---
title: "Get the managed signing key a new release build of the app embeds."
method: GET
path: "/apps/{appId}/signing-key"
tags: ["releases"]
---

# Get the managed signing key a new release build of the app embeds.

`GET /apps/{appId}/signing-key`

## Request

- Base URL: `https://api.shorebird.dev/api/v1`
- URL: `https://api.shorebird.dev/api/v1/apps/{appId}/signing-key`
- Auth: one of:
  - HTTP bearer
  - HTTP bearer

Returns the managed patch-signing key a new release build of the
app embeds: the app's own key if it has one, else its
organization's current key. The organization's key is created on
the first call, so repeated calls return the same key until it is
rotated. The CLI calls this before it builds each platform of a
release, embeds the public key, and reports the key's id with each
release artifact it uploads. Requires permission to create the
app's releases.

## Response `200`

The key.

- GetSigningKeyResponse: The response body for GET /apps/{appId}/signing-key.
  - `signing_key` SigningKey, required: A managed patch-signing key: a key Shorebird holds, whose private half never leaves Cloud KMS, and which signs the patches of every release that embeds it.
    - `id` integer, required: The key's id, which a managed release artifact names as signing.key_id.
    - `public_key_pem` string, required: The public key, PEM encoded (SubjectPublicKeyInfo), which a release build embeds to verify its patches.

## Other responses

- `503`: Managed signing is not configured on this server.
- `default`: Standard error response. Emitted for any non-2xx status where a body can be decoded into an [ErrorResponse].

---

[API](https://skmtc.dev/shorebird/apis/shorebird-codepush-api.md) - [All operations](https://skmtc.dev/shorebird/apis/shorebird-codepush-api/llms.txt) - [OpenAPI document](https://skmtc.dev/shorebird/apis/shorebird-codepush-api/revisions/941da8871d10?raw)