Skip to main content
Once the Co-signer is connected to your workspace, you can manage it through the Console or APIs. This includes sending commands such as pairing additional API users or configuring the Callback Handler for a paired API user. For all types of SGX Co-signers and the AWS Nitro Co-signer, all operations can also be performed via the command-line interface (CLI) on the Co-signer’s host machine. However, due to the enclave architecture of the Google Cloud Confidential Space Co-signer, all operations on this type of Co-signer must be performed exclusively through the Console or APIs. A Google Cloud Confidential Space Co-signer can be connected to only one workspace, and configuration stays in that workspace.

​
Co-signer API operations

Refer to Fireblocks Cosigners API for the list of Co-signer operations you can do using Fireblocks APIs. The operations include:
  • Get all the Co-signers that are connected to the workspace
  • Get the details of a specific Co-signer that is connected to the workspace
  • Rename the Co-signer
  • Get a list of all the API users that are paired with the Co-signer
  • Get the details of a specific API user that is paired with the Co-signer
  • Add a Co-signer to the workspace
  • ❗ Pair an additional API user with a Co-signer
  • Unpair an API user from a Co-signer
  • ❗Update the callback handler of a paired API user
The operations that are marked with ❗ will only work with Co-signers with the following versions:
  • SGX Co-signer: version 3.7.1 or later
  • AWS Nitro Co-signer: version 2.0.5 or later
  • Google Cloud Confidential Space Co-signer: version 0.9.4 or later

​
Co-signer Console operations

You manage paired API users and their Callback Handlers from the Co-signers tab in the Console.

​
Configure the Callback Handler

  1. In the Console, go to Developer center > Co-signers.
  2. Expand the Co-signer. In the Callback Handler column, select +.
  3. Select Configure Callback Handler.
  4. Enter the Callback Handler URL and authentication parameters. See Setup API Co-signer Callback Handler. Select Update.
Configuring the Callback Handler from the Console requires a Co-signer version that supports platform commands. See the version list in Co-signer API operations.
The Console supports only Option 1 (public key authentication) and Option 2 (certificate pinning) from Securing communication. Options 3, 4, and 5 (Root-CA and hybrid options) are currently supported only through local configuration with the Co-signer scripts.
For other Co-signer operations in the Console, such as renaming a Co-signer or pairing an API user, see the Co-signer management tab in the Help Center.

​
Co-signer command-line operations

This section covers operations related to Co-signer management, including adding and configuring API users. For maintenance operations such as viewing logs, updating the Co-signer, and more, refer to the API Co-signer maintenance article.

​
List the paired API users

You can list all API users paired with the Co-signer across the connected workspaces by running the following command:
The output will display a list of all API users paired with your Co-Signer, including the workspace name they are connected to, the API user’s ID (its API key), and the associated Callback Handler server URL (if applicable).

​
Add API user

You can pair an additional API user with your Co-Signer instance by running the following command:
This command works only after the first API user has been paired during the Co-Signer installation.
You will be prompted to provide the API user’s pairing token, which can be retrieved from the Console. If you opt to connect this API user with a Callback Handler, you must also provide the Callback Handler’s URL and its public key or certificate. For more information, refer to the Setup API Co-Signer Callback Handler article.

​
Setup and update Callback Handler for API user

To set up or update the Callback Handler of an API user paired with your Co-signer, run:
If only one API user is paired with your Co-signer, you don’t have to specify the API user ID, which is its API key. You’re prompted for the Callback Handler’s URL and authentication method, then for the public key, certificate, or root CA certificate the method requires. The root CA certificate and hybrid authentication methods (Options 3, 4, and 5 in Securing communication) are available in SGX Co-signer version 2025.12.11 and later and AWS Nitro Co-signer version 2026.08.19 and later. Earlier versions offer only public key and certificate authentication. The command applies each value as follows: A root CA certificate and a pinned certificate can’t be used together. Setting a root CA certificate removes the pinned certificate, and setting a pinned certificate removes the root CA certificate.
The command doesn’t show an error when it keeps an existing value. If you enter a new public key, certificate, or root CA certificate for an API user that already has one, the command completes, but the Co-signer keeps the existing value.
To change a public key or pinned certificate that is already configured, use the APIs or the Console. The APIs and the Console don’t accept a root CA certificate, so to change an existing root CA certificate, unpair (re-enroll) the API user and pair it again with the Co-signer using the add-user command. Re-pairing also works for any of the other settings. If only one API user is paired with your Co-signer, unpairing it results in a full Co-signer setup.
To configure the Callback Handler’s public key or certificate using APIs or through the Console, your Co-signer should meet the requirements for Co-signer platform commands, as described in the Co-signer API operations section within this article.