---
title: "Provision a threshold-key share to a runtime holder"
method: PUT
path: "/v1/keys/{key_id}/client-share/holder"
tags: ["Key Custody"]
---

# Provision a threshold-key share to a runtime holder

`PUT /v1/keys/{key_id}/client-share/holder`

## Request

- Base URL: `https://api.1claw.co`
- URL: `https://api.1claw.co/v1/keys/{key_id}/client-share/holder`
- Auth: HTTP bearer

The owner's browser unlocks its share with the passkey PRF and re-wraps
it to the holder's P-256 key (ECIES: ephemeral point ‖ iv ‖ AES-GCM). The
vault stores the ciphertext unopened. The wallet must be delegated to the
holder's agent. Audited as `client_share.provisioned_to_runtime`.

## Request body

- object
  - `holder_id` string, uuid, required
  - `wrapped_share` string, required
  - `salt` string, required

## Response `201`

Stored

## Other responses

- `400`: Invalid request
- `401`: Authentication required or invalid
- `403`: Insufficient permissions
- `404`: Resource not found

---

[API](https://skmtc.dev/1claw/apis/1claw-api.md) · [All operations](https://skmtc.dev/1claw/apis/1claw-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1claw/apis/1claw-api/revisions/ae109b496830?raw)