---
title: "Add a wrap for another credential or the recovery code"
method: POST
path: "/v1/keys/{key_id}/client-share/rewrap"
tags: ["Key Custody"]
---

# Add a wrap for another credential or the recovery code

`POST /v1/keys/{key_id}/client-share/rewrap`

## Request

- Base URL: `https://api.1claw.co`
- URL: `https://api.1claw.co/v1/keys/{key_id}/client-share/rewrap`
- Auth: HTTP bearer

Same write as `PUT …/client-share`, for a key that already has at
least one wrap: the browser, holding the share in memory during a
passkey session, re-wraps it under a newly added passkey's PRF
output. Owner only. 409 if no wrap exists yet, or if a wrap for
this credential and generation already exists (delete it first,
with re-authentication, to replace it).

Needs `X-Auth-Confirm`: a single-use re-auth token from
`POST /v1/auth/reauth/complete` with purpose `tss.key.wrap_add`, or the
account password. Strong factor: once a passkey (usable on this domain)
or TOTP is enrolled, the confirmation must use one of them and a
password is refused. Without it the call answers 403.

## Headers

- `X-Auth-Confirm` string, required

## Request body

- PutClientShareRequest
  - `wrap_kind` 'passkey_prf', required: Sidecar wraps are stored through `PUT /v1/keys/{key_id}/client-share/holder`. `recovery_code` is refused: the recovery code seals the offline kit in the browser, and 1Claw holds nothing it can open.
  - `credential_id` string, uuid, nullable: Required for `passkey_prf`; the passkey id from `GET /v1/auth/passkeys`.
  - `wrapped_share` string, required: Base64 ciphertext (≤ 4 KiB). Opaque to the vault.
  - `salt` string, required: Base64 PRF salt, 16–64 bytes. For `wrap_version` 2, the account's salt from `GET /v1/keys/tss/prf-salt`; for 1, random per key.
  - `generation` integer: Share generation this wrap holds. Defaults to the key's current one; during a refresh, the pending one (the new device share).
  - `wrap_version` 1 | 2: 1 = per-key salt (keys created before the master wrap). 2 = the per-account master wrap: account PRF salt, wrap key HKDF'd per (key_id, share index). Every passkey wrap of one key must use the same salt and version (409 otherwise), so any of the user's passkeys opens it with one touch.

## Response `201`

Wrap added

- ClientShareResponse
  - `id` string, uuid
  - `key_id` string, uuid
  - `key_kind` 'agent_signing_key' | 'treasury_wallet'
  - `wrap_kind` 'passkey_prf' | 'recovery_code' | 'sidecar'
  - `credential_id` string, uuid, nullable
  - `holder_id` string, uuid, nullable
  - `wrapped_share` string: Base64, exactly as stored.
  - `salt` string: Base64.
  - `wrap_version` 1 | 2
  - `generation` integer
  - `created_at` string, date-time
  - `updated_at` string, date-time

## Other responses

- `400`: Invalid request
- `401`: Authentication required or invalid
- `403`: Insufficient permissions
- `404`: Resource not found
- `409`: Resource already exists or conflict

## Changes

- **2026-10-20** `5fa0918f3b41`: 1 breaking
  - added the new required `header` request parameter `X-Auth-Confirm`

[Operation history](https://skmtc.dev/1claw/apis/1claw-api/changes/v1/keys/:key_id/client-share/rewrap/post.md)

---

[API](https://skmtc.dev/1claw/apis/1claw-api.md) · [All operations](https://skmtc.dev/1claw/apis/1claw-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1claw/apis/1claw-api/revisions/5fa0918f3b41?raw)