SSO connectors

Create an SP signing key

Generate a new Service Provider signing key pair for the given SAML SSO connector. Create the key inactive (default) to stage a graceful rotation — register its certificate at the identity provider before activating it. Creating an active key deactivates the currently active key atomically.

post/api/sso-connectors/{id}/signing-keys

Request

  • Base URL: https://[tenant_id].logto.app
  • URL: https://[tenant_id].logto.app/api/sso-connectors/{id}/signing-keys
  • Auth: OAuth 2 (client credentials, token URL /oidc/token, scopes: all)

Path parameters

idstring required

The unique identifier of the sso connector.

Request body

activeboolean required

Whether the new key should become the active signing key immediately. Defaults to false (staged rotation).

Response

The created SP signing key.

idstring required
certificatestring required
createdAtnumber required
expiresAtnumber required
activeboolean required

Changes

No recorded changes to this operation across all 8 revisions of this API.