---
title: "The account's master-wrap PRF salt"
method: GET
path: "/v1/keys/tss/prf-salt"
tags: ["Key Custody"]
---

# The account's master-wrap PRF salt

`GET /v1/keys/tss/prf-salt`

## Request

- Base URL: `https://api.1claw.co`
- URL: `https://api.1claw.co/v1/keys/tss/prf-salt`
- Auth: HTTP bearer

The per-account WebAuthn PRF salt for the `client_tss` master wrap,
created on first use and stable after. Evaluate the passkey PRF over it,
then HKDF a wrap key per (key_id, share index). A public input: it
derives nothing without the passkey. Human users only.

## Response `200`

The salt

- object
  - `salt` string: Base64, 32 bytes.
  - `wrap_version` integer

## Other responses

- `401`: Authentication required or invalid
- `403`: Insufficient permissions

---

[API](https://skmtc.dev/1claw/apis/1claw-api.md) · [All operations](https://skmtc.dev/1claw/apis/1claw-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1claw/apis/1claw-api/revisions/5fa0918f3b41?raw)