Key Custody

Store the customer's wrapped share of a threshold key

Stores ciphertext the vault cannot open: the customer's share of a 2-party threshold signing key, wrapped in the browser under the passkey's WebAuthn PRF output (passkey_prf, one wrap per credential and share generation). recovery_code wraps are refused: the recovery code seals the offline kit in the browser. The vault keeps the blob and its salt and returns them only to the owning user. Human users only; the passkey must have reported PRF support at registration.

A stored wrap is never overwritten: if a wrap for this credential and generation already exists the call answers 409. To replace it, delete the old wrap first (DELETE /v1/keys/{key_id}/client-share/{share_id}, which needs re-authentication).

put/v1/keys/{key_id}/client-share

Request

  • Base URL: https://api.1claw.co
  • URL: https://api.1claw.co/v1/keys/{key_id}/client-share
  • Auth: HTTP bearer

Request body

wrap_kind'passkey_prf' required

Sidecar wraps are stored through PUT /v1/keys/{key_id}/client-share/holder. recovery_code is refused: the recovery code seals the offline kit in the browser, and 1Claw holds nothing it can open.

credential_idstring uuid nullable

Required for passkey_prf; the passkey id from GET /v1/auth/passkeys.

wrapped_sharestring required

Base64 ciphertext (≤ 4 KiB). Opaque to the vault.

saltstring required

Base64 PRF salt, 16–64 bytes. For wrap_version 2, the account's salt from GET /v1/keys/tss/prf-salt; for 1, random per key.

generationinteger

Share generation this wrap holds. Defaults to the key's current one; during a refresh, the pending one (the new device share).

wrap_version1 | 2

1 = per-key salt (keys created before the master wrap). 2 = the per-account master wrap: account PRF salt, wrap key HKDF'd per (key_id, share index). Every passkey wrap of one key must use the same salt and version (409 otherwise), so any of the user's passkeys opens it with one touch.

Response

Share stored

idstring uuid
key_idstring uuid
key_kind'agent_signing_key' | 'treasury_wallet'
wrap_kind'passkey_prf' | 'recovery_code' | 'sidecar'
credential_idstring uuid nullable
holder_idstring uuid nullable
wrapped_sharestring

Base64, exactly as stored.

saltstring

Base64.

wrap_version1 | 2
generationinteger
created_atstring date-time
updated_atstring date-time

Changes

No recorded changes to this operation across all 1 revision of this API.