Create an Agent API cryptographic key

Agent API key creation asks the Neuron to create and store encrypted key material for supported signing workflows. This differs from a direct XMPP client that manages its own private keys.

Expected result

Authenticated Agent API session
        ↓
Supported algorithm selected
        ↓
Signed key-creation request
        ↓
Encrypted key stored by the Neuron
        ↓
Stable key reference retained for identity and signing workflows

Procedure

Call POST /Agent/Crypto/GetAlgorithms with the documented empty JSON body.
Select an algorithm accepted by the relying identity or contract workflow; do not hard-code an algorithm merely because one Neuron returns it.
Choose a unique id for the key. This caller-supplied value is the keyId used by later identity and signing operations.
Calculate the signatures using the formulas below.
Submit the request and retain the submitted id, localName, and namespace.
Retrieve the public key through POST /Agent/Crypto/GetPublicKey when the relying workflow needs verification material.

State to retain

Value	Why
Neuron host	Key references are deployment-bound
Local name and namespace	Locate the application key without relying on display text
Key identifier required by later operations	Bind identity and signing requests to the intended key
Algorithm and creation metadata returned by the API	Support validation, rotation, and audit decisions

Never store a key password or account password beside these identifiers. CreateKey returns created and updated; it does not return a generated keyId.

Construct the request

The signed messages use colon separators with no whitespace:

s1 = username:HTTP-Host:localName:namespace:id
keySignature = Base64(HMAC-SHA256(key=UTF8(keyPassword), data=UTF8(s1)))
s2 = s1:keySignature:nonce
requestSignature = Base64(HMAC-SHA256(key=UTF8(accountPassword), data=UTF8(s2)))

HTTP-Host is the exact value sent in the HTTP Host header, including a non-default port. Generate nonce from at least 32 cryptographically random bytes, encode it as Base64, and do not reuse it.

POST /Agent/Crypto/CreateKey HTTP/1.1
Host: <NEURON_HOST>
Referer: https://your-app.example/
Authorization: Bearer <JWT>
Accept: application/json
Content-Type: application/json

{
  "localName": "<ALGORITHM_LOCAL_NAME>",
  "namespace": "<ALGORITHM_NAMESPACE>",
  "id": "agreement-key",
  "nonce": "<FRESH_NONCE>",
  "keySignature": "<CALCULATED_KEY_SIGNATURE>",
  "requestSignature": "<CALCULATED_REQUEST_SIGNATURE>"
}

Send the request over HTTPS using your authenticated session and application URL as Referer. Use the same id in the signed message and JSON body. Store that submitted identifier with the account and Legal Identity that will use it. See Create key reference.

Build an application

Verified identity

Sign-in and signatures

Contracts and agreements

Tokens and digital assets

Wallets and payments

Other application tasks

Reports

Expected result

Procedure

State to retain

Construct the request

Next

​Expected result

​Procedure

​State to retain

​Construct the request

​Next

Expected result

Procedure

State to retain

Construct the request

Next