Create an SP signing key

Add MCP server to your AI tool

Allow AI tools and LLMs to interact with the API documentation portal through MCP.

MCP server URL

https://openapi.logto.io/mcp

Standard setup for AI tools providing an mcp.json file

mcp.json 
{
  "Logto API references MCP server": {
    "url": "https://openapi.logto.io/mcp"
  }
}
Close
POST /api/sso-connectors/{id}/signing-keys
O auth2

Generate a new Service Provider signing key pair for the given SAML SSO connector. Create the key inactive (default) to stage a graceful rotation — register its certificate at the identity provider before activating it. Creating an active key deactivates the currently active key atomically.

Path parameters

  • id string Required

    The unique identifier of the sso connector.

application/json

Body Required

  • active boolean Required

    Whether the new key should become the active signing key immediately. Defaults to false (staged rotation).

    Default value is false.

Responses

  • 201 application/json

    The created SP signing key.

    Hide response attributes Show response attributes object
    • id string Required

      Minimum length is 1, maximum length is 21.

    • certificate string Required

      Minimum length is 1.

    • createdAt number Required
    • expiresAt number Required
    • active boolean Required
    • fingerprints object Required
      Hide fingerprints attribute Show fingerprints attribute object
      • sha256 object Required
        Hide sha256 attributes Show sha256 attributes object
        • formatted string Required
        • unformatted string Required
  • 400

    Bad Request

  • 401

    Unauthorized

  • 403

    Forbidden

  • 404

    The SSO connector is not found or is not a SAML connector.

POST /api/sso-connectors/{id}/signing-keys 
curl \
 --request POST 'https://[tenant_id].logto.app/api/sso-connectors/{id}/signing-keys' \
 --header "Authorization: Bearer $ACCESS_TOKEN" \
 --header "Content-Type: application/json" \
 --data '{"active":false}'
Request examples 
{
  "active": false
}
Response examples (201) 
{
  "id": "string",
  "certificate": "string",
  "createdAt": 42.0,
  "expiresAt": 42.0,
  "active": true,
  "fingerprints": {
    "sha256": {
      "formatted": "string",
      "unformatted": "string"
    }
  }
}