# Get Public Key
> Retrieve the RSA public key for encrypting sensitive merchant application data. **Content-Type**: `application/json` **Authentication**: None required (public endpoint) **Response**: Returns base64-encoded RSA public key for client-side encryption
Source: https://help.boltapp.com/api-reference/merchant-onboarding/merchant-applications/get-public-key
`GET /v1/merchant-application/public-key`
## OpenAPI definition
This endpoint as it appears in the OpenAPI document, with every schema it references included.
```json
{
"openapi": "3.2.0",
"info": {
"title": "Bolt Connect Merchant Onboarding API",
"version": "1.0.0",
"description": "## Overview\nThis collection provides comprehensive access to Bolt's Platform Connected Merchant Onboarding APIs, designed to enable platform platforms to onboard their sub-merchants seamlessly. The APIs support two primary workflows:\n1. **Direct Onboarding**: Platforms can directly onboard sub-merchants using the merchant application APIs\n2. **Self-Onboarding**: Platforms can generate sharable links for sub-merchants to complete their own onboarding\n\n## API Workflow\nThe typical onboarding workflow follows these steps:\n1. **Get Public Key** (`GET /v1/merchant-application/public-key`):
\nRetrieve RSA public key for encrypting \nsensitive data\n2. **Create Application** (`POST /v1/merchant_applications`):
\nCreate a new merchant application with encrypted company information\n3. **Upload Attachments** (`POST /v1/merchant_applications/{id}/attachments`): Upload required documents (tax verification, bank statements, etc.)\n4. **Update Application** (`PUT /v1/merchant_applications/{id}`):
\nComplete the application with encrypted form submission\n5. **Generate Link** (Optional) (`POST /v1/merchant_applications/onboarding-link`):\nGenerate self-onboarding link for sub-merchants\n\n## Encryption\n Sensitive data in requests must be encrypted using RSA-4096 encryption with the public key obtained from the public key endpoint.\n\n ### Node.js encryption example\n ```javascript\n const crypto = require('crypto');\n const axios = require('axios');\n // Function to fetch public key and encrypt JSON payload\nasync function encryptPayload(baseUrl, apiKey, jsonPayload) {\n try {\n // Step 1: Fetch the public key\n const publicKeyResponse = await axios.get(`${baseUrl}/v1/merchant-application/public-key`);\n const publicKeyBase64 = publicKeyResponse.data.public_key;\n // Step 2: Decode the base64-encoded PEM public key\n const publicKeyPEM = Buffer.from(publicKeyBase64, 'base64').toString('utf8');\n // Step 3: Convert JSON payload to string\n const payloadString = JSON.stringify(jsonPayload);\n // Step 4: Encrypt the payload using RSA-OAEP with SHA-256\n const encryptedBuffer = crypto.publicEncrypt({\n key: publicKeyPEM,\n padding: crypto.constants.RSA_PKCS1_OAEP_PADDING,\n oaepHash: 'sha256'\n }, Buffer.from(payloadString, 'utf8'));\n // Step 5: Encode the encrypted data as base64\n const encryptedPayloadBase64 = encryptedBuffer.toString('base64');\n return {\n encrypted_payload: encryptedPayloadBase64\n };\n } catch (error) {\n console.error('Encryption failed:', error);\n throw error;\n }\n}\n// Example usage:\nconst payload = {\n company_information: {\n email_address: \"company@example.com\",\n phone_number: \"+1234567890\",\n registered_address: {\n address_line1: \"123 Main St\",\n city: \"San Francisco\",\n state: \"CA\",\n zip: \"94105\",\n country: \"US\"\n },\n billing_address: {\n address_line1: \"123 Main St\",\n city: \"San Francisco\",\n state: \"CA\",\n zip: \"94105\",\n country: \"US\"\n },\n annual_processing_volume: 1000000,\n average_transaction_value: 5000,\n highest_transaction_value: 10000\n }\n};\n// Encrypt and send request\nencryptPayload('https://api.boltapp.com', 'your-api-key', payload)\n .then(encryptedData => {\n // Use encryptedData in your API request\n return axios.post(`${baseUrl}/v1/merchant_applications`, encryptedData, {\n headers: {\n 'Content-Type': 'application/json',\n 'X-API-Key': 'your-api-key'\n }\n });\n})\n.then(response => {\n console.log('Merchant application created:', response.data);\n})\n.catch(error => {\n console.error('Request failed:', error);\n});\n ```\n"
},
"servers": [
{
"url": "https://api.boltapp.com"
}
],
"paths": {
"/v1/merchant-application/public-key": {
"get": {
"operationId": "get_public_key",
"summary": "Get Public Key",
"description": "Retrieve the RSA public key for encrypting sensitive merchant application data.\n\n**Content-Type**: `application/json`\n\n**Authentication**: None required (public endpoint)\n\n**Response**: Returns base64-encoded RSA public key for client-side encryption",
"responses": {
"200": {
"description": "RSA public key",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"public_key": {
"type": "string",
"description": "Base64-encoded PEM RSA public key"
}
},
"required": [
"public_key"
]
},
"examples": {
"success": {
"value": {
"public_key": "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlJQ0lqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FnOEFNSUlDQ2dLQ0FnRUF4..."
}
}
}
}
}
},
"500": {
"description": "Internal Server Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ErrorResponse"
},
"examples": {
"Internal Server Error": {
"value": {
"errors": [
{
"code": 46,
"message": "Internal error",
"field": ""
}
]
}
}
}
}
}
}
},
"tags": [
"Merchant Applications"
],
"security": []
}
}
},
"components": {
"schemas": {
"ErrorResponse": {
"type": "object",
"properties": {
"errors": {
"type": "array",
"items": {
"type": "object",
"properties": {
"code": {
"type": "integer",
"description": "Numeric error code"
},
"message": {
"type": "string",
"description": "Human-readable error message"
},
"field": {
"type": "string",
"description": "Field related to the error, if applicable"
}
}
}
}
}
}
},
"securitySchemes": {
"ApiKeyAuth": {
"type": "apiKey",
"in": "header",
"name": "X-API-Key",
"description": "API key used to authorize requests for non-public endpoints."
}
}
}
}
```