RegisterSigningKeyDto

deviceLabelstringrequired

Human-friendly device label, e.g. "Chrome 132 on macOS"

publicKeyJwkobjectrequired

Raw JWK as exported by Web Crypto. Must be EC / P-256 / SIG.

Example: {"kty":"EC","crv":"P-256","x":"...","y":"..."}

algorithmstring

Algorithm identifier (default: ECDSA-P256).

keyProtectionstring

Declare HARDWARE only for a key generated in a Secure Enclave / StrongBox. Defaults to SOFTWARE; only HARDWARE keys may co-sign a custody transfer.

Possible values: [HARDWARE, SOFTWARE]

RegisterSigningKeyDto

{
  "deviceLabel": "string",
  "publicKeyJwk": {
    "kty": "EC",
    "crv": "P-256",
    "x": "...",
    "y": "..."
  },
  "algorithm": "string",
  "keyProtection": "HARDWARE"
}