Key Custody

Add a wrap for another credential or the recovery code

Changed on

Same write as PUT …/client-share, for a key that already has at least one wrap: the browser, holding the share in memory during a passkey session, re-wraps it under a newly added passkey's PRF output. Owner only. 409 if no wrap exists yet, or if a wrap for this credential and generation already exists (delete it first, with re-authentication, to replace it).

Needs X-Auth-Confirm: a single-use re-auth token from POST /v1/auth/reauth/complete with purpose tss.key.wrap_add, or the account password. Strong factor: once a passkey (usable on this domain) or TOTP is enrolled, the confirmation must use one of them and a password is refused. Without it the call answers 403.

post/v1/keys/{key_id}/client-share/rewrap

Request

  • Base URL: https://api.1claw.co
  • URL: https://api.1claw.co/v1/keys/{key_id}/client-share/rewrap
  • Auth: HTTP bearer

Headers

X-Auth-Confirmstring required

Request body

wrap_kind'passkey_prf' required

Sidecar wraps are stored through PUT /v1/keys/{key_id}/client-share/holder. recovery_code is refused: the recovery code seals the offline kit in the browser, and 1Claw holds nothing it can open.

credential_idstring uuid nullable

Required for passkey_prf; the passkey id from GET /v1/auth/passkeys.

wrapped_sharestring required

Base64 ciphertext (≤ 4 KiB). Opaque to the vault.

saltstring required

Base64 PRF salt, 16–64 bytes. For wrap_version 2, the account's salt from GET /v1/keys/tss/prf-salt; for 1, random per key.

generationinteger

Share generation this wrap holds. Defaults to the key's current one; during a refresh, the pending one (the new device share).

wrap_version1 | 2

1 = per-key salt (keys created before the master wrap). 2 = the per-account master wrap: account PRF salt, wrap key HKDF'd per (key_id, share index). Every passkey wrap of one key must use the same salt and version (409 otherwise), so any of the user's passkeys opens it with one touch.

Response

Wrap added

idstring uuid
key_idstring uuid
key_kind'agent_signing_key' | 'treasury_wallet'
wrap_kind'passkey_prf' | 'recovery_code' | 'sidecar'
credential_idstring uuid nullable
holder_idstring uuid nullable
wrapped_sharestring

Base64, exactly as stored.

saltstring

Base64.

wrap_version1 | 2
generationinteger
created_atstring date-time
updated_atstring date-time

Changes