# Activate or deactivate an SP signing key

**PATCH /api/sso-connectors/{id}/signing-keys/{keyId}**

Update the activation state of the given Service Provider signing key. Activating a key atomically deactivates the currently active key — the switch step of a graceful rotation. Deactivating the active key is rejected while signed authentication requests are enabled — disable them first (key routes never modify the connector config).


## Servers
- Logto endpoint address.: https://[tenant_id].logto.app (Logto endpoint address.)


## Authentication methods
- O auth2


## Parameters

### Path parameters

- **id** (string)
  The unique identifier of the sso connector.

- **keyId** (string)
  The unique identifier of the key.



### Body: application/json (object)

- **active** (boolean)
  Whether the key should be the active signing key.



## Responses
### 200
The updated SP signing key.

#### Body: application/json (object)
- **id** (string)

- **certificate** (string)

- **createdAt** (number)

- **expiresAt** (number)

- **active** (boolean)

- **fingerprints** (object)


### 400
The key is the active signing key and signed authentication requests are enabled — it cannot be deactivated until they are disabled.

### 401
Unauthorized

### 403
Forbidden

### 404
The SSO connector is not found, is not a SAML connector, or the signing key is not found.


[Powered by Bump.sh](https://bump.sh)