---
title: "Create a JWK set with an active key"
method: POST
path: "/v2/jwkSets"
tags: ["jwkSets"]
---

# Create a JWK set with an active key

`POST /v2/jwkSets`

## Request

- Base URL: `https://api.sigmacomputing.com`
- URL: `https://api.sigmacomputing.com/v2/jwkSets`
- Auth: HTTP bearer

Create a JWK set and generate its first JSON Web Key as the active signing key. Returns the created key, including the new `jwkSetId`.

### Usage notes
- To perform this operation, you must use API credentials owned by a user assigned the Admin account type.
- The response never includes private key material.

### Usage scenarios
- **New JWT bearer connection:** Create a signing key set for a connection that uses JWT bearer authentication.

## Request body

- object
  - `validForDays` number, double: Number of days the generated certificate is valid for. Must be a positive integer. Defaults to 365.

## Response `200`

The response body.

- JwkSetsCreateJwkSetResponse200
  - `jsonWebKeyId` string, required: Unique identifier of the JSON Web Key.
  - `jwkSetId` string, required: Unique identifier of the JWK set this key belongs to.
  - `algorithm` 'RS256' | 'ES256', required: Signing algorithm this key was generated for.
  - `publicKey` string, required: PEM-encoded X.509 certificate wrapping the public key. Never includes private key material.
  - `expiresAt` string, date-time, required: Expiration timestamp of the underlying certificate.
  - `status` 'active' | 'inactive', required: `active` if this is the key currently used to sign JWT bearer tokens for the set, otherwise `inactive`.

---

[API](https://skmtc.dev/sigmacomputing/apis/sigma-rest-api.md) - [All operations](https://skmtc.dev/sigmacomputing/apis/sigma-rest-api/llms.txt) - [OpenAPI document](https://skmtc.dev/sigmacomputing/apis/sigma-rest-api/revisions/fb6036208c49?raw)