Create connection keys

Provision initial connection keys for Okta or OIDC connection strategies. This endpoint allows you to create keys before configuring the connection to use Private Key JWT authentication, enabling zero-downtime transitions.

POST https://{tenantDomain}/api/v2/connections/{id}/keys

C#

C#

using Auth0.ManagementApi;
using System.Threading.Tasks;

public partial class Examples
{
    public async Task Example() {
        var client = new ManagementClient(
            token: "<token>"
        );

        await client.Connections.Keys.CreateAsync(
            id: "id",
            request: new PostConnectionKeysRequestContent()
        );
    }

}

package com.example.usage;

import com.auth0.client.mgmt.ManagementApi;
import java.util.Optional;

public class Example {
    public static void main(String[] args) {
        ManagementApi client = ManagementApi
            .builder()
            .token("<token>")
            .build();

        client.connections().keys().create(
            "id",
            Optional.empty()
        );
    }
}

<?php

namespace Example;

use Auth0\SDK\API\Management\Management;
use Auth0\SDK\API\Management\Types\PostConnectionKeysRequestContent;

$client = new Management(
    token: '<token>',
);
$client->connections->keys->create(
    'id',
    new PostConnectionKeysRequestContent([]),
);

from auth0.management import ManagementClient, PostConnectionKeysRequestContent

client = ManagementClient(
    token="<token>",
)

client.connections.keys.create(
    id="id",
    request=PostConnectionKeysRequestContent(),
)

require "auth0"

client = Auth0::Management.new(token: "<token>")

client.connections.keys.create(
  id: "id",
  request: {}
)

curl --request POST \
  --url https://{tenantDomain}/api/v2/connections/{id}/keys \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{}'

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({})
};

fetch('https://{tenantDomain}/api/v2/connections/{id}/keys', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://{tenantDomain}/api/v2/connections/{id}/keys"

	payload := strings.NewReader("{}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

201

[
  {
    "kid": "<string>",
    "cert": "-----BEGIN CERTIFICATE-----\r\nMIIDDTCCA...YiA0TQhAt8=\r\n-----END CERTIFICATE-----",
    "fingerprint": "CC:FB:DD:D8:9A:B5:DE:1B:F0:CC:36:D2:99:59:21:12:03:DD:A8:25",
    "thumbprint": "CCFBDDD89AB5DE1BF0CC36D29959211203DDA825",
    "pkcs": "-----BEGIN PKCS7-----\r\nMIIDPA....t8xAA==\r\n-----END PKCS7-----",
    "current": true,
    "next": true,
    "current_since": "<string>",
    "algorithm": "<string>",
    "subject_dn": "<string>"
  }
]

Authorizations

bearerAuthoAuth2ClientCredentials

Authorization · string · header · required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Path Parameters

id · string · required

ID of the connection

Body

application/jsonapplication/x-www-form-urlencoded

signing_alg · enum<string>

Selected Signing Algorithm

Available options: RS256, RS384, RS512, PS256, PS384, ES256, ES384

Response

201

application/json

Connection keys successfully created.

kid · string · required

The key id of the signing key

Maximum string length: 255

cert · string · default: -----BEGIN CERTIFICATE----- MIIDDTCCA...YiA0TQhAt8= -----END CERTIFICATE----- · required

The public certificate of the signing key

Maximum string length: 4096

fingerprint · string · default: CC:FB:DD:D8:9A:B5:DE:1B:F0:CC:36:D2:99:59:21:12:03:DD:A8:25 · required

The cert fingerprint

thumbprint · string · default: CCFBDDD89AB5DE1BF0CC36D29959211203DDA825 · required

The cert thumbprint

Maximum string length: 255

pkcs · string · default: -----BEGIN PKCS7----- MIIDPA....t8xAA== -----END PKCS7-----

The public certificate of the signing key in pkcs7 format

Maximum string length: 4096

current · boolean · default: true

True if the key is the current key

next · boolean

True if the key is the next key

current_since · string

The date and time when the key became the current key

algorithm · string

Signing key algorithm

key_use · enum<string>

Signing key use, whether for encryption or signing

Available options: encryption, signing

subject_dn · string

Maximum string length: 132