> For the complete documentation index, see [llms.txt](https://partner.doc.bunq.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://partner.doc.bunq.com/documentation/bunq-as-a-service/chapter-0-setting-up-api-context/creating-the-installation.md).

# Creating the installation

#### 1. Installation <a href="#id-1.-installation" id="id-1.-installation"></a>

Installation is the first step in activating your API key!

It creates an **API context**, which is a secure foundation for all future interactions. This step ensures that the API key is properly registered and associated with a trusted user, reducing the risk of unauthorized access. Without installation, the API key alone could be misused if leaked. This is similar to setting up encryption keys before securely exchanging data.

Firstly, you'll need to generate a public-private key pair using OpenSSL following these steps:

1. Open a terminal.
2. Run the following command to generate the key pair:

   ```json
   openssl genrsa -out installation.key && openssl rsa -in installation.key -outform PEM -pubout -out installation.pub
   ```
3. Your installation key pair will be stored as:

   ```json
   $(pwd)/installation.pub #your public-key
   $(pwd)/installation.key #your private-key
   ```
4. Copy the installation.pub value

   ```json
   cat ~(pwd)/installation.pub | pbcopy #this command can be different depending on your Operating System.
   ```

After generating your key pair, you'll be able to pass the `installation.pub` in the request body as value for the field `client_public_key`.

Here you can find all required fields for the installation endpoint:

```json
POST /v1/installation HTTP/1.1
Host: partner-api.sandbox.bunq.com
User-Agent: text
X-Bunq-Client-Authentication: text
Content-Type: application/json
Accept: */*
Content-Length: 28

{
  "client_public_key": "text"
}
```

Installation is used to tell the server about the public key of your key pair. The server uses this key to verify your subsequent calls, which need to be signed with your own private key. Additionally, you can use the token you get from an Installation to authenticate the registration of a new device.

Copy

```json
{
  "Id": {
    "id": 1
  },
  "Token": {
    "id": 1,
    "created": "text",
    "updated": "text",
    "token": "text"
  },
  "ServerPublicKey": {
    "server_public_key": "text"
  }
}
```

#### What's next <a href="#whats-next" id="whats-next"></a>

With the `installation_token` and the `server_public_key` in hands, we are able to authenticate ourselves and register our device for future endpoint calls.