Before you begin
Obtain the enrollment endpoint and one-time token from your administrator. The
token expires after 24 hours and is invalid after its first successful use.
Generate an RSA key of at least 2048 bits in the system that will sign client
assertions. Use RS256, set the JWK use to sig, and retain the private key
in an approved key store.
Submit only a public JWK. Never send a private JWK, private-key PEM, key-store export, or passphrase.
Complete enrollment
Compute the RFC 7638 SHA-256 thumbprint of the public JWK. publicKeyJwk is a
JSON string field, so serialize the public JWK and JSON-escape that serialized
value when embedding it in the request body:
POST /api/customer/enrollment
Content-Type: application/json
{
"token": "<one-time-enrollment-token>",
"publicKeyJwk": "{\"kty\":\"RSA\",\"use\":\"sig\",\"alg\":\"RS256\",\"kid\":\"<base64url-sha256-thumbprint>\",\"n\":\"...\",\"e\":\"AQAB\"}",
"publicKeyThumbprint": "<base64url-sha256-thumbprint>",
"certificateChainPem": null
}
A 202 Accepted response means the public material was recorded for review;
it does not mean the credential is active. Wait for administrator approval
before requesting an access token.
To add mTLS binding, set certificateChainPem to the leaf certificate followed
by every intermediate in PEM format. The leaf must permit TLS client
authentication. The root is normally omitted.
Protect enrollment
Do not log the enrollment token or request body. If enrollment fails, the response intentionally does not distinguish an invalid, expired, used, or revoked token. Request a new enrollment grant rather than repeatedly retrying the same value.