---
title: "Create a JSON Web Key"
method: POST
path: "/v2/jwkSets/{jwkSetId}/jsonWebKeys"
tags: ["jwkSets"]
---

# Create a JSON Web Key

`POST /v2/jwkSets/{jwkSetId}/jsonWebKeys`

## Request

- Base URL: `https://api.sigmacomputing.com`
- URL: `https://api.sigmacomputing.com/v2/jwkSets/{jwkSetId}/jsonWebKeys`
- Auth: HTTP bearer

Generate a new RS256 key pair for a JWK set and inserts it as an inactive key.

### Usage notes
- To perform this operation, you must use API credentials owned by a user assigned the Admin account type.
- A set may hold at most two keys at a time. Delete an existing key before creating a new one.
- The response never includes private key material.

### Usage scenarios
- **Key rotation:** Stage a new key ahead of an upcoming rotation window.

## Path parameters

- `jwkSetId` string, required

## Request body

- object
  - `validForDays` number, double: Number of days the generated certificate is valid for. Must be a positive integer. Defaults to 365.

## Response `200`

The response body.

- JwkSetsCreateJsonWebKeyResponse200
  - `jsonWebKeyId` string, required: Unique identifier of the JSON Web Key.
  - `jwkSetId` string, required: Unique identifier of the JWK set this key belongs to.
  - `algorithm` 'RS256' | 'ES256', required: Signing algorithm this key was generated for.
  - `publicKey` string, required: PEM-encoded X.509 certificate wrapping the public key. Never includes private key material.
  - `expiresAt` string, date-time, required: Expiration timestamp of the underlying certificate.
  - `status` 'active' | 'inactive', required: `active` if this is the key currently used to sign JWT bearer tokens for the set, otherwise `inactive`.

---

[API](https://skmtc.dev/sigmacomputing/apis/sigma-rest-api.md) - [All operations](https://skmtc.dev/sigmacomputing/apis/sigma-rest-api/llms.txt) - [OpenAPI document](https://skmtc.dev/sigmacomputing/apis/sigma-rest-api/revisions/fb6036208c49?raw)