> ## Documentation Index > Fetch the complete documentation index at: https://auth0.com/llms.txt > Use this file to discover all available pages before exploring further. # Register a consent signing key > Register a consent signing key for the authenticated user. The key is used to verify signed consent decisions. Only the public key is supplied; the corresponding private key must never leave the device. ## OpenAPI ````yaml docs/oas/myaccount/myaccount-api-oas.json POST /consent-signing-keys openapi: 3.1.0 info: title: My Account version: '1.0' description: >- The Auth0 My Account API provides a dedicated set of endpoints for users to manage their own account information. Customers can use these APIs to build self-service experiences in their applications or progressively add details to a user account. The My Account API operates within the context of the currently logged-in user and can be used directly within user-facing applications. :::tip Using Auth0 domain vs. custom domain The My Account API supports using your canonical Auth0 domain or your custom domain, but you must use the same one throughout the entire process, including: - Getting an access token - Setting the audience value - Calling the My Account API endpoint For more information, read [Custom Domains](https://auth0.com/docs/customize/custom-domains). ::: ## Activate the My Account API You can activate the My Account API for your tenant in the Auth0 Dashboard: 1. Navigate to Authentication > APIs. 2. Locate the MyAccount API banner. 3. Select Activate. ![](https://images.ctfassets.net/cdy7uua7fh8z/DGkDQNIHcegN8vtQyEvF3/a2e98b06867701a66fa1f1b3df1c996b/My_Account_API_-_Activate.png) By default, the My Account API is created with the following application API access policies: `require_client_grant` for user flows `deny_all` for client (machine-to-machine) flows For an application to access the My Account API on the user's behalf, you must explicitly create a client grant for that application, which allows you to define the maximum scopes the application can request. Alternatively, you can change the policy for user access flows to allow_all, which allows any application in your tenant to request any scope from the My Account API. Because the My Account API exposes sensitive information and operations, Auth0 does not recommend using allow_all for user access flows. You should follow a least privilege principle with the My Account API to ensure applications only get access to what they truly need, minimizing potential security risks. The final permissions granted to the application will be determined by the intersection of the scopes allowed by the application API access policy, the Role-Based Access Control (RBAC) permissions assigned to the end user, and any user consent given (if applicable). :::info Supported flows You cannot update the application API policy for client access to the My Account API, which means you cannot access the My Account API using the Client Credentials Flow. ::: To learn more about how to manage application API access policies and their associated client grants, read [Application Access to APIs: Client Grants](https://auth0.com/docs/get-started/applications/application-access-to-apis-client-grants). ## Get an access token You can get an access token for the My Account API in the same way you'd get an access token for one of your own APIs. :::info   If you're going to allow the My Account API to perform sensitive operations (such as enrolling an authentication method), we strongly recommend that you use [step-up authentication](https://auth0.com/docs/secure/multi-factor-authentication/step-up-authentication) to enforce additional security policies through [multi-factor authentication (MFA)](https://auth0.com/docs/secure/multi-factor-authentication). ::: If you're using Universal Login, read the following articles: - [Call Your API Using the Authorization Code Flow](https://auth0.com/docs/get-started/authentication-and-authorization-flow/authorization-code-flow/call-your-api-using-the-authorization-code-flow) - [Call Your API Using the Authorization Code Flow with PKCE](https://auth0.com/docs/get-started/authentication-and-authorization-flow/authorization-code-flow-with-pkce/call-your-api-using-the-authorization-code-flow-with-pkce) If you're using embedded login, read the following articles: - [Call Your API Using Resource Owner Password Flow](https://auth0.com/docs/get-started/authentication-and-authorization-flow/resource-owner-password-flow/call-your-api-using-resource-owner-password-flow) - [Login Flow with Native Passkeys API](https://auth0.com/docs/native-passkeys-api#login-flow) ## Examples ### Universal Login with authorization code flow **Step 1: Request authorization code** ``` curl --request GET \ --url 'https://{yourDomain}/authorize?response_type=code&client_id={yourClientId}&redirect_uri=%7ByourRedirectUri%7D&scope=create%3Ame%3Aauthentication_methods&offline_access=&audience=https%3A%2F%2F{yourDomain}%2Fme%2F' ``` **Step 2: Exchange code for access token** ``` curl --request POST \ --url 'https://{yourDomain}/oauth/token' \ --header 'content-type: application/json' \ --data '{"grant_type": "authorization_code","client_id": "{yourClientId}","client_secret": "{yourClientSecret}","code": "{yourAuthorizationCode}","redirect_uri": "{yourRedirectUri}","audience": "{yourAudience}","scope": "create:me:authentication_methods","offline_access": ""}' ``` ### Embedded login with native passkeys **Step 1: Request login challenge** ``` curl --request POST \ --url 'https://{yourDomain}/passkey/challenge' \ --header 'content-type: application/json' \ --data '{"client_id": "{yourClientId}"}' ``` **Step 2: Authenticate existing user** ``` curl --request POST \ --url 'https://{yourDomain}/oauth/token' \ --header 'content-type: application/json' \ --data '{ "grant_type": "urn:okta:params:oauth:grant-type:webauthn", "client_id": "{yourClientId}", "scope": "create:me:authentication_methods offline_access", "audience": "https://{yourDomain}/me/", "auth_session": "{sessionIdFromTheFirstRequest}", "authn_response": "{authenticatorResponse}"}' ``` servers: - url: https://{host}/me/v1 variables: host: default: auth0.auth0.com description: Custom or canonical host name security: [] tags: - name: factors description: Factors x-displayName: Factors - name: connected-accounts description: Connected Accounts x-displayName: Connected Accounts - name: authentication-methods description: Authentication Methods x-displayName: Authentication Methods - name: consents description: Consents x-displayName: Consents - name: organizations description: Organizations x-displayName: Organizations - name: profile description: Profile x-displayName: Profile paths: /consent-signing-keys: post: tags: - consents summary: Register a consent signing key description: >- Register a consent signing key for the authenticated user. The key is used to verify signed consent decisions. Only the public key is supplied; the corresponding private key must never leave the device. operationId: createConsentSigningKey requestBody: content: application/json: schema: $ref: '#/components/schemas/CreateConsentSigningKeyRequestContent' required: true responses: '201': $ref: '#/components/responses/CreateConsentSigningKeyResponse' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '415': $ref: '#/components/responses/UnsupportedMediaType' '422': $ref: '#/components/responses/UnprocessableEntity' '429': $ref: '#/components/responses/TooManyRequests' security: - Bearer-DPoP: - create:me:consent_signing_keys x-codeSamples: [] components: schemas: CreateConsentSigningKeyRequestContent: description: Request body for registering a consent signing key. type: object properties: jwk: $ref: '#/components/schemas/ConsentSigningKeyJwkRequest' device_identifier: type: string description: >- A human-readable label for the device holding the corresponding private key. This is a label only and is not a guarantee that the key is bound to that device. minLength: 1 maxLength: 128 expires_at: type: string format: date-time description: >- When the key should expire. Optional; defaults to the maximum 2 year lifetime. Must be at least 1 hour in the future and no later than the default. required: - jwk - device_identifier additionalProperties: false ConsentSigningKeyJwkRequest: description: >- A public JWK to register for signing consent decisions. ES256 (ECDSA P-256) is the expected algorithm; RS256 and PS256 are also accepted. Only public key material may be supplied, and the key identifier is assigned by Auth0. type: object oneOf: - $ref: '#/components/schemas/ConsentSigningKeyEcJwkRequest' title: ec - $ref: '#/components/schemas/ConsentSigningKeyRsaJwkRequest' title: rsa discriminator: propertyName: kty mapping: EC: '#/components/schemas/ConsentSigningKeyEcJwkRequest' RSA: '#/components/schemas/ConsentSigningKeyRsaJwkRequest' x-openapi-typescript-ignore: true ConsentSigningKey: type: object description: A consent signing key registered by the authenticated user. properties: kid: type: string description: >- The unique identifier of the registered signing key. Supply this when signing a consent decision so the signature can be verified against this key. example: csk_72jbvv7LfRKYp59gtRLtkn jwk: $ref: '#/components/schemas/ConsentSigningKeyJwk' device_identifier: type: string description: >- The human-readable label for the device holding the corresponding private key. created_at: type: string format: date-time description: The date and time when the signing key was registered. expires_at: type: string format: date-time description: >- The date and time when the signing key expires. After this point the key can no longer be used to sign consent decisions and must be replaced. required: - kid - jwk - device_identifier - created_at - expires_at additionalProperties: false ErrorResponse: properties: type: type: string status: type: number title: type: string detail: type: string validation_errors: type: array items: $ref: '#/components/schemas/ValidationError' required: - type - status - title - detail type: object additionalProperties: false ConsentSigningKeyEcJwkRequest: type: object description: >- A public ECDSA P-256 JWK to register for signing consent decisions. Private key material must never be supplied. The key identifier is assigned by Auth0 and must not be supplied. properties: kty: type: string description: The key type. Elliptic Curve. const: EC crv: type: string description: The curve the key is defined over. Only P-256 is supported. const: P-256 alg: type: string description: The algorithm the key is intended to be used with. const: ES256 use: type: string description: The intended use of the key. The key must be a signing key. const: sig x: type: string description: The base64url-encoded x coordinate of the public key. pattern: ^[A-Za-z0-9_-]{43}$ 'y': type: string description: The base64url-encoded y coordinate of the public key. pattern: ^[A-Za-z0-9_-]{43}$ required: - kty - crv - alg - use - x - 'y' additionalProperties: false ConsentSigningKeyRsaJwkRequest: type: object description: >- A public RSA JWK to register for signing consent decisions. Private key material must never be supplied. The key identifier is assigned by Auth0 and must not be supplied. RSA keys are supported but atypical for hardware-bound device keys; prefer ES256. properties: kty: type: string description: The key type. RSA. const: RSA alg: $ref: '#/components/schemas/ConsentSigningKeyRsaAlgorithmEnum' use: type: string description: The intended use of the key. The key must be a signing key. const: sig 'n': type: string description: >- The base64url-encoded modulus of the public key. A 2048-bit modulus encodes to 342 characters, a 4096-bit one to 683. The upper bound is 1000 rather than consents-api's 1400 because this service compiles patterns with RE2, which rejects bounded repetition above 1000; 1000 still admits moduli well beyond 4096 bits. pattern: ^[A-Za-z0-9_-]{342,1000}$ e: type: string description: The base64url-encoded public exponent of the public key. pattern: ^[A-Za-z0-9_-]{1,16}$ required: - kty - alg - use - 'n' - e additionalProperties: false ConsentSigningKeyJwk: description: >- A registered public JWK used to sign consent decisions, including the key identifier Auth0 assigned to it. type: object oneOf: - $ref: '#/components/schemas/ConsentSigningKeyEcJwk' title: ec - $ref: '#/components/schemas/ConsentSigningKeyRsaJwk' title: rsa discriminator: propertyName: kty mapping: EC: '#/components/schemas/ConsentSigningKeyEcJwk' RSA: '#/components/schemas/ConsentSigningKeyRsaJwk' x-openapi-typescript-ignore: true ValidationError: type: object properties: detail: type: string field: type: string pointer: type: string source: type: string required: - detail additionalProperties: false ConsentSigningKeyRsaAlgorithmEnum: type: string description: The RSA signing algorithm the key is intended to be used with. enum: - RS256 - PS256 ConsentSigningKeyEcJwk: type: object description: >- A registered public ECDSA P-256 JWK used to sign consent decisions. Private key material is never stored or returned. properties: kty: type: string description: The key type. Elliptic Curve. const: EC crv: type: string description: The curve the key is defined over. const: P-256 alg: type: string description: The algorithm the key is intended to be used with. const: ES256 use: type: string description: The intended use of the key. const: sig x: type: string description: The base64url-encoded x coordinate of the public key. pattern: ^[A-Za-z0-9_-]{43}$ 'y': type: string description: The base64url-encoded y coordinate of the public key. pattern: ^[A-Za-z0-9_-]{43}$ kid: type: string description: >- The key identifier Auth0 assigned to this key. Matches the top-level `kid`. minLength: 1 maxLength: 128 required: - kty - crv - alg - use - x - 'y' - kid additionalProperties: false ConsentSigningKeyRsaJwk: type: object description: >- A registered public RSA JWK used to sign consent decisions. Private key material is never stored or returned. properties: kty: type: string description: The key type. RSA. const: RSA alg: $ref: '#/components/schemas/ConsentSigningKeyRsaAlgorithmEnum' use: type: string description: The intended use of the key. const: sig 'n': type: string description: The base64url-encoded modulus of the public key. pattern: ^[A-Za-z0-9_-]{342,1000}$ e: type: string description: The base64url-encoded public exponent of the public key. pattern: ^[A-Za-z0-9_-]{1,16}$ kid: type: string description: >- The key identifier Auth0 assigned to this key. Matches the top-level `kid`. minLength: 1 maxLength: 128 required: - kty - alg - use - 'n' - e - kid additionalProperties: false responses: CreateConsentSigningKeyResponse: content: application/json: schema: $ref: '#/components/schemas/ConsentSigningKey' description: Consent signing key registered successfully headers: Location: $ref: '#/components/headers/ConsentSigningKeyLocationHeader' x-ratelimit-limit: $ref: '#/components/headers/XRateLimitLimitHeader' x-ratelimit-reset: $ref: '#/components/headers/XRateLimitResetHeader' x-ratelimit-remaining: $ref: '#/components/headers/XRateLimitRemainingHeader' BadRequest: content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' description: Invalid input based on schema. headers: x-correlation-id: $ref: '#/components/headers/CorrelationIdHeader' traceparent: $ref: '#/components/headers/TraceparentHeader' Unauthorized: content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' description: Unauthorized. headers: x-correlation-id: $ref: '#/components/headers/CorrelationIdHeader' traceparent: $ref: '#/components/headers/TraceparentHeader' Forbidden: content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' description: Forbidden. headers: x-correlation-id: $ref: '#/components/headers/CorrelationIdHeader' traceparent: $ref: '#/components/headers/TraceparentHeader' UnsupportedMediaType: content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' description: Unsupported Media Type. headers: x-correlation-id: $ref: '#/components/headers/CorrelationIdHeader' traceparent: $ref: '#/components/headers/TraceparentHeader' UnprocessableEntity: content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' description: >- The request was well-formed but cannot be processed in the current state, for example because a resource limit has been reached. TooManyRequests: content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' description: Too Many Requests. headers: retry-after: $ref: '#/components/headers/RetryAfterHeader' x-ratelimit-limit: $ref: '#/components/headers/XRateLimitLimitHeader' x-ratelimit-reset: $ref: '#/components/headers/XRateLimitResetHeader' x-ratelimit-remaining: $ref: '#/components/headers/XRateLimitRemainingHeader' x-auth0-error-kind: $ref: '#/components/headers/XAuth0ErrorKindHeader' x-correlation-id: $ref: '#/components/headers/CorrelationIdHeader' traceparent: $ref: '#/components/headers/TraceparentHeader' headers: ConsentSigningKeyLocationHeader: required: true description: URL of the registered consent signing key resource. schema: type: string format: uri examples: create: summary: Location URL for a newly registered consent signing key value: >- https://auth0.auth0.com/me/v1/consent-signing-keys/csk_72jbvv7LfRKYp59gtRLtkn XRateLimitLimitHeader: required: true description: >- The maximum number of requests permissible during the limit’s window window schema: type: number XRateLimitResetHeader: required: true description: >- The anticipated time (as a UNIX timestamp, in seconds) when the bucket will be replenished schema: type: number XRateLimitRemainingHeader: required: true description: >- The number of remaining requests remaining in the current window until requests are rejected schema: type: number CorrelationIdHeader: required: false description: >- Echoes the validated `x-correlation-id` supplied on the request, or a generated UUID v4 when none was supplied. schema: type: string TraceparentHeader: required: false description: >- A [W3C Trace Context](https://www.w3.org/TR/trace-context/) header echoing the inbound trace ID with a fresh child span ID. schema: type: string RetryAfterHeader: required: true description: The number of seconds the client should wait before making a new request schema: type: number XAuth0ErrorKindHeader: description: >- An indicator that the rate limit exceeded a is global (per tenant) limit. schema: type: string const: global-rate-limit securitySchemes: Bearer-DPoP: type: http scheme: bearer description: Bearer and DPoP tokens are supported depending on the API configuration ````