A public key is the shareable half of an asymmetric key pair. A user keeps the private key secret, registers the public key with an API, and lets the server verify signatures made with the private key. section 30.2 section 30.3.1
The pair avoids a shared-secret design: the server receives only the public key, while the private key never leaves the user’s control. A public key can verify a signature but cannot generate the corresponding signature. section 30.3.1 section 30.3.3
Use a public key in an authenticated API workflow by:
- Generating the key pair on the client, then serializing the public key into a shareable string. section 30.3.1
- Registering the public key under a user or key identifier so the server can retrieve it later. section 30.2 section 30.3.7
- Verifying the request digest, recomputed fingerprint, selected public key, and digital signature before authentication. section 30.3.6
Signed HTTP request
A request can identify the public key through keyId="1234" and declare algorithm="rsa-sha256" in its Signature header. The server uses that identifier to select the registered public key, recomputes the request fingerprint, and verifies the signature. section 30.3.5
Listing 30.1 Generating a set of credentials
const crypto = require('crypto');
interface KeyPair {
publicKey: string;
privateKey: string;
}
function generateCredentials(size = 2048): Promise<KeyPair> {
return new Promise<KeyPair>( (resolve, reject) => {
crypto.generateKeyPair('rsa', { modulusLength: size },
(err, pub, priv) => {
if (err) { return reject(err); } #1
return resolve({
publicKey: pub.export({ type: 'pkcs1', format: 'pem' }), #2
privateKey: priv.export({ type: 'pkcs1', format: 'pem' })
});
});
});
}
Inspect the TypeScript credential-generation listing to see an RSA key pair exported as PEM strings, with the public key ready for distribution. section 30.3.1
