diff --git a/cmd/silo-proxy-agent/main.go b/cmd/silo-proxy-agent/main.go
index d9c2fcd..c1a70b5 100644
--- a/cmd/silo-proxy-agent/main.go
+++ b/cmd/silo-proxy-agent/main.go
@@ -21,6 +21,14 @@ import (
 var AppVersion string
 
 func main() {
+	if len(os.Args) > 1 && os.Args[1] == "provision" {
+		if err := runProvision(os.Args[2:]); err != nil {
+			fmt.Fprintf(os.Stderr, "Error: %v\n", err)
+			os.Exit(1)
+		}
+		return
+	}
+
 	InitConfig()
 
 	slog.Info("Silo Proxy Agent", "version", AppVersion)
diff --git a/cmd/silo-proxy-agent/provision.go b/cmd/silo-proxy-agent/provision.go
new file mode 100644
index 0000000..c609018
--- /dev/null
+++ b/cmd/silo-proxy-agent/provision.go
@@ -0,0 +1,113 @@
+package main
+
+import (
+	"bytes"
+	"crypto/tls"
+	"encoding/json"
+	"flag"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+
+	"github.com/EternisAI/silo-proxy/internal/api/http/dto"
+)
+
+func runProvision(args []string) error {
+	fs := flag.NewFlagSet("provision", flag.ExitOnError)
+	server := fs.String("server", "", "Server URL (e.g., https://server:8080)")
+	key := fs.String("key", "", "Provision key")
+	certDir := fs.String("cert-dir", "./certs", "Directory to save certificates")
+	insecure := fs.Bool("insecure", false, "Skip TLS certificate verification (for development only)")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+
+	if *server == "" {
+		return fmt.Errorf("--server is required")
+	}
+	if *key == "" {
+		return fmt.Errorf("--key is required")
+	}
+
+	if *insecure {
+		fmt.Fprintln(os.Stderr, "WARNING: Using insecure TLS mode. This is unsafe for production.")
+	}
+
+	reqBody, err := json.Marshal(dto.ProvisionRequest{Key: *key})
+	if err != nil {
+		return fmt.Errorf("failed to marshal request: %w", err)
+	}
+
+	client := &http.Client{
+		Transport: &http.Transport{
+			TLSClientConfig: &tls.Config{
+				InsecureSkipVerify: *insecure,
+			},
+		},
+	}
+
+	url := *server + "/api/v1/provision"
+	resp, err := client.Post(url, "application/json", bytes.NewBuffer(reqBody))
+	if err != nil {
+		return fmt.Errorf("failed to connect to server: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return fmt.Errorf("failed to read response: %w", err)
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("provisioning failed (HTTP %d): %s", resp.StatusCode, string(body))
+	}
+
+	var provResp dto.ProvisionResponse
+	if err := json.Unmarshal(body, &provResp); err != nil {
+		return fmt.Errorf("failed to parse response: %w", err)
+	}
+
+	agentCertDir := filepath.Join(*certDir, "agents", provResp.AgentID)
+	caCertDir := filepath.Join(*certDir, "ca")
+
+	if err := os.MkdirAll(agentCertDir, 0700); err != nil {
+		return fmt.Errorf("failed to create directory %s: %w", agentCertDir, err)
+	}
+	if err := os.MkdirAll(caCertDir, 0755); err != nil {
+		return fmt.Errorf("failed to create directory %s: %w", caCertDir, err)
+	}
+
+	certPath := filepath.Join(agentCertDir, provResp.AgentID+"-cert.pem")
+	keyPath := filepath.Join(agentCertDir, provResp.AgentID+"-key.pem")
+	caPath := filepath.Join(caCertDir, "ca-cert.pem")
+
+	if err := os.WriteFile(certPath, []byte(provResp.CertPEM), 0644); err != nil {
+		return fmt.Errorf("failed to write cert: %w", err)
+	}
+	if err := os.WriteFile(keyPath, []byte(provResp.KeyPEM), 0600); err != nil {
+		return fmt.Errorf("failed to write key: %w", err)
+	}
+	if err := os.WriteFile(caPath, []byte(provResp.CACertPEM), 0644); err != nil {
+		return fmt.Errorf("failed to write CA cert: %w", err)
+	}
+
+	fmt.Println("Provisioning successful!")
+	fmt.Printf("  Agent ID: %s\n", provResp.AgentID)
+	fmt.Printf("  Cert:     %s\n", certPath)
+	fmt.Printf("  Key:      %s\n", keyPath)
+	fmt.Printf("  CA Cert:  %s\n", caPath)
+	fmt.Println()
+	fmt.Println("Add the following to your agent application.yaml:")
+	fmt.Println()
+	fmt.Printf("grpc:\n")
+	fmt.Printf("  agent_id: \"%s\"\n", provResp.AgentID)
+	fmt.Printf("  tls:\n")
+	fmt.Printf("    enabled: true\n")
+	fmt.Printf("    cert_file: %s\n", certPath)
+	fmt.Printf("    key_file: %s\n", keyPath)
+	fmt.Printf("    ca_file: %s\n", caPath)
+
+	return nil
+}
diff --git a/cmd/silo-proxy-server/application.yaml b/cmd/silo-proxy-server/application.yaml
index cb4eba0..51d09d3 100644
--- a/cmd/silo-proxy-server/application.yaml
+++ b/cmd/silo-proxy-server/application.yaml
@@ -24,3 +24,7 @@ grpc:
     domain_names: "localhost"
     ip_addresses: "127.0.0.1"
     agent_cert_dir: ./certs/agents
+provision:
+  enabled: false
+  key_ttl_hours: 24
+  cleanup_interval_minutes: 60
diff --git a/cmd/silo-proxy-server/config.go b/cmd/silo-proxy-server/config.go
index e767703..447a45e 100644
--- a/cmd/silo-proxy-server/config.go
+++ b/cmd/silo-proxy-server/config.go
@@ -13,11 +13,18 @@ import (
 )
 
 type Config struct {
-	Log  LogConfig
-	Http http.Config
-	Grpc GrpcConfig
-	DB   db.Config   `mapstructure:"db"`
-	JWT  auth.Config `mapstructure:"jwt"`
+	Log       LogConfig
+	Http      http.Config
+	Grpc      GrpcConfig
+	DB        db.Config        `mapstructure:"db"`
+	JWT       auth.Config      `mapstructure:"jwt"`
+	Provision ProvisionConfig  `mapstructure:"provision"`
+}
+
+type ProvisionConfig struct {
+	Enabled                bool `mapstructure:"enabled"`
+	KeyTTLHours            int  `mapstructure:"key_ttl_hours"`
+	CleanupIntervalMinutes int  `mapstructure:"cleanup_interval_minutes"`
 }
 
 type GrpcConfig struct {
diff --git a/cmd/silo-proxy-server/main.go b/cmd/silo-proxy-server/main.go
index 45b2caa..6fc41b9 100644
--- a/cmd/silo-proxy-server/main.go
+++ b/cmd/silo-proxy-server/main.go
@@ -17,6 +17,7 @@ import (
 	"github.com/EternisAI/silo-proxy/internal/db"
 	"github.com/EternisAI/silo-proxy/internal/db/sqlc"
 	grpcserver "github.com/EternisAI/silo-proxy/internal/grpc/server"
+	"github.com/EternisAI/silo-proxy/internal/provision"
 	"github.com/EternisAI/silo-proxy/internal/users"
 	"github.com/gin-contrib/cors"
 	"github.com/gin-gonic/gin"
@@ -92,11 +93,25 @@ func main() {
 		"range_end", config.Http.AgentPortRange.End,
 		"pool_size", config.Http.AgentPortRange.End-config.Http.AgentPortRange.Start+1)
 
+	var keyStore *provision.KeyStore
+	if config.Provision.Enabled {
+		if certService == nil {
+			slog.Error("Provisioning requires TLS to be enabled")
+			os.Exit(1)
+		}
+		ttl := time.Duration(config.Provision.KeyTTLHours) * time.Hour
+		keyStore = provision.NewKeyStore(ttl)
+		cleanupInterval := time.Duration(config.Provision.CleanupIntervalMinutes) * time.Minute
+		go keyStore.StartCleanup(context.Background(), cleanupInterval)
+		slog.Info("Provisioning enabled", "key_ttl_hours", config.Provision.KeyTTLHours)
+	}
+
 	services := &internalhttp.Services{
 		GrpcServer:  grpcSrv,
 		CertService: certService,
 		AuthService: authService,
 		UserService: userService,
+		KeyStore:    keyStore,
 	}
 
 	gin.SetMode(gin.ReleaseMode)
diff --git a/docs/cert-provisioning/overview.md b/docs/cert-provisioning/overview.md
new file mode 100644
index 0000000..4893fba
--- /dev/null
+++ b/docs/cert-provisioning/overview.md
@@ -0,0 +1,285 @@
+# Automated Certificate Provisioning
+
+## Overview
+
+Automate mTLS certificate issuance for agents using a provision key workflow. Instead of manually generating and distributing certificates, an admin creates a one-time provision key on the server, shares it with the agent operator, and the agent uses it to obtain a signed certificate via a REST API.
+
+The agent's private key never leaves the device (CSR-based signing).
+
+## Motivation
+
+Current certificate workflow requires manual steps:
+1. Run `make generate-certs` on the server
+2. Copy `agent-cert.pem`, `agent-key.pem`, and `ca-cert.pem` to each agent device
+3. Configure the agent with cert file paths
+
+This doesn't scale. Each new agent requires SSH access to the server, manual cert generation, and secure file transfer. The provisioning API eliminates this by letting agents self-enroll with a pre-authorized key.
+
+## Architecture
+
+### Flow
+
+```
+ Admin                    Server                     Agent Device
+   |                        |                            |
+   | POST /api/v1/          |                            |
+   |   provision-keys       |                            |
+   | {agent_id: "agent-5"}  |                            |
+   |----------------------->|                            |
+   |   provision_key:       |                            |
+   |   "sk_a1b2c3..."      |                            |
+   |<-----------------------|                            |
+   |                        |                            |
+   |  (copy key to device)  |                            |
+   |~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~>|
+   |                        |                            |
+   |                        |  1. Generate private key   |
+   |                        |  2. Create CSR             |
+   |                        |                            |
+   |                        |  POST /api/v1/provision    |
+   |                        |  {key, csr}                |
+   |                        |<---------------------------|
+   |                        |                            |
+   |                        |  3. Validate key           |
+   |                        |  4. Sign CSR with CA       |
+   |                        |  5. Mark key as used       |
+   |                        |                            |
+   |                        |  {agent_cert, ca_cert}     |
+   |                        |--------------------------->|
+   |                        |                            |
+   |                        |  6. Save certs to disk     |
+   |                        |  7. Connect via mTLS       |
+   |                        |<===========================|
+   |                        |     (gRPC stream)          |
+```
+
+### Design Decisions
+
+**CSR-based signing** (not server-generated keys): The agent generates its own private key locally and sends only a Certificate Signing Request. The private key never crosses the network.
+
+**One-time use keys**: Each provision key can only be used once. After successful provisioning, the key is marked as consumed. This prevents replay attacks.
+
+**Key expiry**: Provision keys expire after a configurable TTL (default: 24 hours). Unused keys are cleaned up automatically.
+
+**Agent ID embedded in certificate CN**: The server sets the certificate's Common Name to the agent ID when signing. During mTLS handshake, the server can verify agent identity directly from the certificate rather than trusting a metadata field.
+
+**Provision API uses standard TLS (not mTLS)**: The agent doesn't have certificates yet at provisioning time, so the provision endpoint must be accessible without client certs. Use standard HTTPS for transport security.
+
+## API Design
+
+### Create Provision Key
+
+Admin creates a key tied to a specific agent ID.
+
+```
+POST /api/v1/provision-keys
+```
+
+Request:
+```json
+{
+  "agent_id": "agent-5",
+  "ttl_hours": 24
+}
+```
+
+Response:
+```json
+{
+  "provision_key": "sk_a1b2c3d4e5f6...",
+  "agent_id": "agent-5",
+  "expires_at": "2026-02-10T12:00:00Z"
+}
+```
+
+### List Provision Keys
+
+Admin lists active (unused, unexpired) provision keys.
+
+```
+GET /api/v1/provision-keys
+```
+
+Response:
+```json
+{
+  "keys": [
+    {
+      "agent_id": "agent-5",
+      "expires_at": "2026-02-10T12:00:00Z",
+      "used": false
+    }
+  ]
+}
+```
+
+The `provision_key` value is not returned in list responses (write-only).
+
+### Revoke Provision Key
+
+Admin revokes a key before it's used.
+
+```
+DELETE /api/v1/provision-keys/:agent_id
+```
+
+### Provision Agent Certificate
+
+Agent exchanges provision key + CSR for a signed certificate.
+
+```
+POST /api/v1/provision
+```
+
+Request:
+```json
+{
+  "provision_key": "sk_a1b2c3d4e5f6...",
+  "csr": "-----BEGIN CERTIFICATE REQUEST-----\nMIIE..."
+}
+```
+
+Response:
+```json
+{
+  "agent_id": "agent-5",
+  "agent_cert": "-----BEGIN CERTIFICATE-----\nMIIF...",
+  "ca_cert": "-----BEGIN CERTIFICATE-----\nMIID..."
+}
+```
+
+Error responses:
+```json
+{"error": "invalid or expired provision key"}
+{"error": "provision key already used"}
+{"error": "invalid CSR format"}
+```
+
+## Data Model
+
+### ProvisionKey
+
+```go
+type ProvisionKey struct {
+    Key       string    // random 32-byte hex token, prefixed "sk_"
+    AgentID   string    // which agent this key provisions
+    ExpiresAt time.Time // auto-expires after TTL
+    Used      bool      // one-time use flag
+    CreatedAt time.Time
+}
+```
+
+### ProvisionKeyStore
+
+```go
+type ProvisionKeyStore struct {
+    keys map[string]*ProvisionKey // key string -> ProvisionKey
+    mu   sync.RWMutex
+}
+
+func (s *ProvisionKeyStore) Create(agentID string, ttl time.Duration) *ProvisionKey
+func (s *ProvisionKeyStore) Validate(key string) (*ProvisionKey, error)
+func (s *ProvisionKeyStore) MarkUsed(key string)
+func (s *ProvisionKeyStore) Revoke(agentID string)
+func (s *ProvisionKeyStore) List() []*ProvisionKey
+func (s *ProvisionKeyStore) CleanupExpired()
+```
+
+## Agent CLI
+
+The agent adds a `provision` subcommand:
+
+```bash
+silo-proxy-agent provision \
+  --server https://server:8080 \
+  --key sk_a1b2c3d4e5f6... \
+  --cert-dir ~/.silo-proxy/certs
+```
+
+This command:
+1. Generates an RSA 4096-bit private key
+2. Creates a CSR from the key
+3. Calls `POST /api/v1/provision` with the key + CSR
+4. Saves the returned files:
+   ```
+   ~/.silo-proxy/certs/
+   ├── agent-key.pem    # generated locally
+   ├── agent-cert.pem   # signed by server CA
+   └── ca-cert.pem      # for verifying server
+   ```
+5. Prints the config snippet for `application.yml`
+
+After provisioning, the agent connects normally:
+
+```bash
+silo-proxy-agent --config ~/.silo-proxy/application.yml
+```
+
+## Server-Side CA Management
+
+The server needs access to the CA private key to sign CSRs. New config fields:
+
+```yaml
+grpc:
+  tls:
+    enabled: true
+    cert_file: "certs/server/server-cert.pem"
+    key_file: "certs/server/server-key.pem"
+    ca_file: "certs/ca/ca-cert.pem"
+    ca_key_file: "certs/ca/ca-key.pem"   # NEW: needed for signing
+    client_auth: "require"
+
+provision:
+  enabled: true
+  key_ttl_hours: 24          # default TTL for provision keys
+  cert_validity_days: 365    # validity period for issued certs
+```
+
+### Certificate Signing
+
+```go
+func SignCSR(csrPEM []byte, caCert *x509.Certificate, caKey crypto.PrivateKey, agentID string, validityDays int) ([]byte, error) {
+    // 1. Parse CSR
+    // 2. Verify CSR signature (proves agent owns the private key)
+    // 3. Create x509 certificate template:
+    //    - Subject CN = agentID (overrides CSR subject)
+    //    - Serial number = random
+    //    - NotBefore = now
+    //    - NotAfter = now + validityDays
+    // 4. Sign with CA private key
+    // 5. Return PEM-encoded certificate
+}
+```
+
+The server overrides the CSR's subject CN with the agent ID from the provision key. This prevents an agent from claiming a different identity.
+
+## Security Considerations
+
+| Concern | Mitigation |
+|---------|------------|
+| Key interception | Provision keys should be shared over a secure channel (HTTPS dashboard, encrypted message). Keys are one-time use, limiting window of attack. |
+| Replay attack | One-time use flag prevents reuse of a provision key. |
+| Stale keys | TTL-based expiry (default 24h). Background cleanup goroutine. |
+| Rogue CSR | Server overrides the CN with the agent ID from the provision key. Agent cannot claim another identity. |
+| CA key compromise | CA key only needed on the server. Restrict file permissions (`chmod 600`). Consider HSM for production. |
+| Provisioning endpoint abuse | Rate limit `/api/v1/provision`. Consider IP allowlisting. Invalid key attempts should be logged. |
+
+## Implementation Phases
+
+- [ ] **Phase 1**: Provision key store (in-memory CRUD + expiry cleanup)
+- [ ] **Phase 2**: Admin API endpoints (create, list, revoke keys)
+- [ ] **Phase 3**: CSR signing logic (parse CSR, sign with CA, return cert)
+- [ ] **Phase 4**: Provision endpoint (`POST /api/v1/provision`)
+- [ ] **Phase 5**: Agent CLI `provision` subcommand
+- [ ] **Phase 6**: Configuration updates (ca_key_file, provision section)
+- [ ] **Phase 7**: Testing and documentation
+
+## Detailed Phase Documentation
+
+- [Phase 1: Provision Key Store](./phase1.md)
+- [Phase 2: Admin API](./phase2.md)
+- [Phase 3: CSR Signing](./phase3.md)
+- [Phase 4: Provision Endpoint](./phase4.md)
+- [Phase 5: Agent CLI](./phase5.md)
+- [Phase 6: Configuration](./phase6.md)
+- [Phase 7: Testing](./phase7.md)
diff --git a/docs/cert-provisioning/phase1.md b/docs/cert-provisioning/phase1.md
new file mode 100644
index 0000000..48079b1
--- /dev/null
+++ b/docs/cert-provisioning/phase1.md
@@ -0,0 +1,101 @@
+# Phase 1: Provision Key Store
+
+**Status**: Pending
+
+## Summary
+
+Implement an in-memory store for provision keys with CRUD operations, one-time use enforcement, TTL-based expiry, and background cleanup.
+
+## Files to Add
+
+- `internal/provision/key_store.go` - Core implementation
+- `internal/provision/key_store_test.go` - Unit tests
+
+## Implementation
+
+### Data Structures
+
+```go
+type ProvisionKey struct {
+    Key       string
+    AgentID   string
+    ExpiresAt time.Time
+    Used      bool
+    CreatedAt time.Time
+}
+
+type KeyStore struct {
+    keys map[string]*ProvisionKey // provision key string -> ProvisionKey
+    mu   sync.RWMutex
+    ttl  time.Duration
+}
+```
+
+### API
+
+```go
+func NewKeyStore(defaultTTL time.Duration) *KeyStore
+func (s *KeyStore) Create(agentID string, ttl time.Duration) *ProvisionKey
+func (s *KeyStore) Validate(key string) (*ProvisionKey, error)
+func (s *KeyStore) MarkUsed(key string)
+func (s *KeyStore) Revoke(agentID string) bool
+func (s *KeyStore) List() []*ProvisionKey
+func (s *KeyStore) StartCleanup(ctx context.Context, interval time.Duration)
+```
+
+### Key Generation
+
+- 32 random bytes, hex-encoded, prefixed with `sk_`
+- Example: `sk_a1b2c3d4e5f6...` (68 characters total)
+- Use `crypto/rand` for generation
+
+### Validate Logic
+
+`Validate` checks three conditions and returns a specific error for each:
+1. Key exists in the map → `"invalid provision key"`
+2. Key not expired → `"provision key expired"`
+3. Key not already used → `"provision key already used"`
+
+Returns the `ProvisionKey` on success.
+
+### Background Cleanup
+
+`StartCleanup` runs in a goroutine, periodically removing keys that are both expired and used (or expired beyond a grace period). Controlled by a context for clean shutdown.
+
+```go
+func (s *KeyStore) StartCleanup(ctx context.Context, interval time.Duration) {
+    ticker := time.NewTicker(interval)
+    defer ticker.Stop()
+    for {
+        select {
+        case <-ctx.Done():
+            return
+        case <-ticker.C:
+            s.removeExpired()
+        }
+    }
+}
+```
+
+### Thread Safety
+
+- All map access protected by `sync.RWMutex`
+- `Create`, `MarkUsed`, `Revoke`, `removeExpired`: write lock
+- `Validate`, `List`: read lock
+
+## Test Cases
+
+1. Create key and validate successfully
+2. Validate with invalid key returns error
+3. Validate expired key returns error
+4. Validate used key returns error
+5. MarkUsed prevents reuse
+6. Revoke removes key for agent
+7. List returns only active (unused, unexpired) keys
+8. Cleanup removes expired keys
+9. Concurrent create + validate (10 goroutines)
+10. Custom TTL override per key
+
+## Next Steps
+
+**Phase 2**: Build admin API endpoints that use KeyStore for CRUD operations.
diff --git a/docs/cert-provisioning/phase2.md b/docs/cert-provisioning/phase2.md
new file mode 100644
index 0000000..0a6cb5c
--- /dev/null
+++ b/docs/cert-provisioning/phase2.md
@@ -0,0 +1,136 @@
+# Phase 2: Admin API
+
+**Status**: Pending
+
+## Summary
+
+Add REST endpoints for admins to create, list, and revoke provision keys. These endpoints are served on the existing admin HTTP server (port 8080).
+
+## Files to Add
+
+- `internal/api/http/handler/provision.go` - Handler functions
+- `internal/api/http/handler/provision_test.go` - Handler tests
+
+## Files to Modify
+
+- `internal/api/http/router.go` - Register new routes
+
+## Routes
+
+```
+POST   /api/v1/provision-keys      → CreateProvisionKey
+GET    /api/v1/provision-keys      → ListProvisionKeys
+DELETE /api/v1/provision-keys/:id  → RevokeProvisionKey
+```
+
+## Implementation
+
+### Handler Struct
+
+```go
+type ProvisionHandler struct {
+    keyStore *provision.KeyStore
+}
+
+func NewProvisionHandler(keyStore *provision.KeyStore) *ProvisionHandler
+```
+
+### CreateProvisionKey
+
+```go
+func (h *ProvisionHandler) CreateProvisionKey(c *gin.Context)
+```
+
+Request:
+```json
+{
+  "agent_id": "agent-5",
+  "ttl_hours": 24
+}
+```
+
+Validation:
+- `agent_id` is required, non-empty
+- `ttl_hours` is optional, defaults to server config value
+- `ttl_hours` must be positive if provided
+
+Response (201):
+```json
+{
+  "provision_key": "sk_a1b2c3d4e5f6...",
+  "agent_id": "agent-5",
+  "expires_at": "2026-02-10T12:00:00Z"
+}
+```
+
+This is the only endpoint that returns the raw key value.
+
+### ListProvisionKeys
+
+```go
+func (h *ProvisionHandler) ListProvisionKeys(c *gin.Context)
+```
+
+Response (200):
+```json
+{
+  "keys": [
+    {
+      "agent_id": "agent-5",
+      "expires_at": "2026-02-10T12:00:00Z",
+      "used": false,
+      "created_at": "2026-02-09T12:00:00Z"
+    }
+  ]
+}
+```
+
+The `provision_key` value is never returned in list responses.
+
+### RevokeProvisionKey
+
+```go
+func (h *ProvisionHandler) RevokeProvisionKey(c *gin.Context)
+```
+
+Deletes the provision key for the given agent ID. The `:id` path parameter is the agent ID.
+
+Response (200):
+```json
+{
+  "message": "provision key revoked",
+  "agent_id": "agent-5"
+}
+```
+
+Response (404) if no key exists for the agent:
+```json
+{
+  "error": "no provision key found for agent"
+}
+```
+
+### Router Registration
+
+```go
+v1 := router.Group("/api/v1")
+{
+    v1.POST("/provision-keys", provisionHandler.CreateProvisionKey)
+    v1.GET("/provision-keys", provisionHandler.ListProvisionKeys)
+    v1.DELETE("/provision-keys/:id", provisionHandler.RevokeProvisionKey)
+}
+```
+
+## Test Cases
+
+1. Create key with valid agent_id returns 201 + key
+2. Create key with missing agent_id returns 400
+3. Create key with custom TTL
+4. List keys returns active keys without raw key values
+5. List keys with no keys returns empty array
+6. Revoke existing key returns 200
+7. Revoke nonexistent key returns 404
+
+## Next Steps
+
+**Phase 3**: Implement CSR parsing and signing logic that the provision endpoint will use.
diff --git a/docs/cert-provisioning/phase3.md b/docs/cert-provisioning/phase3.md
new file mode 100644
index 0000000..8909f85
--- /dev/null
+++ b/docs/cert-provisioning/phase3.md
@@ -0,0 +1,108 @@
+# Phase 3: CSR Signing
+
+**Status**: Pending
+
+## Summary
+
+Implement the certificate signing logic: parse a PEM-encoded CSR, verify it, and sign it with the server's CA key to produce an agent certificate. The agent ID from the provision key is embedded as the certificate's Common Name.
+
+## Files to Add
+
+- `internal/provision/signer.go` - CSR parsing and signing
+- `internal/provision/signer_test.go` - Unit tests
+
+## Implementation
+
+### CertSigner Struct
+
+```go
+type CertSigner struct {
+    caCert       *x509.Certificate
+    caKey        crypto.PrivateKey
+    validityDays int
+}
+
+func NewCertSigner(caCertFile, caKeyFile string, validityDays int) (*CertSigner, error)
+func (s *CertSigner) SignCSR(csrPEM []byte, agentID string) ([]byte, error)
+func (s *CertSigner) CACertPEM() []byte
+```
+
+### NewCertSigner
+
+Loads the CA certificate and private key from disk at startup:
+
+```go
+func NewCertSigner(caCertFile, caKeyFile string, validityDays int) (*CertSigner, error) {
+    // 1. Read and parse CA cert PEM
+    // 2. Read and parse CA private key PEM
+    // 3. Verify key matches cert (optional sanity check)
+    // 4. Return CertSigner
+}
+```
+
+Fails fast at server startup if CA files are missing or invalid.
+
+### SignCSR
+
+```go
+func (s *CertSigner) SignCSR(csrPEM []byte, agentID string) ([]byte, error) {
+    // 1. PEM-decode the CSR
+    // 2. Parse the CSR with x509.ParseCertificateRequest
+    // 3. Verify CSR signature (csr.CheckSignature())
+    //    - This proves the agent owns the private key
+    // 4. Generate random serial number
+    // 5. Build x509.Certificate template:
+    //    - SerialNumber: random
+    //    - Subject.CommonName: agentID (overrides CSR subject)
+    //    - NotBefore: time.Now()
+    //    - NotAfter: time.Now().Add(validityDays)
+    //    - KeyUsage: x509.KeyUsageDigitalSignature
+    //    - ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth}
+    // 6. Sign: x509.CreateCertificate(rand.Reader, template, s.caCert, csr.PublicKey, s.caKey)
+    // 7. PEM-encode and return
+}
+```
+
+Key details:
+- **CN override**: The agent cannot choose its own identity. The CN is always set from the provision key's agent ID.
+- **Client auth only**: The `ExtKeyUsage` is `ClientAuth` — these certs are only valid for mTLS client authentication, not for serving TLS.
+- **CSR signature check**: Verifies the agent actually holds the private key for the public key in the CSR.
+
+### CACertPEM
+
+Returns the PEM-encoded CA certificate. Used by the provision endpoint to include the CA cert in the response so the agent can verify the server.
+
+```go
+func (s *CertSigner) CACertPEM() []byte {
+    return pem.EncodeToMemory(&pem.Block{
+        Type:  "CERTIFICATE",
+        Bytes: s.caCert.Raw,
+    })
+}
+```
+
+## Test Cases
+
+1. Sign valid CSR returns valid certificate
+2. Signed cert has correct CN (matches agentID, not CSR subject)
+3. Signed cert has `ExtKeyUsageClientAuth`
+4. Signed cert is verifiable against CA
+5. Signed cert has correct validity period
+6. Reject invalid PEM input
+7. Reject malformed CSR
+8. Reject CSR with bad signature
+9. NewCertSigner fails with missing CA cert file
+10. NewCertSigner fails with missing CA key file
+
+### Test Helpers
+
+Tests will need to generate test CA certs and CSRs programmatically:
+
+```go
+func generateTestCA() (*x509.Certificate, crypto.PrivateKey, error)
+func generateTestCSR(cn string) ([]byte, crypto.PrivateKey, error)
+```
+
+## Next Steps
+
+**Phase 4**: Build the provision endpoint that ties together KeyStore validation and CSR signing.
diff --git a/docs/cert-provisioning/phase4.md b/docs/cert-provisioning/phase4.md
new file mode 100644
index 0000000..fc43cde
--- /dev/null
+++ b/docs/cert-provisioning/phase4.md
@@ -0,0 +1,108 @@
+# Phase 4: Provision Endpoint
+
+**Status**: Pending
+
+## Summary
+
+Add the `POST /api/v1/provision` endpoint that agents call to exchange a provision key + CSR for a signed certificate. This ties together the KeyStore (phase 1) and CertSigner (phase 3).
+
+## Files to Modify
+
+- `internal/api/http/handler/provision.go` - Add Provision handler method
+- `internal/api/http/handler/provision_test.go` - Add tests
+- `internal/api/http/router.go` - Register route
+
+### ProvisionHandler Update
+
+Add the `CertSigner` dependency:
+
+```go
+type ProvisionHandler struct {
+    keyStore   *provision.KeyStore
+    certSigner *provision.CertSigner
+}
+
+func NewProvisionHandler(keyStore *provision.KeyStore, certSigner *provision.CertSigner) *ProvisionHandler
+```
+
+## Implementation
+
+### Provision Handler
+
+```go
+func (h *ProvisionHandler) Provision(c *gin.Context)
+```
+
+Request:
+```json
+{
+  "provision_key": "sk_a1b2c3d4e5f6...",
+  "csr": "-----BEGIN CERTIFICATE REQUEST-----\nMIIE..."
+}
+```
+
+Flow:
+```
+1. Parse and validate request body
+   - provision_key: required, non-empty
+   - csr: required, non-empty
+
+2. Validate provision key
+   pk, err := h.keyStore.Validate(req.ProvisionKey)
+   - Returns 401 for invalid/expired/used key
+
+3. Sign the CSR
+   certPEM, err := h.certSigner.SignCSR([]byte(req.CSR), pk.AgentID)
+   - Returns 400 for invalid CSR
+
+4. Mark key as used
+   h.keyStore.MarkUsed(req.ProvisionKey)
+
+5. Return signed cert + CA cert
+```
+
+Response (200):
+```json
+{
+  "agent_id": "agent-5",
+  "agent_cert": "-----BEGIN CERTIFICATE-----\nMIIF...",
+  "ca_cert": "-----BEGIN CERTIFICATE-----\nMIID..."
+}
+```
+
+Error responses:
+- 400: `{"error": "provision_key is required"}` / `{"error": "csr is required"}` / `{"error": "invalid CSR: ..."}`
+- 401: `{"error": "invalid provision key"}` / `{"error": "provision key expired"}` / `{"error": "provision key already used"}`
+
+### Route Registration
+
+```go
+v1.POST("/provision", provisionHandler.Provision)
+```
+
+### Important: Key Consumption Ordering
+
+The key is marked as used **after** signing succeeds. If signing fails (bad CSR), the key remains valid so the agent can retry with a corrected CSR. This is intentional — the key is only consumed on successful provisioning.
+
+### Logging
+
+- INFO: `"agent provisioned" agent_id=agent-5`
+- WARN: `"provision attempt with invalid key" key_prefix=sk_a1b2...`
+- ERROR: `"CSR signing failed" agent_id=agent-5 error=...`
+
+## Test Cases
+
+1. Valid provision key + valid CSR returns 200 + certs
+2. Invalid provision key returns 401
+3. Expired provision key returns 401
+4. Already-used provision key returns 401
+5. Valid key + malformed CSR returns 400
+6. Missing provision_key field returns 400
+7. Missing csr field returns 400
+8. Key remains valid if CSR signing fails
+9. Key is consumed after successful provisioning
+10. Response includes correct agent_id, agent_cert, and ca_cert
+
+## Next Steps
+
+**Phase 5**: Implement the agent-side `provision` CLI subcommand.
diff --git a/docs/cert-provisioning/phase5.md b/docs/cert-provisioning/phase5.md
new file mode 100644
index 0000000..11cba4c
--- /dev/null
+++ b/docs/cert-provisioning/phase5.md
@@ -0,0 +1,134 @@
+# Phase 5: Agent CLI
+
+**Status**: Pending
+
+## Summary
+
+Add a `provision` subcommand to the agent binary. This command generates a local private key, creates a CSR, calls the server's provision API, and saves the returned certificates to disk.
+
+## Files to Add
+
+- `internal/provision/client.go` - HTTP client for the provision API
+- `internal/provision/client_test.go` - Unit tests
+
+## Files to Modify
+
+- `cmd/silo-proxy-agent/main.go` - Add `provision` subcommand handling
+
+## Implementation
+
+### Provision Client
+
+```go
+type ProvisionClient struct {
+    serverURL  string
+    httpClient *http.Client
+}
+
+func NewProvisionClient(serverURL string) *ProvisionClient
+func (c *ProvisionClient) Provision(provisionKey string, csrPEM []byte) (*ProvisionResponse, error)
+
+type ProvisionResponse struct {
+    AgentID   string `json:"agent_id"`
+    AgentCert string `json:"agent_cert"`
+    CACert    string `json:"ca_cert"`
+}
+```
+
+### Key and CSR Generation
+
+```go
+func GenerateKeyAndCSR() (keyPEM []byte, csrPEM []byte, err error) {
+    // 1. Generate RSA 4096-bit private key
+    //    key, err := rsa.GenerateKey(rand.Reader, 4096)
+    //
+    // 2. Create CSR template
+    //    template := &x509.CertificateRequest{
+    //        Subject: pkix.Name{CommonName: "silo-proxy-agent"},
+    //    }
+    //
+    // 3. Create CSR
+    //    csrDER, err := x509.CreateCertificateRequest(rand.Reader, template, key)
+    //
+    // 4. PEM-encode both key and CSR
+    //    Return keyPEM, csrPEM
+}
+```
+
+The CN in the CSR doesn't matter — the server overrides it with the agent ID from the provision key.
+
+### CLI Subcommand
+
+```bash
+silo-proxy-agent provision \
+  --server https://server:8080 \
+  --key sk_a1b2c3d4e5f6... \
+  --cert-dir ~/.silo-proxy/certs
+```
+
+Flags:
+- `--server` (required): Server base URL
+- `--key` (required): Provision key
+- `--cert-dir` (optional, default: `./certs`): Directory to save certificates
+
+### Provision Flow
+
+```go
+func runProvision(serverURL, provisionKey, certDir string) error {
+    // 1. Generate private key and CSR
+    keyPEM, csrPEM, err := GenerateKeyAndCSR()
+
+    // 2. Call provision API
+    client := NewProvisionClient(serverURL)
+    resp, err := client.Provision(provisionKey, csrPEM)
+
+    // 3. Create cert directory
+    os.MkdirAll(certDir, 0700)
+
+    // 4. Write files with restrictive permissions
+    os.WriteFile(certDir+"/agent-key.pem", keyPEM, 0600)
+    os.WriteFile(certDir+"/agent-cert.pem", []byte(resp.AgentCert), 0644)
+    os.WriteFile(certDir+"/ca-cert.pem", []byte(resp.CACert), 0644)
+
+    // 5. Print summary
+    fmt.Printf("Provisioned as: %s\n", resp.AgentID)
+    fmt.Printf("Certificates saved to: %s\n", certDir)
+    fmt.Printf("\nAdd to application.yml:\n")
+    fmt.Printf("  grpc:\n")
+    fmt.Printf("    tls:\n")
+    fmt.Printf("      enabled: true\n")
+    fmt.Printf("      cert_file: %s/agent-cert.pem\n", certDir)
+    fmt.Printf("      key_file: %s/agent-key.pem\n", certDir)
+    fmt.Printf("      ca_file: %s/ca-cert.pem\n", certDir)
+}
+```
+
+### File Permissions
+
+| File | Permissions | Reason |
+|------|------------|--------|
+| `agent-key.pem` | `0600` | Private key — owner read/write only |
+| `agent-cert.pem` | `0644` | Public certificate — world readable |
+| `ca-cert.pem` | `0644` | Public CA cert — world readable |
+| cert directory | `0700` | Owner only |
+
+### Error Handling
+
+- Server unreachable: `"failed to connect to server: ..."`
+- Invalid provision key: print the server's error message (401 response body)
+- File write failure: `"failed to save certificates: ..."`
+- Cert directory already has files: warn but overwrite (agent may be re-provisioning)
+
+## Test Cases
+
+1. GenerateKeyAndCSR produces valid PEM key and CSR
+2. CSR signature is valid (verifiable)
+3. ProvisionClient sends correct request format
+4. ProvisionClient handles 200 response correctly
+5. ProvisionClient handles 401 response with error message
+6. ProvisionClient handles network errors
+7. Files written with correct permissions
+
+## Next Steps
+
+**Phase 6**: Add configuration fields for CA key path and provision settings.
diff --git a/docs/cert-provisioning/phase6.md b/docs/cert-provisioning/phase6.md
new file mode 100644
index 0000000..dac48e3
--- /dev/null
+++ b/docs/cert-provisioning/phase6.md
@@ -0,0 +1,114 @@
+# Phase 6: Configuration
+
+**Status**: Pending
+
+## Summary
+
+Add configuration fields for the CA private key (needed for signing) and provisioning settings. Update config loading and validation.
+
+## Files to Modify
+
+- `cmd/silo-proxy-server/config.go` - Add provision config struct
+- `cmd/silo-proxy-server/application.yaml` - Add provision section
+- `cmd/silo-proxy-server/main.go` - Wire up KeyStore and CertSigner
+
+## Configuration
+
+### application.yaml additions
+
+```yaml
+grpc:
+  port: 9090
+  tls:
+    enabled: true
+    cert_file: "certs/server/server-cert.pem"
+    key_file: "certs/server/server-key.pem"
+    ca_file: "certs/ca/ca-cert.pem"
+    ca_key_file: "certs/ca/ca-key.pem"   # NEW
+    client_auth: "require"
+
+provision:                          # NEW section
+  enabled: false                    # disabled by default
+  key_ttl_hours: 24                 # default TTL for provision keys
+  cert_validity_days: 365           # validity period for issued certs
+  cleanup_interval_minutes: 60      # how often to clean expired keys
+```
+
+### Config Struct
+
+```go
+type ProvisionConfig struct {
+    Enabled                bool `mapstructure:"enabled"`
+    KeyTTLHours            int  `mapstructure:"key_ttl_hours"`
+    CertValidityDays       int  `mapstructure:"cert_validity_days"`
+    CleanupIntervalMinutes int  `mapstructure:"cleanup_interval_minutes"`
+}
+
+// Existing TLS config, add one field:
+type TLSConfig struct {
+    Enabled    bool   `mapstructure:"enabled"`
+    CertFile   string `mapstructure:"cert_file"`
+    KeyFile    string `mapstructure:"key_file"`
+    CAFile     string `mapstructure:"ca_file"`
+    CAKeyFile  string `mapstructure:"ca_key_file"`  // NEW
+    ClientAuth string `mapstructure:"client_auth"`
+}
+```
+
+### Environment Variable Overrides
+
+Following existing Viper conventions:
+- `PROVISION_ENABLED=true`
+- `PROVISION_KEY_TTL_HOURS=48`
+- `PROVISION_CERT_VALIDITY_DAYS=730`
+- `GRPC_TLS_CA_KEY_FILE=/path/to/ca-key.pem`
+
+### Validation
+
+At startup, if `provision.enabled` is true:
+- `grpc.tls.ca_file` must be set and file must exist
+- `grpc.tls.ca_key_file` must be set and file must exist
+- `provision.key_ttl_hours` must be > 0
+- `provision.cert_validity_days` must be > 0
+
+If validation fails, server exits with a clear error message.
+
+### Wiring in main.go
+
+```go
+// In server startup, after config load:
+
+if cfg.Provision.Enabled {
+    // Initialize KeyStore
+    ttl := time.Duration(cfg.Provision.KeyTTLHours) * time.Hour
+    keyStore := provision.NewKeyStore(ttl)
+
+    // Start cleanup goroutine
+    cleanupInterval := time.Duration(cfg.Provision.CleanupIntervalMinutes) * time.Minute
+    go keyStore.StartCleanup(ctx, cleanupInterval)
+
+    // Initialize CertSigner
+    certSigner, err := provision.NewCertSigner(
+        cfg.GRPC.TLS.CAFile,
+        cfg.GRPC.TLS.CAKeyFile,
+        cfg.Provision.CertValidityDays,
+    )
+
+    // Register provision handler and routes
+    provisionHandler := handler.NewProvisionHandler(keyStore, certSigner)
+    // ... register routes
+}
+```
+
+## Test Cases
+
+1. Config loads provision section correctly
+2. Default values applied when section is omitted
+3. Environment variables override config file
+4. Validation fails when provision enabled but CA key file missing
+5. Validation fails when provision enabled but CA cert file missing
+6. Provision routes not registered when provision disabled
+
+## Next Steps
+
+**Phase 7**: End-to-end testing of the complete provisioning flow.
diff --git a/docs/cert-provisioning/phase7.md b/docs/cert-provisioning/phase7.md
new file mode 100644
index 0000000..21612dd
--- /dev/null
+++ b/docs/cert-provisioning/phase7.md
@@ -0,0 +1,154 @@
+# Phase 7: Testing
+
+**Status**: Pending
+
+## Summary
+
+End-to-end testing of the full provisioning flow, plus integration tests that verify a provisioned agent can establish an mTLS gRPC connection.
+
+## Files to Add
+
+- `internal/provision/integration_test.go` - Full flow integration tests
+
+## Test Plan
+
+### Unit Test Summary (from earlier phases)
+
+| Phase | Package | Tests |
+|-------|---------|-------|
+| 1 | `provision.KeyStore` | 10 cases (CRUD, expiry, concurrency) |
+| 2 | `handler.ProvisionHandler` | 7 cases (admin API endpoints) |
+| 3 | `provision.CertSigner` | 10 cases (signing, validation, error paths) |
+| 4 | `handler.Provision` | 10 cases (provision endpoint) |
+| 5 | `provision.Client` | 7 cases (agent client, key generation) |
+
+### Integration Tests
+
+#### Test 1: Full Provisioning Flow
+
+```
+1. Start server with TLS + provisioning enabled (test CA certs)
+2. POST /api/v1/provision-keys {agent_id: "test-agent"}
+3. Verify 201 response with key
+4. Generate key + CSR on "agent side"
+5. POST /api/v1/provision {provision_key, csr}
+6. Verify 200 response with agent_cert + ca_cert
+7. Verify agent_cert:
+   - CN = "test-agent"
+   - Signed by test CA
+   - ExtKeyUsage = ClientAuth
+   - Valid time range
+8. Verify provision key is now consumed (second attempt returns 401)
+```
+
+#### Test 2: Provisioned Agent Connects via mTLS
+
+```
+1. Start gRPC server with mTLS (RequireAndVerifyClientCert)
+2. Provision agent cert via API
+3. Create gRPC client using provisioned certs
+4. Connect to gRPC server
+5. Verify bidirectional stream works
+6. Verify server sees correct agent ID from cert CN
+```
+
+#### Test 3: Key Lifecycle
+
+```
+1. Create provision key
+2. Verify it appears in list
+3. Revoke the key
+4. Verify it no longer appears in list
+5. Attempt to provision with revoked key → 401
+```
+
+#### Test 4: Key Expiry
+
+```
+1. Create provision key with 1-second TTL
+2. Wait 2 seconds
+3. Attempt to provision → 401 (expired)
+```
+
+#### Test 5: Concurrent Provisioning
+
+```
+1. Create 10 provision keys for 10 different agents
+2. Provision all 10 concurrently
+3. Verify all 10 get valid, unique certificates
+4. Verify all 10 keys are consumed
+```
+
+#### Test 6: Provisioning Disabled
+
+```
+1. Start server with provision.enabled = false
+2. POST /api/v1/provision-keys → 404 (route not registered)
+3. POST /api/v1/provision → 404 (route not registered)
+```
+
+### Manual Testing Checklist
+
+```bash
+# 1. Generate CA certs
+make generate-certs
+
+# 2. Start server with provisioning enabled
+# Edit application.yaml:
+#   provision:
+#     enabled: true
+#   grpc.tls:
+#     enabled: true
+#     ca_key_file: certs/ca/ca-key.pem
+make run
+
+# 3. Create a provision key
+curl -X POST http://localhost:8080/api/v1/provision-keys \
+  -H "Content-Type: application/json" \
+  -d '{"agent_id": "agent-test"}'
+# Save the returned provision_key
+
+# 4. Provision from agent device
+silo-proxy-agent provision \
+  --server http://localhost:8080 \
+  --key sk_<key_from_step_3> \
+  --cert-dir ./test-certs
+
+# 5. Verify cert files created
+ls -la ./test-certs/
+# agent-key.pem (0600)
+# agent-cert.pem (0644)
+# ca-cert.pem (0644)
+
+# 6. Inspect the issued certificate
+openssl x509 -in ./test-certs/agent-cert.pem -text -noout
+# Verify: Subject: CN = agent-test
+# Verify: Issuer: CN = Silo Proxy CA
+# Verify: X509v3 Extended Key Usage: TLS Web Client Authentication
+
+# 7. Start agent with provisioned certs
+# Update agent application.yaml with cert paths
+make run-agent
+
+# 8. Verify agent connects and is functional
+curl http://localhost:8100/health
+
+# 9. Verify provision key is consumed
+curl -X POST http://localhost:8080/api/v1/provision \
+  -H "Content-Type: application/json" \
+  -d '{"provision_key": "sk_<same_key>", "csr": "..."}'
+# Should return 401: provision key already used
+
+# 10. List keys and verify status
+curl http://localhost:8080/api/v1/provision-keys
+```
+
+## Success Criteria
+
+- All unit tests pass across phases 1-5
+- Integration tests verify end-to-end provisioning
+- Provisioned agents connect via mTLS successfully
+- One-time use enforcement works
+- Key expiry works
+- Concurrent provisioning is safe
+- Provisioning can be disabled via config
diff --git a/internal/api/http/dto/provision.go b/internal/api/http/dto/provision.go
new file mode 100644
index 0000000..65f4d9e
--- /dev/null
+++ b/internal/api/http/dto/provision.go
@@ -0,0 +1,35 @@
+package dto
+
+import "time"
+
+type CreateProvisionKeyRequest struct {
+	AgentID string `json:"agent_id" binding:"required"`
+}
+
+type CreateProvisionKeyResponse struct {
+	Key       string    `json:"key"`
+	AgentID   string    `json:"agent_id"`
+	ExpiresAt time.Time `json:"expires_at"`
+}
+
+type ListProvisionKeysResponse struct {
+	Keys  []ProvisionKeyInfo `json:"keys"`
+	Count int                `json:"count"`
+}
+
+type ProvisionKeyInfo struct {
+	AgentID   string    `json:"agent_id"`
+	CreatedAt time.Time `json:"created_at"`
+	ExpiresAt time.Time `json:"expires_at"`
+}
+
+type ProvisionRequest struct {
+	Key string `json:"key" binding:"required"`
+}
+
+type ProvisionResponse struct {
+	AgentID   string `json:"agent_id"`
+	CertPEM   string `json:"cert_pem"`
+	KeyPEM    string `json:"key_pem"`
+	CACertPEM string `json:"ca_cert_pem"`
+}
diff --git a/internal/api/http/handler/provision.go b/internal/api/http/handler/provision.go
new file mode 100644
index 0000000..2f7c1a0
--- /dev/null
+++ b/internal/api/http/handler/provision.go
@@ -0,0 +1,147 @@
+package handler
+
+import (
+	"log/slog"
+	"net/http"
+
+	"github.com/EternisAI/silo-proxy/internal/api/http/dto"
+	"github.com/EternisAI/silo-proxy/internal/cert"
+	"github.com/EternisAI/silo-proxy/internal/provision"
+	"github.com/gin-gonic/gin"
+)
+
+type ProvisionHandler struct {
+	keyStore    *provision.KeyStore
+	certService *cert.Service
+}
+
+func NewProvisionHandler(keyStore *provision.KeyStore, certService *cert.Service) *ProvisionHandler {
+	return &ProvisionHandler{
+		keyStore:    keyStore,
+		certService: certService,
+	}
+}
+
+func (h *ProvisionHandler) CreateProvisionKey(ctx *gin.Context) {
+	var req dto.CreateProvisionKeyRequest
+	if err := ctx.ShouldBindJSON(&req); err != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	if err := cert.ValidateAgentID(req.AgentID); err != nil {
+		slog.Warn("Invalid agent ID for provision key", "agent_id", req.AgentID, "error", err)
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	pk, err := h.keyStore.Create(req.AgentID)
+	if err != nil {
+		slog.Error("Failed to create provision key", "error", err)
+		ctx.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create provision key"})
+		return
+	}
+
+	ctx.JSON(http.StatusCreated, dto.CreateProvisionKeyResponse{
+		Key:       pk.Key,
+		AgentID:   pk.AgentID,
+		ExpiresAt: pk.ExpiresAt,
+	})
+}
+
+func (h *ProvisionHandler) ListProvisionKeys(ctx *gin.Context) {
+	keys := h.keyStore.List()
+
+	keyInfos := make([]dto.ProvisionKeyInfo, len(keys))
+	for i, k := range keys {
+		keyInfos[i] = dto.ProvisionKeyInfo{
+			AgentID:   k.AgentID,
+			CreatedAt: k.CreatedAt,
+			ExpiresAt: k.ExpiresAt,
+		}
+	}
+
+	ctx.JSON(http.StatusOK, dto.ListProvisionKeysResponse{
+		Keys:  keyInfos,
+		Count: len(keyInfos),
+	})
+}
+
+func (h *ProvisionHandler) RevokeProvisionKey(ctx *gin.Context) {
+	agentID := ctx.Param("id")
+
+	if removed := h.keyStore.Revoke(agentID); !removed {
+		ctx.JSON(http.StatusNotFound, gin.H{"error": "No provision keys found for this agent"})
+		return
+	}
+
+	slog.Info("Provision keys revoked", "agent_id", agentID)
+	ctx.JSON(http.StatusOK, gin.H{"message": "Provision keys revoked"})
+}
+
+func (h *ProvisionHandler) Provision(ctx *gin.Context) {
+	if h.certService == nil {
+		slog.Warn("Provision requested but TLS is disabled")
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "TLS is not enabled on this server"})
+		return
+	}
+
+	var req dto.ProvisionRequest
+	if err := ctx.ShouldBindJSON(&req); err != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	pk, err := h.keyStore.Validate(req.Key)
+	if err != nil {
+		slog.Warn("Provision key validation failed", "error", err)
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": err.Error()})
+		return
+	}
+
+	agentID := pk.AgentID
+
+	agentCert, agentKey, created, err := h.certService.GenerateAgentCertIfNotExists(agentID)
+	if err != nil {
+		slog.Error("Failed to generate agent certificate", "error", err, "agent_id", agentID)
+		ctx.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to generate agent certificate"})
+		return
+	}
+
+	if !created {
+		slog.Warn("Certificate already exists for agent", "agent_id", agentID)
+		ctx.JSON(http.StatusConflict, gin.H{"error": "Certificate already exists for this agent"})
+		return
+	}
+
+	certPEM, err := cert.CertToPEM(agentCert)
+	if err != nil {
+		slog.Error("Failed to encode certificate", "error", err, "agent_id", agentID)
+		ctx.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to encode certificate"})
+		return
+	}
+
+	keyPEM, err := cert.KeyToPEM(agentKey)
+	if err != nil {
+		slog.Error("Failed to encode key", "error", err, "agent_id", agentID)
+		ctx.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to encode key"})
+		return
+	}
+
+	caCertBytes, err := h.certService.GetCACert()
+	if err != nil {
+		slog.Error("Failed to read CA certificate", "error", err, "agent_id", agentID)
+		ctx.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to read CA certificate"})
+		return
+	}
+
+	h.keyStore.MarkUsed(req.Key)
+
+	slog.Info("Agent provisioned successfully", "agent_id", agentID)
+	ctx.JSON(http.StatusOK, dto.ProvisionResponse{
+		AgentID:   agentID,
+		CertPEM:   string(certPEM),
+		KeyPEM:    string(keyPEM),
+		CACertPEM: string(caCertBytes),
+	})
+}
diff --git a/internal/api/http/handler/provision_test.go b/internal/api/http/handler/provision_test.go
new file mode 100644
index 0000000..c023b77
--- /dev/null
+++ b/internal/api/http/handler/provision_test.go
@@ -0,0 +1,181 @@
+package handler
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/EternisAI/silo-proxy/internal/api/http/dto"
+	"github.com/EternisAI/silo-proxy/internal/provision"
+	"github.com/gin-gonic/gin"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func init() {
+	gin.SetMode(gin.TestMode)
+}
+
+func setupProvisionRouter(h *ProvisionHandler) *gin.Engine {
+	r := gin.New()
+	r.POST("/api/v1/provision-keys", h.CreateProvisionKey)
+	r.GET("/api/v1/provision-keys", h.ListProvisionKeys)
+	r.DELETE("/api/v1/provision-keys/:id", h.RevokeProvisionKey)
+	r.POST("/api/v1/provision", h.Provision)
+	return r
+}
+
+func TestCreateProvisionKey(t *testing.T) {
+	ks := provision.NewKeyStore(1 * time.Hour)
+	h := NewProvisionHandler(ks, nil)
+	r := setupProvisionRouter(h)
+
+	body, _ := json.Marshal(dto.CreateProvisionKeyRequest{AgentID: "agent-1"})
+	req, _ := http.NewRequest("POST", "/api/v1/provision-keys", bytes.NewBuffer(body))
+	req.Header.Set("Content-Type", "application/json")
+	w := httptest.NewRecorder()
+
+	r.ServeHTTP(w, req)
+
+	assert.Equal(t, http.StatusCreated, w.Code)
+
+	var resp dto.CreateProvisionKeyResponse
+	err := json.Unmarshal(w.Body.Bytes(), &resp)
+	require.NoError(t, err)
+	assert.Equal(t, "agent-1", resp.AgentID)
+	assert.NotEmpty(t, resp.Key)
+}
+
+func TestCreateProvisionKeyInvalidAgentID(t *testing.T) {
+	ks := provision.NewKeyStore(1 * time.Hour)
+	h := NewProvisionHandler(ks, nil)
+	r := setupProvisionRouter(h)
+
+	body, _ := json.Marshal(dto.CreateProvisionKeyRequest{AgentID: "../bad-id"})
+	req, _ := http.NewRequest("POST", "/api/v1/provision-keys", bytes.NewBuffer(body))
+	req.Header.Set("Content-Type", "application/json")
+	w := httptest.NewRecorder()
+
+	r.ServeHTTP(w, req)
+
+	assert.Equal(t, http.StatusBadRequest, w.Code)
+}
+
+func TestCreateProvisionKeyMissingBody(t *testing.T) {
+	ks := provision.NewKeyStore(1 * time.Hour)
+	h := NewProvisionHandler(ks, nil)
+	r := setupProvisionRouter(h)
+
+	req, _ := http.NewRequest("POST", "/api/v1/provision-keys", bytes.NewBuffer([]byte("{}")))
+	req.Header.Set("Content-Type", "application/json")
+	w := httptest.NewRecorder()
+
+	r.ServeHTTP(w, req)
+
+	assert.Equal(t, http.StatusBadRequest, w.Code)
+}
+
+func TestListProvisionKeys(t *testing.T) {
+	ks := provision.NewKeyStore(1 * time.Hour)
+	_, _ = ks.Create("agent-1")
+	_, _ = ks.Create("agent-2")
+
+	h := NewProvisionHandler(ks, nil)
+	r := setupProvisionRouter(h)
+
+	req, _ := http.NewRequest("GET", "/api/v1/provision-keys", nil)
+	w := httptest.NewRecorder()
+
+	r.ServeHTTP(w, req)
+
+	assert.Equal(t, http.StatusOK, w.Code)
+
+	var resp dto.ListProvisionKeysResponse
+	err := json.Unmarshal(w.Body.Bytes(), &resp)
+	require.NoError(t, err)
+	assert.Equal(t, 2, resp.Count)
+}
+
+func TestRevokeProvisionKey(t *testing.T) {
+	ks := provision.NewKeyStore(1 * time.Hour)
+	_, _ = ks.Create("agent-1")
+
+	h := NewProvisionHandler(ks, nil)
+	r := setupProvisionRouter(h)
+
+	req, _ := http.NewRequest("DELETE", "/api/v1/provision-keys/agent-1", nil)
+	w := httptest.NewRecorder()
+
+	r.ServeHTTP(w, req)
+
+	assert.Equal(t, http.StatusOK, w.Code)
+}
+
+func TestRevokeProvisionKeyNotFound(t *testing.T) {
+	ks := provision.NewKeyStore(1 * time.Hour)
+	h := NewProvisionHandler(ks, nil)
+	r := setupProvisionRouter(h)
+
+	req, _ := http.NewRequest("DELETE", "/api/v1/provision-keys/nonexistent", nil)
+	w := httptest.NewRecorder()
+
+	r.ServeHTTP(w, req)
+
+	assert.Equal(t, http.StatusNotFound, w.Code)
+}
+
+func TestProvisionTLSDisabled(t *testing.T) {
+	ks := provision.NewKeyStore(1 * time.Hour)
+	h := NewProvisionHandler(ks, nil) // certService is nil
+	r := setupProvisionRouter(h)
+
+	body, _ := json.Marshal(dto.ProvisionRequest{Key: "sk_something"})
+	req, _ := http.NewRequest("POST", "/api/v1/provision", bytes.NewBuffer(body))
+	req.Header.Set("Content-Type", "application/json")
+	w := httptest.NewRecorder()
+
+	r.ServeHTTP(w, req)
+
+	assert.Equal(t, http.StatusBadRequest, w.Code)
+}
+
+func TestProvisionInvalidKey(t *testing.T) {
+	ks := provision.NewKeyStore(1 * time.Hour)
+	// We need a certService for this test path but we'll test with a nil
+	// to verify the TLS check happens first, and test invalid key separately
+	// by passing a non-nil certService. For unit tests without a real cert.Service,
+	// we verify the key validation path via the key store directly.
+
+	// Create a handler with nil certService to hit TLS check
+	h := NewProvisionHandler(ks, nil)
+	r := setupProvisionRouter(h)
+
+	body, _ := json.Marshal(dto.ProvisionRequest{Key: "sk_invalid"})
+	req, _ := http.NewRequest("POST", "/api/v1/provision", bytes.NewBuffer(body))
+	req.Header.Set("Content-Type", "application/json")
+	w := httptest.NewRecorder()
+
+	r.ServeHTTP(w, req)
+
+	// Should fail with TLS not enabled (since certService is nil)
+	assert.Equal(t, http.StatusBadRequest, w.Code)
+}
+
+func TestProvisionMissingKey(t *testing.T) {
+	ks := provision.NewKeyStore(1 * time.Hour)
+	h := NewProvisionHandler(ks, nil)
+	r := setupProvisionRouter(h)
+
+	body, _ := json.Marshal(map[string]string{})
+	req, _ := http.NewRequest("POST", "/api/v1/provision", bytes.NewBuffer(body))
+	req.Header.Set("Content-Type", "application/json")
+	w := httptest.NewRecorder()
+
+	r.ServeHTTP(w, req)
+
+	// TLS check happens first
+	assert.Equal(t, http.StatusBadRequest, w.Code)
+}
diff --git a/internal/api/http/router.go b/internal/api/http/router.go
index 9814538..2143595 100644
--- a/internal/api/http/router.go
+++ b/internal/api/http/router.go
@@ -6,6 +6,7 @@ import (
 	"github.com/EternisAI/silo-proxy/internal/auth"
 	"github.com/EternisAI/silo-proxy/internal/cert"
 	grpcserver "github.com/EternisAI/silo-proxy/internal/grpc/server"
+	"github.com/EternisAI/silo-proxy/internal/provision"
 	"github.com/EternisAI/silo-proxy/internal/users"
 	"github.com/gin-gonic/gin"
 )
@@ -15,6 +16,7 @@ type Services struct {
 	CertService *cert.Service
 	AuthService *auth.Service
 	UserService *users.Service
+	KeyStore    *provision.KeyStore
 }
 
 func SetupRoute(engine *gin.Engine, srvs *Services, adminAPIKey string, jwtSecret string) {
@@ -54,4 +56,18 @@ func SetupRoute(engine *gin.Engine, srvs *Services, adminAPIKey string, jwtSecre
 			certRoutes.DELETE("/:id/certificate", certHandler.DeleteAgentCertificate)
 		}
 	}
+
+	if srvs.KeyStore != nil {
+		provisionHandler := handler.NewProvisionHandler(srvs.KeyStore, srvs.CertService)
+
+		provisionAdmin := engine.Group("/api/v1/provision-keys")
+		provisionAdmin.Use(middleware.APIKeyAuth(adminAPIKey))
+		{
+			provisionAdmin.POST("", provisionHandler.CreateProvisionKey)
+			provisionAdmin.GET("", provisionHandler.ListProvisionKeys)
+			provisionAdmin.DELETE("/:id", provisionHandler.RevokeProvisionKey)
+		}
+
+		engine.POST("/api/v1/provision", provisionHandler.Provision)
+	}
 }
diff --git a/internal/cert/generate.go b/internal/cert/generate.go
index 51ce1f8..de1032f 100644
--- a/internal/cert/generate.go
+++ b/internal/cert/generate.go
@@ -157,3 +157,19 @@ func (s *Service) GenerateAgentCert(agentID string) (*x509.Certificate, *rsa.Pri
 	slog.Info("Generated and saved agent certificate", "agent_id", agentID, "cert_path", certPath, "key_path", keyPath)
 	return agentCert, agentKey, nil
 }
+
+func (s *Service) GenerateAgentCertIfNotExists(agentID string) (*x509.Certificate, *rsa.PrivateKey, bool, error) {
+	s.agentCertMu.Lock()
+	defer s.agentCertMu.Unlock()
+
+	if s.AgentCertExists(agentID) {
+		return nil, nil, false, nil
+	}
+
+	agentCert, agentKey, err := s.GenerateAgentCert(agentID)
+	if err != nil {
+		return nil, nil, false, err
+	}
+
+	return agentCert, agentKey, true, nil
+}
diff --git a/internal/cert/service.go b/internal/cert/service.go
index 0cdbe21..f8a45d8 100644
--- a/internal/cert/service.go
+++ b/internal/cert/service.go
@@ -8,6 +8,7 @@ import (
 	"net"
 	"os"
 	"path/filepath"
+	"sync"
 )
 
 type Service struct {
@@ -18,6 +19,7 @@ type Service struct {
 	AgentCertDir   string
 	DomainNames    []string
 	IPAddresses    []net.IP
+	agentCertMu    sync.Mutex
 }
 
 func New(caCertPath, caKeyPath, serverCertPath, serverKeyPath, agentCertDir, domainNamesConfig, IPAddressesConfig string) (*Service, error) {
diff --git a/internal/provision/key_store.go b/internal/provision/key_store.go
new file mode 100644
index 0000000..0c99c76
--- /dev/null
+++ b/internal/provision/key_store.go
@@ -0,0 +1,152 @@
+package provision
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"log/slog"
+	"sync"
+	"time"
+)
+
+var (
+	ErrKeyNotFound   = errors.New("provision key not found")
+	ErrKeyExpired    = errors.New("provision key has expired")
+	ErrKeyAlreadyUsed = errors.New("provision key has already been used")
+)
+
+type ProvisionKey struct {
+	Key       string
+	AgentID   string
+	CreatedAt time.Time
+	ExpiresAt time.Time
+	Used      bool
+}
+
+type KeyStore struct {
+	mu   sync.RWMutex
+	keys map[string]*ProvisionKey
+	ttl  time.Duration
+}
+
+func NewKeyStore(ttl time.Duration) *KeyStore {
+	return &KeyStore{
+		keys: make(map[string]*ProvisionKey),
+		ttl:  ttl,
+	}
+}
+
+func (ks *KeyStore) Create(agentID string) (*ProvisionKey, error) {
+	b := make([]byte, 32)
+	if _, err := rand.Read(b); err != nil {
+		return nil, fmt.Errorf("failed to generate random key: %w", err)
+	}
+
+	key := "sk_" + hex.EncodeToString(b)
+	now := time.Now()
+
+	pk := &ProvisionKey{
+		Key:       key,
+		AgentID:   agentID,
+		CreatedAt: now,
+		ExpiresAt: now.Add(ks.ttl),
+		Used:      false,
+	}
+
+	ks.mu.Lock()
+	ks.keys[key] = pk
+	ks.mu.Unlock()
+
+	slog.Info("Provision key created", "agent_id", agentID, "expires_at", pk.ExpiresAt)
+	return pk, nil
+}
+
+func (ks *KeyStore) Validate(key string) (*ProvisionKey, error) {
+	ks.mu.RLock()
+	pk, exists := ks.keys[key]
+	ks.mu.RUnlock()
+
+	if !exists {
+		return nil, ErrKeyNotFound
+	}
+	if pk.Used {
+		return nil, ErrKeyAlreadyUsed
+	}
+	if time.Now().After(pk.ExpiresAt) {
+		return nil, ErrKeyExpired
+	}
+	return pk, nil
+}
+
+func (ks *KeyStore) MarkUsed(key string) {
+	ks.mu.Lock()
+	if pk, exists := ks.keys[key]; exists {
+		pk.Used = true
+	}
+	ks.mu.Unlock()
+}
+
+func (ks *KeyStore) Revoke(agentID string) bool {
+	ks.mu.Lock()
+	defer ks.mu.Unlock()
+
+	removed := false
+	for key, pk := range ks.keys {
+		if pk.AgentID == agentID {
+			delete(ks.keys, key)
+			removed = true
+		}
+	}
+	return removed
+}
+
+func (ks *KeyStore) List() []ProvisionKey {
+	ks.mu.RLock()
+	defer ks.mu.RUnlock()
+
+	var result []ProvisionKey
+	for _, pk := range ks.keys {
+		if pk.Used || time.Now().After(pk.ExpiresAt) {
+			continue
+		}
+		result = append(result, ProvisionKey{
+			AgentID:   pk.AgentID,
+			CreatedAt: pk.CreatedAt,
+			ExpiresAt: pk.ExpiresAt,
+		})
+	}
+	return result
+}
+
+func (ks *KeyStore) StartCleanup(ctx context.Context, interval time.Duration) {
+	ticker := time.NewTicker(interval)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+			ks.cleanup()
+		}
+	}
+}
+
+func (ks *KeyStore) cleanup() {
+	ks.mu.Lock()
+	defer ks.mu.Unlock()
+
+	now := time.Now()
+	removed := 0
+	for key, pk := range ks.keys {
+		if pk.Used || now.After(pk.ExpiresAt) {
+			delete(ks.keys, key)
+			removed++
+		}
+	}
+	if removed > 0 {
+		slog.Debug("Cleaned up provision keys", "removed", removed)
+	}
+}
diff --git a/internal/provision/key_store_test.go b/internal/provision/key_store_test.go
new file mode 100644
index 0000000..121033c
--- /dev/null
+++ b/internal/provision/key_store_test.go
@@ -0,0 +1,173 @@
+package provision
+
+import (
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestCreate(t *testing.T) {
+	ks := NewKeyStore(1 * time.Hour)
+
+	pk, err := ks.Create("agent-1")
+	require.NoError(t, err)
+	assert.Equal(t, "agent-1", pk.AgentID)
+	assert.True(t, strings.HasPrefix(pk.Key, "sk_"))
+	assert.Len(t, pk.Key, 3+64) // "sk_" + 32 bytes hex
+	assert.False(t, pk.Used)
+	assert.WithinDuration(t, time.Now().Add(1*time.Hour), pk.ExpiresAt, 5*time.Second)
+}
+
+func TestValidate(t *testing.T) {
+	ks := NewKeyStore(1 * time.Hour)
+
+	pk, err := ks.Create("agent-1")
+	require.NoError(t, err)
+
+	result, err := ks.Validate(pk.Key)
+	require.NoError(t, err)
+	assert.Equal(t, "agent-1", result.AgentID)
+}
+
+func TestValidateNotFound(t *testing.T) {
+	ks := NewKeyStore(1 * time.Hour)
+
+	_, err := ks.Validate("sk_nonexistent")
+	assert.ErrorIs(t, err, ErrKeyNotFound)
+}
+
+func TestValidateExpired(t *testing.T) {
+	ks := NewKeyStore(1 * time.Millisecond)
+
+	pk, err := ks.Create("agent-1")
+	require.NoError(t, err)
+
+	time.Sleep(5 * time.Millisecond)
+
+	_, err = ks.Validate(pk.Key)
+	assert.ErrorIs(t, err, ErrKeyExpired)
+}
+
+func TestValidateAlreadyUsed(t *testing.T) {
+	ks := NewKeyStore(1 * time.Hour)
+
+	pk, err := ks.Create("agent-1")
+	require.NoError(t, err)
+
+	ks.MarkUsed(pk.Key)
+
+	_, err = ks.Validate(pk.Key)
+	assert.ErrorIs(t, err, ErrKeyAlreadyUsed)
+}
+
+func TestRevoke(t *testing.T) {
+	ks := NewKeyStore(1 * time.Hour)
+
+	pk1, err := ks.Create("agent-1")
+	require.NoError(t, err)
+	_, err = ks.Create("agent-1")
+	require.NoError(t, err)
+	_, err = ks.Create("agent-2")
+	require.NoError(t, err)
+
+	removed := ks.Revoke("agent-1")
+	assert.True(t, removed)
+
+	_, err = ks.Validate(pk1.Key)
+	assert.ErrorIs(t, err, ErrKeyNotFound)
+
+	// agent-2 key should still exist
+	keys := ks.List()
+	assert.Len(t, keys, 1)
+	assert.Equal(t, "agent-2", keys[0].AgentID)
+}
+
+func TestRevokeNotFound(t *testing.T) {
+	ks := NewKeyStore(1 * time.Hour)
+
+	removed := ks.Revoke("nonexistent")
+	assert.False(t, removed)
+}
+
+func TestList(t *testing.T) {
+	ks := NewKeyStore(1 * time.Hour)
+
+	_, err := ks.Create("agent-1")
+	require.NoError(t, err)
+	_, err = ks.Create("agent-2")
+	require.NoError(t, err)
+
+	keys := ks.List()
+	assert.Len(t, keys, 2)
+
+	// Keys should be redacted (empty)
+	for _, k := range keys {
+		assert.Empty(t, k.Key)
+	}
+}
+
+func TestListExcludesUsedAndExpired(t *testing.T) {
+	ks := NewKeyStore(1 * time.Millisecond)
+
+	pk1, err := ks.Create("agent-expired")
+	require.NoError(t, err)
+	_ = pk1
+
+	time.Sleep(5 * time.Millisecond)
+
+	// Create a fresh key with longer TTL
+	ks.ttl = 1 * time.Hour
+	pk2, err := ks.Create("agent-used")
+	require.NoError(t, err)
+	ks.MarkUsed(pk2.Key)
+
+	_, err = ks.Create("agent-active")
+	require.NoError(t, err)
+
+	keys := ks.List()
+	assert.Len(t, keys, 1)
+	assert.Equal(t, "agent-active", keys[0].AgentID)
+}
+
+func TestCleanup(t *testing.T) {
+	ks := NewKeyStore(1 * time.Millisecond)
+
+	_, err := ks.Create("agent-1")
+	require.NoError(t, err)
+
+	time.Sleep(5 * time.Millisecond)
+
+	ks.cleanup()
+
+	ks.mu.RLock()
+	count := len(ks.keys)
+	ks.mu.RUnlock()
+	assert.Equal(t, 0, count)
+}
+
+func TestConcurrentAccess(t *testing.T) {
+	ks := NewKeyStore(1 * time.Hour)
+
+	var wg sync.WaitGroup
+	for i := 0; i < 50; i++ {
+		wg.Add(1)
+		go func(id int) {
+			defer wg.Done()
+			agentID := "agent-concurrent"
+			pk, err := ks.Create(agentID)
+			if err != nil {
+				return
+			}
+			_, _ = ks.Validate(pk.Key)
+			_ = ks.List()
+			if id%5 == 0 {
+				ks.MarkUsed(pk.Key)
+			}
+		}(i)
+	}
+	wg.Wait()
+}
diff --git a/misc/provision-key-create.sh b/misc/provision-key-create.sh
new file mode 100755
index 0000000..416e483
--- /dev/null
+++ b/misc/provision-key-create.sh
@@ -0,0 +1,20 @@
+#!/bin/bash
+AGENT_ID=${1:-agent-1}
+API_KEY=${ADMIN_API_KEY:-some-secret-key}
+BASE_URL=${BASE_URL:-http://localhost:8080}
+
+response=$(curl -s -w '\n%{http_code}' -X POST "${BASE_URL}/api/v1/provision-keys" \
+  -H "X-API-Key: ${API_KEY}" \
+  -H "Content-Type: application/json" \
+  -d "{\"agent_id\": \"${AGENT_ID}\"}")
+
+http_code=$(echo "$response" | tail -n1)
+body=$(echo "$response" | sed '$d')
+
+if [[ "$http_code" -ge 200 && "$http_code" -lt 300 ]]; then
+  echo "$body" | jq .
+else
+  echo "Error: HTTP ${http_code}" >&2
+  echo "$body" >&2
+  exit 1
+fi
diff --git a/misc/provision-key-list.sh b/misc/provision-key-list.sh
new file mode 100755
index 0000000..225377b
--- /dev/null
+++ b/misc/provision-key-list.sh
@@ -0,0 +1,17 @@
+#!/bin/bash
+API_KEY=${ADMIN_API_KEY:-some-secret-key}
+BASE_URL=${BASE_URL:-http://localhost:8080}
+
+response=$(curl -s -w '\n%{http_code}' -X GET "${BASE_URL}/api/v1/provision-keys" \
+  -H "X-API-Key: ${API_KEY}")
+
+http_code=$(echo "$response" | tail -n1)
+body=$(echo "$response" | sed '$d')
+
+if [[ "$http_code" -ge 200 && "$http_code" -lt 300 ]]; then
+  echo "$body" | jq .
+else
+  echo "Error: HTTP ${http_code}" >&2
+  echo "$body" >&2
+  exit 1
+fi
diff --git a/misc/provision-key-revoke.sh b/misc/provision-key-revoke.sh
new file mode 100755
index 0000000..303212b
--- /dev/null
+++ b/misc/provision-key-revoke.sh
@@ -0,0 +1,18 @@
+#!/bin/bash
+AGENT_ID=${1:-agent-1}
+API_KEY=${ADMIN_API_KEY:-some-secret-key}
+BASE_URL=${BASE_URL:-http://localhost:8080}
+
+response=$(curl -s -w '\n%{http_code}' -X DELETE "${BASE_URL}/api/v1/provision-keys/${AGENT_ID}" \
+  -H "X-API-Key: ${API_KEY}")
+
+http_code=$(echo "$response" | tail -n1)
+body=$(echo "$response" | sed '$d')
+
+if [[ "$http_code" -ge 200 && "$http_code" -lt 300 ]]; then
+  echo "$body" | jq .
+else
+  echo "Error: HTTP ${http_code}" >&2
+  echo "$body" >&2
+  exit 1
+fi