Trade a signed challenge for a machine credential
For a host that can prove nothing about itself, such as a plain VPS.
/api/v1/auth/keypairFor a host that can prove nothing about itself, such as a plain VPS. It signs the nonce with its enrolled private key and both sides advance a counter, so a copied key still works once and then locks itself and the original out. Run one agent per host, because two racing re-authentications look exactly like a clone.
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
The nonce from the challenge endpoint, the generation this host holds, and an Ed25519 signature over penv-cloud:keypair:v1, the credential id, the nonce and the generation, each on its own line. The signature is base64.
Response Body
application/json
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/api/v1/auth/keypair" \ -H "Content-Type: application/json" \ -d '{ "credentialId": "string", "nonce": "string", "generation": -9007199254740991, "signature": "string" }'{ "credential": "string", "expiresAt": "2019-08-24T14:15:22Z", "generation": -9007199254740991}