> ## Documentation Index
> Fetch the complete documentation index at: https://docs.base44.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Register as a partner

> How a security partner registers with Base44 to use the Compliance API

A security partner is a company that a business hires to monitor its security and compliance. Workspace owners and admins can share access with a security partner, so it can review their Base44 workspace.

## Register

To register as a verified security partner:

1. Apply on the [Base44 security partners page](https://base44.com/compliance-api#partners).

2. Base44 follows up to schedule a kickoff call and assigns you a partner contact. The partner contact manages your registration and helps with any issues.

3. Generate a key pair that meets the following requirements:

   | Key type | Requirement | Signing algorithm |
   | - | - | - |
   | Elliptic curve | P-256 curve | `ES256` |
   | RSA | At least 2048 bits | `RS256` |

   You use the signing key to sign each authentication token, which is a JSON Web Token (JWT), a signed token that carries claims about who is making the request. Base44 uses the public key to check that each JWT was signed by your signing key.

   Keep the signing key secret and save the public key as `signing.pub`. You can register up to 3 public keys at once.

4. Send the following registration details to your Base44 partner contact:
   * **Display name:** The name of your product.
   * **Slug:** A short identifier. Workspace audit logs show it as the caller of each read.
   * **Technical contact address:** Where Base44 sends notices about key rotation and incidents.
   * **Public key:** The contents of `signing.pub`, in PEM format, which begins with `-----BEGIN PUBLIC KEY-----`.

5. Once approved, Base44 returns a `client_id` that identifies you as a security partner. Include it in every authentication token as the `iss` claim. The `client_id` is an identifier, not a secret.

> [!WARNING]
>
> Never send your signing key. Base44 rejects a private key at registration.

## Managing signing keys

A signing key is the private key of the key pair you registered. Manage its lifecycle by rotating it on a schedule and revoking it when it's exposed or no longer needed.

### Rotate

Rotate a signing key on a regular schedule, when it may have been exposed, or when someone with access to it leaves your team.

**To rotate a signing key:**

1. Generate a new key pair and send your Base44 partner contact the new public key and its `kid` value.
2. Sign authentication tokens with the new signing key, and set `kid` in the token header.
3. Check the last-used time that Base44 records for each registered key to confirm that your traffic has moved.
4. Ask your Base44 partner contact to retire the old key.

### Revoke

Revoking a key stops Base44 from accepting authentication tokens signed with it. Use it when a signing key is exposed, lost, or no longer needed.

To revoke a key, ask your Base44 partner contact to disable it. The change takes effect immediately.

Base44 can also suspend your registration. A suspension stops your access to every workspace at once. As a result, requests return a `403` with the code `partner_not_approved`.

## Next steps

* [Get workspace credentials](https://docs.base44.com/developers/references/compliance-api/get-started/authentication.md#credentials): Get the workspace ID and a workspace API key from a workspace owner or admin.
* [Sign an authentication token](https://docs.base44.com/developers/references/compliance-api/get-started/authentication.md#sign-an-authentication-token): Sign a new authentication token with your signing key for each request.
* [Send a request](https://docs.base44.com/developers/references/compliance-api/get-started/authentication.md#send-a-request): Send the workspace API key and the authentication token, and confirm the connection.
* [Error codes](https://docs.base44.com/developers/references/compliance-api/get-started/error-codes.md): See what each error code indicates.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.