Cryptographic Keys

We leverage cryptographic keys to create cryptographic message signatures. These signatures help to maintain the authenticity and integrity of HTTP requests within the Pipevest platform.

Supported Key Types

We currently only support ED25519 key types.

Instructions to Generate Keys

Note

You can use any Cryptographic Key Generator of your choice

Generate Staging Keys

1. Private Key

  openssl genpkey -algorithm ed25519 -outform PEM -out staging-pipevest-private-ed25519.pem

2. Public Key

  openssl pkey -in staging-pipevest-private-ed25519.pem -pubout -out staging-pipevest-public-ed25519.pub

Copy Staging Public Key

MacOs

  pbcopy < ./staging-pipevest-public-ed25519.pub

Linux

  cat ./staging-pipevest-public-ed25519.pub | xclip

Windows

  cat ./staging-pipevest-public-ed25519.pub | clip

Note

This public key will need to be submitted when requesting API access

Generate Production Keys

1. Private Key

  openssl genpkey -algorithm ed25519 -outform PEM -out production-pipevest-private-ed25519.pem

2. Public Key

  openssl pkey -in production-pipevest-private-ed25519.pem -pubout -out production-pipevest-public-ed25519.pub

Copy Production Public Key

MacOs

  pbcopy < ./production-pipevest-public-ed25519.pub

Linux

  cat ./production-pipevest-public-ed25519.pub | xclip

Windows

  cat ./production-pipevest-public-ed25519.pub | clip

Note

This public key will need to be submitted when requesting API access

Note

The generated private keys must be safely secured in accordance with your organization’s cryptographic key retention policies.

Registering and rotating your key

Send us the public half only (the .pub file — SPKI PEM, the -----BEGIN PUBLIC KEY----- block). Pipevest never asks for, and never stores, a partner private key.

Registration is performed by Pipevest against your credential. Email engineering.support@pipevest.com with:

• your client ID,
• the public key,
• the key id you intend to send as the keyid signature parameter (e.g. staging-pipevest-ed25519), and
• optionally, the IP addresses your requests will originate from.

The same operation sets all three, so send the IP allowlist at the same time if you want one. Leave it out and requests are accepted from any source IP.

Caution

Until a public key is registered against your credential, every signed request fails with 401 "No signing key registered for this client". Register the key before you start integrating.

Rotation. Use the same route: send the new public key and key id, and we replace the one on file. A credential holds one active key at a time, so cut over in a single step — sign with the old key until we confirm, then switch. Rotate immediately if a private key is suspected of exposure.