> ## Documentation Index
> Fetch the complete documentation index at: https://sandbox-docs.thundercompute.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Issue an organization sandbox SSH certificate

> Signs a client-generated public key with the organization's sandbox SSH authority. The matching private key remains on the client. The certificate authenticates to every sandbox in the organization until it expires.



## OpenAPI

````yaml /api-reference/openapi.yaml post /sandboxes/ssh-certificate
openapi: 3.1.0
info:
  title: Thunder Sandbox API
  version: '1.0'
  description: Create, inspect, list, update, access, and stop Thunder sandboxes.
  contact:
    name: Thunder Compute Support
    url: https://www.thundercompute.com/contact
    email: support@thundercompute.com
servers:
  - url: https://api.thundercompute.com:8443/v1
    description: Production
security:
  - bearerAuth: []
tags:
  - name: Sandboxes
    description: Short-lived isolated compute environments.
paths:
  /sandboxes/ssh-certificate:
    post:
      tags:
        - Sandboxes
      summary: Issue an organization sandbox SSH certificate
      description: >-
        Signs a client-generated public key with the organization's sandbox SSH
        authority. The matching private key remains on the client. The
        certificate authenticates to every sandbox in the organization until it
        expires.
      operationId: issueSandboxSSHCertificate
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SandboxSSHCertificateRequest'
            example:
              ssh_public_key: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIExampleReplaceWithYourKey
      responses:
        '200':
          description: Certificate issued.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SandboxSSHCertificateResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalError'
        '503':
          $ref: '#/components/responses/Unavailable'
components:
  schemas:
    SandboxSSHCertificateRequest:
      type: object
      required:
        - ssh_public_key
      properties:
        ssh_public_key:
          type: string
          description: >-
            One-line OpenSSH public key whose matching private key remains on
            the client.
    SandboxSSHCertificateResponse:
      type: object
      required:
        - ssh_certificate
        - ssh_ca_public_key
        - principal
        - expires_at
      properties:
        ssh_certificate:
          type: string
          description: >-
            OpenSSH user certificate signed by the organization's sandbox
            authority.
        ssh_ca_public_key:
          type: string
          description: Public key of the organization's sandbox SSH authority.
        principal:
          type: string
          description: Organization-scoped principal accepted by its sandboxes.
        expires_at:
          type: string
          format: date-time
    Error:
      type: object
      required:
        - error
        - message
        - code
      properties:
        error:
          type: string
          description: Stable machine-readable error code.
          example: invalid_request
        message:
          type: string
          description: Human-readable explanation.
          example: Invalid request body
        code:
          type: integer
          description: HTTP status code.
          example: 400
  responses:
    BadRequest:
      description: Invalid request or pagination parameters.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    Unauthorized:
      description: Missing, invalid, or expired bearer token.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    Forbidden:
      description: The organization lacks sandbox access.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    TooManyRequests:
      description: Rate limit exceeded. Honor the Retry-After header.
      headers:
        Retry-After:
          description: Seconds until another request should be attempted.
          schema:
            type: integer
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    InternalError:
      description: Sandbox request failed unexpectedly.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    Unavailable:
      description: >-
        Capacity, access verification, control plane, or scheduler is
        unavailable.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: API token
      description: API token created in the Thunder console.

````