---
title: "Add partner public key"
method: POST
path: "/v2/companies/{companyId}/partner-public-keys"
tags: ["Partner Public Keys"]
---

# Add partner public key

`POST /v2/companies/{companyId}/partner-public-keys`

## Request

- Base URL: `https://api-ext-sboxmeta.partners.spotnana.com`
- URL: `https://api-ext-sboxmeta.partners.spotnana.com/v2/companies/{companyId}/partner-public-keys`
- Auth: HTTP bearer

Adds one or more public keys for a partner organization to use for token exchange authentication. Accessible to TMC, company, and global admins.

## Request body

- AddPartnerPublicKeyRequest: Request to add a partner public key for token exchange authentication. Set keyType to JWKS and populate the jwks field with the RSA public key in standard JWKS format (RFC 7517).
  - `keyType` 'JWKS', required: The type of public key being registered.
  - `jwks` PartnerJwks: A JSON Web Key Set (JWKS) per RFC 7517.
    - `keys` JwkPublicKey[], required: List of public keys. Exactly one key must be provided per request.
      - `kty` 'RSA', required: Key type. Only RSA is supported.
      - `use` 'sig', required: Key use. Must be sig (signature).
      - `alg` 'RS256', required: Signing algorithm. Must be RS256.
      - `kid` string, required: Key ID — used to match the JWT header kid during token exchange.
      - `n` string, required: RSA modulus (base64url-encoded).
      - `e` string, required: RSA public exponent (base64url-encoded).

## Response `201`

Keys created successfully.

- AddPartnerPublicKeyResponse: Response containing the partner public keys that were added.
  - `keys` PartnerPublicKeyInfo[]: List of added partner public keys.
    - `id` string, uuid: Unique identifier for the key.
    - `orgId` string, uuid: Organization this key is scoped to.
    - `kid` string: Key ID extracted from the JWK.
    - `status` 'ACTIVE' | 'REVOKED': Key status.
    - `createdAt` string, date-time: Timestamp when the key was created.
    - `thumbprint` string: RFC 7638 JWK thumbprint (base64url SHA-256 of canonical key material). Use this to verify the correct key was registered.

## Other responses

- `400`: Bad request
- `401`: Unauthorized
- `403`: Forbidden

---

[API](https://skmtc.dev/spotnana/apis/company-api.md) - [All operations](https://skmtc.dev/spotnana/apis/company-api/llms.txt) - [OpenAPI document](https://skmtc.dev/spotnana/apis/company-api/revisions/184a1b415751?raw)