> ## Documentation Index
> Fetch the complete documentation index at: https://docs.methodfi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# MLE Public Keys Overview

> Manage your public keys for Message Level Encryption

## Overview

The MLE Public Keys API allows you to manage your public keys used for Message Level Encryption (MLE) with Method's API. You can register, retrieve, and delete your public keys through these endpoints.

Two key uses are supported:

* **Encryption keys** (`use: "enc"`, `alg: "RSA-OAEP-256"`) are used by Method to encrypt responses to you. Every MLE integration needs one.
* **Signing keys** (`use: "sig"`, `alg: "RS256"`) are used by Method to verify the signature on your requests. These are required only on the [signed MLE path](/2026-03-30/reference/message-level-encryption#signed-message-level-encryption).

## Key Management Operations

| Operation | Endpoint | Description |
| - | - | - |
| **Create** | `POST /teams/mle/public_keys` | Register a new public key |
| **List** | `GET /teams/mle/public_keys` | Retrieve your active registered keys |
| **Retrieve** | `GET /teams/mle/public_keys/:id` | Get a specific key by ID |
| **Delete** | `DELETE /teams/mle/public_keys/:id` | Delete (disable) a specific key |

## Key Registration Types

You can register your public key using two methods:

### Direct Registration

Post your public key directly to Method with the JWK fields.

### Well-Known Endpoint

Provide a URL where Method can dynamically fetch your JWKS (JSON Web Key Set).

<Note>
  **Important**: Each key ID (`kid`) can only be registered once using either method. If you have a public key available through your well-known endpoint, you should not register the same public key through direct registration, even if you change the `kid`.
</Note>

A team may use both mechanisms together, provided each `kid` is registered through only one of them. A single well-known endpoint can serve both your encryption key and your signing key.

## Key Status

Your registered keys can have the following statuses:

* **active**: The key is in service for its declared use — encrypting responses to you for `use: "enc"`, or verifying your request signatures for `use: "sig"`
* **disabled**: The key has been deleted and cannot be used

Keys also accept optional `iat`, `nbf`, and `exp` claims. Method preserves them and uses them for key selection and validity checks on the [signed MLE path](/2026-03-30/reference/message-level-encryption#signed-message-level-encryption).

## Authentication

All MLE Public Keys API endpoints require authentication using your Method API key:

```
Authorization: Bearer sk_your_token
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.