app jwk

The OLP CLI supports the
following functionality for JSON Web Key (JWK) management for the application:

• create a JWK for an application
• list JWKs registered for an application
• delete a JWK from an application

app jwk create

Associates a JWK with an application.

olp app jwk create <app HRN> <jwk configuration file> [command options]

Required parameters:

• <app HRN> The HRN of the application.
• <jwk configuration file> Path to a JSON file containing a single JWK object in
  RFC 7517 format.

Configuration file

Represents a JSON file containing a single JWK object as defined in
RFC 7517. The properties required
depend on the key type (kty). Currently only RSA keys (RS256) are supported.

Note::

Only public key material should be provided in the configuration file.
If private key parameters (d, p, q, dp, dq, qi) are present, they are ignored during processing and are not logged.

Required fields:

• kty (string) The key type parameter identifying the cryptographic algorithm family.
  Must be RSA.
• n (string) The RSA modulus, encoded as a Base64url value. Required when kty is RSA.
• e (string) The RSA public exponent, encoded as a Base64url value (typically AQAB).
  Required when kty is RSA.

Optional fields:

• kid (string) The key ID. Must be unique within the application's key set. Used to
  match a specific key when verifying JWT assertions. Length: 1-256 characters.
• alg (string) The algorithm intended for use with the key. Must be RS256.
• use (string) The intended use of the public key. Must be sig (signature verification).

Sample Config File:

{
    "kty": "RSA",
    "kid": "rsa-signing-key-2026",
    "alg": "RS256",
    "use": "sig",
    "n": "0vx7agoebGcQSuuPiLJXZptN9nndrQmbXEps2aiAFbWhM78LhWx4cbbfAAtVT86zwu1RK7aPFFxuhDR1L6tSoc_BJECPebWKRXjBZCiFV4n3oknjhMstn64tZ_2W-5JsGY4Hc5n9yBXArwl93lqt7_RN5w6Cf0h4QyQ5v-65YGjQR0_FDW2QvzqY368QQMicAtaSqzs8KJZgnYb9c7d0zgdAZHzu6qMQvRL5hajrn1n91CbOpbISD08qNLyrdkt-bFTWhAI4vMQFh6WeZu0fM4lFd2NcRwr3XPksINHaQ-G_xBniIqbw0Ls1jF44-csFCur-kEgU8awapJzKnqDKgw",
    "e": "AQAB"
}

Optional parameters:

• --credentials <path to credentials file> The name of a credentials file to use
  with the command. Credentials files are downloaded separately from the HERE platform
  portal.
• --profile <profile name> The name of the credentials profile to use from the
  olpcli.ini file.
• --json Displays the command result in JSON format.
• --quiet Displays the JWK HRN with no additional information.

For more information on using credentials and profiles,
see Credentials setup.

Note::

A maximum of 2 JWKs can be registered per application. If the limit is
exceeded, the command returns an error.

Example:

The command below creates a JWK for the application:

olp app jwk create hrn:here:account::org:app/my-app-1234 jwk.json

Output:

JWK hrn:here:account::org:appJwk/JWK-550e8400-e29b-41d4-a716-446655440000 has been created

app jwk list

Retrieves JWKs registered for an application.

olp app jwk list <app HRN> [command options]

Required parameters:

• <app HRN> The HRN of the application.

Optional parameters:

• --credentials <path to credentials file> The name of a credentials file to use
  with the command. Credentials files are downloaded separately from the HERE platform
  portal.
• --profile <profile name> The name of the credentials profile to use from the
  olpcli.ini file.
• --json Displays the command result in JSON format.
• --quiet Displays a list of JWK HRNs with no additional information.

For more information on using credentials and profiles,
see Credentials setup.

Example:

The command below lists JWKs registered for the application:

olp app jwk list hrn:here:account::org:app/my-app-1234

Output:

HRN                                                                            Key ID                 Key Type   Algorithm   Use   Modulus(n)                                        Exponent(e)   Created At
hrn:here:account::org:appJwk/JWK-550e8400-e29b-41d4-a716-446655440000          rsa-signing-key-2026   RSA        RS256       sig   0vx7agoebGcQSuuPiLJXZptN9nndrQmbXEps2aiAFbWhM...   AQAB           2026-06-08T10:30:00Z
hrn:here:account::org:appJwk/JWK-770a1234-a12b-63c7-c938-668877662222          rsa-signing-key-2025   RSA        RS256       sig   2mX9kgoebGcQSuuPiLJXZptN9nndrQmbXEps2aiAFbWhN...   AQAB           2025-12-15T08:45:00Z

app jwk delete

Deletes a JWK from an application.

olp app jwk delete <app HRN> <JWK HRN> [command options]

Required parameters:

• <app HRN> The HRN of the application.
• <JWK HRN> The HRN of the JWK.

Optional parameters:

• --credentials <path to credentials file> The name of a credentials file to use
  with the command. Credentials files are downloaded separately from the HERE platform
  portal.
• --profile <profile name> The name of the credentials profile to use from the
  olpcli.ini file.
• --quiet Displays empty output with no additional information.

For more information on using credentials and profiles,
see Credentials setup.

Example:

The command below deletes a JWK from the application:

olp app jwk delete hrn:here:account::org:app/my-app-1234 hrn:here:account::org:appJwk/JWK-550e8400-e29b-41d4-a716-446655440000

Output:

JWK hrn:here:account::org:appJwk/JWK-550e8400-e29b-41d4-a716-446655440000 has been deleted