Activate or deactivate an SP signing key

Add MCP server to your AI tool

Allow AI tools and LLMs to interact with the API documentation portal through MCP.

MCP server URL

https://openapi.logto.io/mcp

Standard setup for AI tools providing an mcp.json file

mcp.json 
{
  "Logto API references MCP server": {
    "url": "https://openapi.logto.io/mcp"
  }
}
Close
PATCH /api/sso-connectors/{id}/signing-keys/{keyId}
O auth2

Update the activation state of the given Service Provider signing key. Activating a key atomically deactivates the currently active key — the switch step of a graceful rotation. Deactivating the active key is rejected while signed authentication requests are enabled — disable them first (key routes never modify the connector config).

Path parameters

  • id string Required

    The unique identifier of the sso connector.

  • keyId string Required

    The unique identifier of the key.

application/json

Body Required

  • active boolean Required

    Whether the key should be the active signing key.

Responses

  • 200 application/json

    The updated SP signing key.

    Hide response attributes Show response attributes object
    • id string Required

      Minimum length is 1, maximum length is 21.

    • certificate string Required

      Minimum length is 1.

    • createdAt number Required
    • expiresAt number Required
    • active boolean Required
    • fingerprints object Required
      Hide fingerprints attribute Show fingerprints attribute object
      • sha256 object Required
        Hide sha256 attributes Show sha256 attributes object
        • formatted string Required
        • unformatted string Required
  • 400

    The key is the active signing key and signed authentication requests are enabled — it cannot be deactivated until they are disabled.

  • 401

    Unauthorized

  • 403

    Forbidden

  • 404

    The SSO connector is not found, is not a SAML connector, or the signing key is not found.

PATCH /api/sso-connectors/{id}/signing-keys/{keyId} 
curl \
 --request PATCH 'https://[tenant_id].logto.app/api/sso-connectors/{id}/signing-keys/{keyId}' \
 --header "Authorization: Bearer $ACCESS_TOKEN" \
 --header "Content-Type: application/json" \
 --data '{"active":true}'
Request examples 
{
  "active": true
}
Response examples (200) 
{
  "id": "string",
  "certificate": "string",
  "createdAt": 42.0,
  "expiresAt": 42.0,
  "active": true,
  "fingerprints": {
    "sha256": {
      "formatted": "string",
      "unformatted": "string"
    }
  }
}