Key Custody

Restore a lost device share from the recovery kit

For an owner who lost every passkey holding the device share. The browser opens the kit with the recovery code locally, re-wraps share 2 under a new passkey (master wrap), and uploads only that wrap. Needs X-Auth-Confirm (a re-auth token with purpose tss.key.restore, or the password). Audited tss_key.recovered_via_code; the owner is emailed. No waiting period: the kit plus the code can already spend without 1Claw.

post/v1/keys/{key_id}/client-share/restore

Request

  • Base URL: https://api.1claw.co
  • URL: https://api.1claw.co/v1/keys/{key_id}/client-share/restore
  • Auth: HTTP bearer

Path parameters

key_idstring uuid required

Headers

X-Auth-Confirmstring required

Request body

credential_idstring uuid required
wrapped_sharestring required

Base64, opaque.

saltstring required

Base64 account PRF salt.

group_public_keystring required

Hex, from the kit entry.

kit_proofstring required

Base64 Schnorr proof of possession of the kit's share 3 for the key's current share generation (@1claw/tss-wasm kit_share_proof). An older generation's kit would restore a dead share, so it is refused with 400, as is a missing proof. For a client_multisig wallet or 2-of-3 Safe: the recovery key's hex signature over the kit digest (multisig_kit_proof), with the device public key as group_public_key.

Response

The new wrap

idstring uuid
key_idstring uuid
key_kind'agent_signing_key' | 'treasury_wallet'
wrap_kind'passkey_prf' | 'recovery_code' | 'sidecar'
credential_idstring uuid nullable
holder_idstring uuid nullable
wrapped_sharestring

Base64, exactly as stored.

saltstring

Base64.

wrap_version1 | 2
generationinteger
created_atstring date-time
updated_atstring date-time

Changes

No recorded changes to this operation across all 1 revision of this API.