# Generate a public key

`POST /end-to-end-keys`

API version: `v2026.10.00`. Send `X-Moov-Version: v2026.10.00` to get the behavior described here.

> AI agents: search and read all Moov docs with the docs MCP server at https://docs.moov.io/mcp (no API key). Setup: https://docs.moov.io/guides/developer-tools/mcp-ai/docs-mcp/index.md

Generates a public key used to create a JWE token for passing secure authentication data through non-PCI compliant intermediaries.

## Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `X-Moov-Version` | header | string |  | Set this header to v2026.10.00 to use the API described in this specification. When omitted, the server defaults to v2024.01.00, the earliest supported version, which may not match the behavior documented here. An unrecognized well-formed version uses the latest supported version that is not newer than the requested version, when one exists. For example, `v2026.08.00` uses `v2026.07.00`. A malformed value, such as `2022`, returns a `404` response. Values: `v2026.10.00`. |

## Response 200

The request completed successfully.

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `kty` | string | Yes | The cryptographic algorithm family used with the key (e.g., 'RSA', 'EC', 'oct'). |
| `use` | string |  | The intended use of the key. 'sig' for signature, 'enc' for encryption. Values: `sig`, `enc`. |
| `key_ops` | array of string |  | The permitted operations for the key, e.g., 'sign', 'verify', 'encrypt', 'decrypt'. |
| `alg` | string |  | The algorithm intended for use with the key, e.g., 'RS256' or 'ES256'. |
| `kid` | string |  | A unique identifier for the key. |
| `crv` | string |  | The curve for Elliptic Curve keys, e.g., 'P-256', 'P-384', or 'P-521'. This field is required when `kty` is 'EC'. |
| `x` | string |  | The x coordinate for Elliptic Curve keys. This field is required when `kty` is 'EC'. |
| `y` | string |  | The y coordinate for Elliptic Curve keys. This field is required when `kty` is 'EC'. |
| `n` | string |  | The modulus value for RSA keys. This field is required when `kty` is 'RSA'. |
| `e` | string |  | The exponent value for RSA keys. This field is required when `kty` is 'RSA'. |

## Errors

| Status | Meaning |
| --- | --- |
| 429 | Request was refused due to rate limiting. |

## Examples

### cURL

```bash
curl -X POST "https://api.moov.io/end-to-end-keys" \
  -H "Authorization: Bearer {token}" \
  -H "X-Moov-Version: v2026.10.00"
```

### Typescript (SDK)

```typescript
import { Moov } from "@moovio/sdk";

const moov = new Moov({
  security: {
    username: "",
    password: "",
  },
});

async function run() {
  const result = await moov.endToEndEncryption.generateKey();

  console.log(result);
}

run();
```

Full reference with SDK examples in every language: https://docs.moov.io/api/v2026.10.00/authentication/e2ee/create/