---
title: "Generate a client certificate"
method: POST
path: "/companies/{companyId}/clientCertificates"
tags: ["Client certificates - company level"]
---

# Generate a client certificate

`POST /companies/{companyId}/clientCertificates`

## Request

- Base URL: `https://management-live.adyen.com`
- URL: `https://management-live.adyen.com/companies/{companyId}/clientCertificates`
- Auth: one of:
  - HTTP basic
  - API key in header `X-API-Key`

Generates a client certificate for secure communication with Adyen using mutual TLS (mTLS). Provide a certificate signing request (CSR). Adyen signs it and returns the client certificate.

The CSR must be generated by a key pair that meets the following criteria:
* Key ownership: the CSR must be signed by the associated private key.
* Key type: RSA with a minimum key size of 2048 bits, or ECC with a minimum key size of 224 bits.

A company account can have a maximum of 10 valid client certificates at a time.

The subject distinguished name (`subjectDN`) of the issued certificate is constructed by Adyen from the path `companyId` and the request `apiCredential`. The subject in your CSR is not used. The returned `subjectDN` has the format `UID={apiCredential}-Company.{companyId},CN={apiCredential}-Company.{companyId},O=Company.{companyId}`.

To make this request, your API credential must have the following [roles](https://docs.adyen.com/development-resources/api-credentials#api-permissions):
* Management API - Client certificates read and write

## Path parameters

- `companyId` string, required: The unique identifier of the company account.

## Request body

- ClientCertificateRequest
  - `apiCredential` string, required: The API Credential that you want to use this certificate with, in the format 'ws_*@Company.*'. NOTE: You must assign the DN on that specified API credential with the one from the generated client certificate. Accomplish this either through the Customer Area API Credential page or the PATCH endpoint for apiCredentials
  - `certificateSigningRequest` string, required: Certificate signing request. Must be a Base64-encoded DER string. Only the public key is enrolled; see the enroll operation for subject handling.

## Response `201`

Created - Client certificate was generated successfully.

- ClientCertificateWithChain
  - `caChain` string[], required: Certificate chain with intermediates and Management Certificate Authority Root which excludes the signed client certificate leaf
  - `id` string, required: The unique identifier of the client certificate
  - `leaf` string, byte, required: Signed client certificate as a Base64-encoded DER string
  - `serialNumber` string, required: Serial number of client certificate
  - `subjectDN` string, required: Subject DN (Distinguished Name) of client certificate. Server-generated from `companyId` and `apiCredential`; see the enroll operation for details.

## Other responses

- `400`: Bad Request - The provided CSR is malformed or of an incorrect format.
- `401`: Unauthorized - The API credential used in the request is invalid.
- `403`: Forbidden - Insufficient permissions to process the request.
- `422`: Unprocessable Entity - a request validation error: missing or invalid request fields, a certificate signing request that does not meet our requirements, or the company has reached its limit of 10 client certificates.
- `429`: Too Many Requests - Request rate limit exceeded.
- `500`: Internal Server Error - An unrecoverable error occurred while trying to perform the request.

## Changes

- **2026-09-23** (v3) `55cb8143ce0e`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/adyen/apis/management-api/changes/companies/:companyId/clientCertificates/post.md)

---

[API](https://skmtc.dev/adyen/apis/management-api.md) - [All operations](https://skmtc.dev/adyen/apis/management-api/llms.txt) - [OpenAPI document](https://skmtc.dev/adyen/apis/management-api/revisions/55cb8143ce0e?raw)