---
title: "Create a 2-of-3 Safe on EVM (client_multisig)"
method: POST
path: "/v1/treasury/multisig-safes"
tags: ["Key Custody"]
---

# Create a 2-of-3 Safe on EVM (client_multisig)

`POST /v1/treasury/multisig-safes`

## Request

- Base URL: `https://api.1claw.co`
- URL: `https://api.1claw.co/v1/treasury/multisig-safes`
- Auth: HTTP bearer

Beta (same rollout flags as self-custody creation; see
`GET /v1/keys/tss/chains` `multisig_safe_chains`). A Safe v1.4.1 with
owners V (the vault's key, generated here and escrowed), D (the device
key, wrapped under the customer's passkey) and R (the recovery kit's
key), in that order, threshold 2: `Safe.setup` with no module or signer
configuration and the pinned fallback handler. The page generates D and
R and proves possession of each: a 65-byte recoverable ECDSA signature
(r ‖ s ‖ v, low-S) over sha256("1claw-multisig-pop-v1" ‖ user_id (16
bytes) ‖ chain ‖ 0x00 ‖ role ‖ 0x00 ‖ public key bytes), role `device` or
`recovery`, chain the EVM chain. The vault records the counterfactual
(CREATE2) address, salt keccak256("1claw-multisig-safe-v1" ‖ user_id ‖
safe_id)[0..8] (big-endian, top bit clear); the Safe is deployed with the
first send. The page re-derives the address from the three owners and
the ids and refuses a mismatch, then wraps D (`PUT
/v1/keys/{safe_id}/client-share`), seals the recovery kit and confirms it
(`POST /v1/keys/{safe_id}/kit`). One Safe per chain per user. Needs a
passkey with PRF. Owner only. Audited `multisig_safe.created`.

## Request body

- CreateMultisigSafeRequest
  - `chain` 'base' | 'optimism' | 'arbitrum' | 'polygon' | 'ethereum' | 'base-sepolia' | 'sepolia', required
  - `device_public_key` string, required: Hex SEC1 public key of D (wrapped under the passkey).
  - `recovery_public_key` string, required: Hex SEC1 public key of R (kit only).
  - `device_proof` string, required: Hex 65-byte signature by D over its proof-of-possession digest (chain = this EVM chain).
  - `recovery_proof` string, required: Hex 65-byte signature by R over its proof-of-possession digest.

## Response `201`

The Safe (counterfactual until the first send)

- MultisigSafeResponse
  - `id` string, uuid, required
  - `chain` string, required
  - `chain_id` integer, required
  - `safe_address` string, required: Lowercase 0x counterfactual (CREATE2) address.
  - `custody` 'client_multisig', required
  - `deploy_status` string, required: `pending` until the first send deploys the Safe and contract code is seen at the address, then `deployed`.
  - `owners` MultisigKeys, required
    - `threshold` integer, required: Always 2.
    - `vault` MultisigKeyInfo, required
      - `address` string, required: Base58check Tron address, or a lowercase 0x EVM address for a Safe's owners.
      - `public_key` string, required: Hex SEC1 public key (33 or 65 bytes).
    - `device` MultisigKeyInfo, required
      - `address` string, required: Base58check Tron address, or a lowercase 0x EVM address for a Safe's owners.
      - `public_key` string, required: Hex SEC1 public key (33 or 65 bytes).
    - `recovery` MultisigKeyInfo, required
      - `address` string, required: Base58check Tron address, or a lowercase 0x EVM address for a Safe's owners.
      - `public_key` string, required: Hex SEC1 public key (33 or 65 bytes).
  - `threshold` integer, required: Always 2.
  - `backup` object, required: Whether a passkey holds D and a recovery kit is confirmed.
    - `threshold` '2of2' | '2of3'
    - `passkey_wraps` integer
    - `recovery_code_wraps` integer
    - `generation` integer
    - `kit_generation` integer, nullable
    - `kit_covered` boolean
    - `backed_up` boolean
    - `missing` string[]

## Other responses

- `400`: Invalid request
- `401`: Authentication required or invalid
- `403`: Insufficient permissions
- `409`: Resource already exists or conflict

## Changes

- **2026-10-20** `5fa0918f3b41`: 1 warning
  - removed the request property `kit_sealed`

[Operation history](https://skmtc.dev/1claw/apis/1claw-api/changes/v1/treasury/multisig-safes/post.md)

---

[API](https://skmtc.dev/1claw/apis/1claw-api.md) · [All operations](https://skmtc.dev/1claw/apis/1claw-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1claw/apis/1claw-api/revisions/5fa0918f3b41?raw)