---
title: "Create a certificate"
method: POST
path: "/certificates"
tags: ["certificates"]
---

# Create a certificate

`POST /certificates`

Add a certificate to the authenticated environment for use in [secure payment method tokenization](https://developer.spreedly.com/docs/iframe-api-lifecycle#security-requirements), payment method distribution functions such as [XML digital signatures](https://developer.spreedly.com/reference/order-and-pagination), or to utilize [Apple Pay](https://developer.spreedly.com/docs/apple-pay#generate-certificate).

## Request body

- CreateCertificate
  - `certificate` object
    - `pem` string, required — The signed certificate in PEM format. This value will be empty on initial certificate generation.
    - `private_key` string — The certificate's RSA or EC private key, in non-password-protected PEM format.
    - `level` string — This is an optional parameter for organizational level certificate configuration; the value is set to `environment` by default but you can pass in `organization` for certificates shared across authenticated environments for the same organization.

## Response `201`

Successful

- CreateCertificateResponse
  - `certificate` object
    - `token` string — A unique string generated by Spreedly to identify the certificate.
    - `algorithm` string — The encryption algorithm to use when creating the key pair. Currently, the only supported options are ec-prime256v1 representing the X9.62/SECG curve over a 256 bit prime field, or rsa-2048, which uses a 2048-bit RSA key.
    - `cn` string — The certificate common name
    - `o` string — The organization
    - `ou` string — The organization unit
    - `c` string — The country
    - `st` string — The state
    - `l` string — The locality or city
    - `email_address` string — The email address
    - `public_key` string — PEM-formatted public key of the certificate
    - `public_key_hash` string — The base64 encoded, SHA256 hash, of the public key
    - `csr` string — PEM formatted certificate signing request (CSR)
    - `pem` string — The signed certificate in PEM format. This value will be empty on initial certificate generation.
    - `created_at` string — The time the certificate was created
    - `updated_at` string — The time the certificate was last updated

## Other responses

- `401` — Unauthorized
- `422` — Request not processed

---

[API](https://skmtc.dev/spreedly/apis/spreedly-api-v1.md) · [All operations](https://skmtc.dev/spreedly/apis/spreedly-api-v1/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/spreedly/spreedly-api-v1/revisions/72ba4e23e65c/schema)