---
title: "Add a new signing key"
method: POST
path: "/key_link/signing_keys"
tags: ["Key Link"]
---

# Add a new signing key

`POST /key_link/signing_keys`

## Request

- Base URL: `https://api.fireblocks.io/v1`
- URL: `https://api.fireblocks.io/v1/key_link/signing_keys`
- Auth: none declared
- TypeScript: <https://skmtc.dev/fireblocks/apis/fireblocks-api/docs/key_link/signing_keys/post.ts> (a function with typed inputs; its response is checked against the schema)

Adds a new signing key to the workspace. The added key will be linked to the specific Fireblocks agent user ID. The same user will receive the proof of ownership message to be signed, and upon successful proof, the key will become enabled.

## Headers

- `Idempotency-Key` string

## Request body

- CreateSigningKeyDto
  - `signingDeviceKeyId` string, required: The ID, name or label of the key specified on the customer's signing device.
  - `signedCertPem` string, required: The signed certificate that includes the public key PEM of the signing key, signed by a validation key.
  - `agentUserId` string, required: Id of user to which this key belongs
  - `proofOfOwnership` object: An object containing proof of ownership for the signing key.
    - `message` string, required: The message to be signed by the key as proof of ownership. 64 to 1024 bytes in hexadecimal format.
    - `signature` string, required: The signature of the message. 64 bytes in hexadecimal format.

## Response `201`

Newly created signing key

- SigningKeyDto
  - `keyId` string, required: External signing key id set by Fireblocks.
  - `signingDeviceKeyId` string, required: The ID, name or label of the key specified on the customer's signing device.
  - `publicKeyPem` string, required: PEM encoded public key
  - `algorithm` string, required: Algorithm and curve used for the signature. Can be: ECDSA_SECP256K1 or EDDSA_ED25519
  - `enabled` boolean, required: True if the signing key is enabled
  - `vaultAccountId` number, nullable, required: Id of the vault account which this key is linked to
  - `agentUserId` string, required: Id of user that represent agent servers that can sign with the key
  - `createdAt` number, required: Creation date (timestamp) in milliseconds.

## Other responses

- `default`: Error Response

---

[API](https://skmtc.dev/fireblocks/apis/fireblocks-api.md) - [All operations](https://skmtc.dev/fireblocks/apis/fireblocks-api/llms.txt) - [OpenAPI document](https://skmtc.dev/fireblocks/apis/fireblocks-api/revisions/4eba9965659a?raw)