# Create an SP signing key

**POST /api/sso-connectors/{id}/signing-keys**

Generate a new Service Provider signing key pair for the given SAML SSO connector. Create the key inactive (default) to stage a graceful rotation — register its certificate at the identity provider before activating it. Creating an active key deactivates the currently active key atomically.


## Servers
- Logto endpoint address.: https://[tenant_id].logto.app (Logto endpoint address.)


## Authentication methods
- O auth2


## Parameters

### Path parameters

- **id** (string)
  The unique identifier of the sso connector.



### Body: application/json (object)

- **active** (boolean)
  Whether the new key should become the active signing key immediately. Defaults to `false` (staged rotation).



## Responses
### 201
The created SP signing key.

#### Body: application/json (object)
- **id** (string)

- **certificate** (string)

- **createdAt** (number)

- **expiresAt** (number)

- **active** (boolean)

- **fingerprints** (object)


### 400
Bad Request

### 401
Unauthorized

### 403
Forbidden

### 404
The SSO connector is not found or is not a SAML connector.


[Powered by Bump.sh](https://bump.sh)