---
title: "Enroll an agent public key"
method: POST
path: "/v1/inboxes/{inbox_id}/identity/keys"
tags: ["Identity"]
---

# Enroll an agent public key

`POST /v1/inboxes/{inbox_id}/identity/keys`

## Request

- Base URL: `https://api.deadsimple.email`
- URL: `https://api.deadsimple.email/v1/inboxes/{inbox_id}/identity/keys`
- Auth: HTTP bearer

Enrolls a P-256 (secp256r1) public key so the agent can sign in with an ES256 assertion instead of an API key. Accepts a JWK object, a JWK string, or a PEM. A JWK carrying a private component (d) or a key on any other curve is rejected. The same key cannot be enrolled on two inboxes. SDK: `identity.enroll_key` / `identity.enrollKey`.

## Path parameters

- `inbox_id` string, required

## Request body

- object
  - `public_key` union, required
    - object: JWK with kty EC, crv P-256, x, y
    - string: A JWK as a JSON string, or a PEM public key
  - `name` string: Label, for example "worker-7".

## Response `201`

Key enrolled. Use kid in the assertion's JWS header.

- IdentityKey
  - `kid` string: RFC 7638 thumbprint prefix. Put it in the assertion's JWS header.
  - `inbox_id` string
  - `email` string
  - `name` string
  - `jwk` object: The enrolled P-256 public key (kty EC, crv P-256, x, y, kid).
  - `created_at` string, date-time
  - `last_used_at` string, date-time, nullable

## Other responses

- `400`: Not a valid P-256 public key, or private material was sent.
- `409`: This public key is already enrolled on another inbox.

---

[API](https://skmtc.dev/deadsimple/apis/dead-simple-email-api.md) · [All operations](https://skmtc.dev/deadsimple/apis/dead-simple-email-api/llms.txt) · [OpenAPI document](https://skmtc.dev/deadsimple/apis/dead-simple-email-api/revisions/c697881be131?raw)