Docs API Account keys

Account keys

Account keys are called ACME keys inside the API.

Fields

  • contacts - Array of contact URIs.
  • directory_id - Directory to which this key belongs.
  • id - CertFu’s ID for the account key, eg: acmk_sample123456. (Read-only)
  • jwk_thumbprint - JWK thumbprint of the public key. (Read-only)
  • kid - ACME key id. (Read-only)
  • name - Name of this key.
  • object - Always acme_key. (Read-only)
  • order_validations - Whether orders from this key are challenged or auto_approvedd.
  • public_key - Public EC or RSA key in pem format.
  • state - valid, deactivated (via client), or revoked (via UI/API). (Read-only)
  • used_on - Date of last use. (Read-only)

public_keys may not be reused. If the public_key is updated or state is deactivated or revoked, the old public key is added to a list of invalidated keys.

Required permissions
API Permission
List, Retrieve read
Create, Update, Revoke write

List account keys

Query params
  • directory_id - Filter by directory_id.
  • state - Filter by state.
  • Plus standard paging params.
    • sort - Fields: id (default), name.

directory_id is required.

Request
GET /v1/acme_keys?directory_id=dir_sample123456
Response

On success, 200 with 0 or more account keys.

{
  "collection": [
    {
      "contacts": [
        "mailto:acme@example.com"
      ],
      "directory_id": "dir_sample123456",
      "id": "acmk_sample123456",
      "jwk_thumbprint": "abcdefghij1234567890ABCDEFGHIJ1234567890abc",
      "kid": "https://acme.certfu.com/v2/example-prod/accounts/acmk_sample123456",
      "name": "host.example.com",
      "object": "acme_key",
      "order_validations": "challenge",
      "public_key": "-----BEGIN PUBLIC KEY-----\n(sample)\n-----END PUBLIC KEY-----",
      "state": "valid",
      "used_on": "2026-01-01"
    }
  ],
  "more_results": false
}

Retrieve an account key

Request
GET /v1/acme_keys/acmk_sample123456
Response

On success, 200 with the account key.

{
  "contacts": [
    "mailto:acme@example.com"
  ],
  "directory_id": "dir_sample123456",
  "id": "acmk_sample123456",
  "jwk_thumbprint": "abcdefghij1234567890ABCDEFGHIJ1234567890abc",
  "kid": "https://acme.certfu.com/v2/example-prod/accounts/acmk_sample123456",
  "name": "host.example.com",
  "object": "acme_key",
  "order_validations": "challenge",
  "public_key": "-----BEGIN PUBLIC KEY-----\n(sample)\n-----END PUBLIC KEY-----",
  "state": "valid",
  "used_on": "2026-01-01"
}

Create an account key

Request
POST /v1/acme_keys

{
  "acme_key": {
    "contacts": [
      "https://host2.example.com"
    ],
    "directory_id": "dir_sample123456",
    "name": "host2.example.com",
    "public_key": "-----BEGIN PUBLIC KEY-----\n(sample)\n-----END PUBLIC KEY-----"
  }
}
Response

On success, 201 with the new account key.
On error, 422 with standard error response.

{
  "contacts": [
    "https://host2.example.com"
  ],
  "directory_id": "dir_sample123456",
  "id": "acmk_sample123456",
  "jwk_thumbprint": "abcdefghij1234567890ABCDEFGHIJ1234567890abc",
  "kid": "https://acme.certfu.com/v2/example-prod/accounts/acmk_sample123456",
  "name": "host2.example.com",
  "object": "acme_key",
  "order_validations": "challenge",
  "public_key": "-----BEGIN PUBLIC KEY-----\n(sample)\n-----END PUBLIC KEY-----",
  "state": "valid",
  "used_on": null
}

Update an account key

Request
PUT /v1/acme_keys/acmk_sample123456

{
  "acme_key": {
    "order_validations": "auto_approve"
  }
}
Response

On success, 200 with the updated account key.
On error, 422 with standard error response.

{
  "contacts": [
    "mailto:acme@example.com"
  ],
  "directory_id": "dir_sample123456",
  "id": "acmk_sample123456",
  "jwk_thumbprint": "abcdefghij1234567890ABCDEFGHIJ1234567890abc",
  "kid": "https://acme.certfu.com/v2/example-prod/accounts/acmk_sample123456",
  "name": "host.example.com",
  "object": "acme_key",
  "order_validations": "auto_approve",
  "public_key": "-----BEGIN PUBLIC KEY-----\n(sample)\n-----END PUBLIC KEY-----",
  "state": "valid",
  "used_on": "2026-01-01"
}

Revoke an account key

Request
DELETE /v1/acme_keys/acmk_sample123456
Response

On success, 200 with the updated account key.

{
  "contacts": [
    "mailto:acme@example.com"
  ],
  "directory_id": "dir_sample123456",
  "id": "acmk_sample123456",
  "jwk_thumbprint": "abcdefghij1234567890ABCDEFGHIJ1234567890abc",
  "kid": "https://acme.certfu.com/v2/example-prod/accounts/acmk_sample123456",
  "name": "host.example.com",
  "object": "acme_key",
  "order_validations": "challenge",
  "public_key": "-----BEGIN PUBLIC KEY-----\n(sample)\n-----END PUBLIC KEY-----",
  "state": "revoked",
  "used_on": "2026-01-01"
}

On error, 422 with standard error response.