing-keys

Generate a new Ed25519 key pair for offline JWT signing.

POST /management/offline/signing-keys

Endpoint context

Use these endpoints from internal tooling or your frontend backend to inspect licenses, manage slug policy templates, provisioning API keys, webhook endpoint configuration/logs, and offline JWT signing keys. Management routes require the management bootstrap key configured via MANAGEMENT_API_KEYS or MANAGEMENT_API_KEY.

Requires management API key auth.
Requires OFFLINE_SIGNING_ENCRYPTION_KEY to be configured with at least 32 characters.
New keys start in verify_only mode until activated.
The encrypted private key is stored server-side; public key material is returned for export.

bash

curl -sS http://localhost:8080/management/offline/signing-keys   -H "Authorization: Bearer management_key_dev_123456"   -H "Content-Type: application/json"   -d '{
    "name": "desktop-app-2026"
  }'

Request body

json

{
  "name": "desktop-app-2026"
}

Response body

json

{
  "id": 1,
  "name": "desktop-app-2026",
  "kid": "61426d843cf40341f68a3053",
  "algorithm": "Ed25519",
  "status": "verify_only",
  "public_key_pem": "-----BEGIN PUBLIC KEY-----
...
-----END PUBLIC KEY-----
",
  "created_at": "2026-04-21T12:00:00Z",
  "activated_at": null,
  "retired_at": null
}

Response field types

id

number

Signing key id.

kid

string

JWT key id for this key pair.

public_key_pem

string

PEM public key to ship with offline-validating clients.

status

"verify_only"

New keys do not sign tokens until activated.

Error codes

400

Invalid JSON, oversized name, or missing/invalid OFFLINE_SIGNING_ENCRYPTION_KEY.

401

Missing or invalid management API key.

409

Generated key id conflict; retry the request.

500

Unexpected server or storage error.

Back to API overview