# Upload a public key for private_key_jwt authentication

Creates a new public key entry for the specified tenant API token. The key is used to verify client_assertion JWTs (RFC 7523) during private_key_jwt authentication at the OAuth token endpoint.

Endpoint: POST /resources/tenants/api-tokens/v1/{apiTokenId}/public-keys
Version: 1.0
Security: bearer

## Path parameters:

  - `apiTokenId` (string, required)

## Header parameters:

  - `frontegg-tenant-id` (string, required)
    The tenant ID identifier

## Request fields (application/json):

  - `publicKeyPem` (string, required)
    PEM-encoded public key (SubjectPublicKeyInfo)

  - `kid` (string, required)
    Key identifier (kid) used in JWT header

  - `algorithm` (string, required)
    Signing algorithm this key is used for
    Enum: "RS256", "RS384", "RS512", "ES256", "ES384", "ES512"

  - `name` (string)
    Human-readable label for this key

  - `expiresAt` (string)
    ISO 8601 expiry date; max 2 years from now

## Response 200 fields (application/json):

  - `id` (string, required)

  - `apiTokenId` (string, required)

  - `kid` (string, required)

  - `algorithm` (string, required)

  - `name` (string,null, required)

  - `publicKeyFingerprint` (string, required)
    SHA-256 hex fingerprint of the SubjectPublicKeyInfo DER

  - `isActive` (boolean, required)

  - `expiresAt` (string,null, required)

  - `createdByUserId` (string,null, required)

  - `createdAt` (string, required)

  - `updatedAt` (string, required)

  - `publicKeyPem` (string, required)
    PEM-encoded public key (SubjectPublicKeyInfo)

## Response 201 fields (application/json):

  - `id` (string, required)

  - `apiTokenId` (string, required)

  - `kid` (string, required)

  - `algorithm` (string, required)

  - `name` (string,null, required)

  - `publicKeyFingerprint` (string, required)
    SHA-256 hex fingerprint of the SubjectPublicKeyInfo DER

  - `isActive` (boolean, required)

  - `expiresAt` (string,null, required)

  - `createdByUserId` (string,null, required)

  - `createdAt` (string, required)

  - `updatedAt` (string, required)

  - `publicKeyPem` (string, required)
    PEM-encoded public key (SubjectPublicKeyInfo)