---
title: "Update an App's Signature Type"
method: PUT
path: "/smartapps/{appNameOrId}/signature-type"
tags: ["SmartApps"]
---

# Update an App's Signature Type

`PUT /smartapps/{appNameOrId}/signature-type`

## Request

- Base URL: `https://api.smartthings.com/v1`
- URL: `https://api.smartthings.com/v1/smartapps/{appNameOrId}/signature-type`
- Auth: OAuth 2
  - Implicit: `https://auth-global.api.smartthings.com`
  - Scopes: `w:smartapps`
- TypeScript: <https://skmtc.dev/smartthings/apis/smartthings-api/docs/smartapps/:appNameOrId/signature-type/put.ts> (a function with typed inputs; its response is checked against the schema)

Updates the signature type of an App.  Signature options:
  * APP_RSA - Legacy signing mechanism comprised of a public / private key generated for an App during registration.  This mechanism requires an App to download the public key and deploy along side their integration to verify the signature in the authorization header.
  * ST_PADLOCK - App callbacks are signed with a SmartThings certificate which is publicly available at https://key.smartthings.com.  App's authorize callbacks by fetching the certificate over HTTPS and using it to validate the signature in the authorization header.

When upgrading an App from APP_RSA to ST_PADLOCK, it is recommended to implement both verification methods.
This will provide the ability to seamlessly switch between mechanisms if a rollback is needed.

## Path parameters

- `appNameOrId` string, required

## Headers

- `Authorization` string, string, required

## Request body

- UpdateSignatureTypeRequest: A request object used to switch the signing mechanism for authorizing SmartApp callbacks.
  - `signatureType` 'APP_RSA' | 'ST_PADLOCK': The http signature type used for authorizing event delivery. APP_RSA generates an RSA key pair that will be used to verify requests from SmartThings. ST_PADLOCK requires verifcation through SmartThings public certificate.

## Response `202`

App signature type will be updated asynchronously. This change take effect within a few minutes.

- UpdateSignatureTypeResponse: An empty object response.

## Other responses

- `400`: Bad request
- `401`: Unauthorized
- `403`: Forbidden
- `422`: Unprocessable Entity
- `429`: Too many requests
- `default`: Unexpected error

## Changes

- **2026-11-07** `2788a4236800`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/smartthings/apis/smartthings-api/changes/smartapps/:appNameOrId/signature-type/put.md)

---

[API](https://skmtc.dev/smartthings/apis/smartthings-api.md) - [All operations](https://skmtc.dev/smartthings/apis/smartthings-api/llms.txt) - [OpenAPI document](https://skmtc.dev/smartthings/apis/smartthings-api/revisions/2788a4236800?raw)