---
title: "Create a Tron 2-of-3 native multisig wallet (client_multisig)"
method: POST
path: "/v1/treasury/multisig/wallets"
tags: ["Key Custody"]
---

# Create a Tron 2-of-3 native multisig wallet (client_multisig)

`POST /v1/treasury/multisig/wallets`

## Request

- Base URL: `https://api.1claw.co`
- URL: `https://api.1claw.co/v1/treasury/multisig/wallets`
- Auth: HTTP bearer

Beta (same rollout flags as self-custody creation; see
`GET /v1/keys/tss/chains` `multisig_chains`). The page generates the
device key D and the recovery key R, proves possession of each, and
seals both into the offline recovery kit before calling this; the vault
adds its own key V (escrowed) and records the wallet as
`pending_activation`. The address is D's, so until activation the
customer alone controls it. Each proof is a 65-byte recoverable ECDSA
signature (r ‖ s ‖ v, low-S) over
sha256("1claw-multisig-pop-v1" ‖ user_id (16 bytes) ‖ chain ‖ 0x00 ‖ role
‖ 0x00 ‖ public key bytes), role `device` or `recovery`. Needs a passkey
with PRF (D is then wrapped under it, `PUT /v1/keys/{key_id}/client-share`).
Owner only. Audited `treasury_wallet.multisig_created`.

## Request body

- CreateMultisigWalletRequest
  - `chain` 'tron' | 'tron-nile' | 'tron-shasta', required
  - `device_public_key` string, required: Hex SEC1 public key of D (the account key).
  - `recovery_public_key` string, required: Hex SEC1 public key of R (kit only).
  - `device_proof` string, required: Hex 65-byte signature by D over its proof-of-possession digest.
  - `recovery_proof` string, required: Hex 65-byte signature by R over its proof-of-possession digest.
  - `kit_sealed` boolean: The page sealed a recovery kit holding D and R before calling. With R's proof, records kit coverage for generation 1.

## Response `201`

The wallet, pending activation

- MultisigWalletResponse
  - `key_id` string, uuid, required
  - `chain` string, required
  - `address` string, required: The account address (D's).
  - `custody` 'client_multisig', required
  - `status` 'pending_activation' | 'active', required
  - `keys` MultisigKeys, required
    - `threshold` integer, required: Always 2.
    - `vault` MultisigKeyInfo, required
      - `address` string, required: Base58check Tron address, or a lowercase 0x EVM address for a Safe's owners.
      - `public_key` string, required: Hex SEC1 public key (33 or 65 bytes).
    - `device` MultisigKeyInfo, required
      - `address` string, required: Base58check Tron address, or a lowercase 0x EVM address for a Safe's owners.
      - `public_key` string, required: Hex SEC1 public key (33 or 65 bytes).
    - `recovery` MultisigKeyInfo, required
      - `address` string, required: Base58check Tron address, or a lowercase 0x EVM address for a Safe's owners.
      - `public_key` string, required: Hex SEC1 public key (33 or 65 bytes).
  - `activation_min_sun` integer, required: What the account must hold before activation (101 TRX), in sun.

## Other responses

- `400`: Invalid request
- `401`: Authentication required or invalid
- `403`: Insufficient permissions
- `409`: Resource already exists or conflict

---

[API](https://skmtc.dev/1claw/apis/1claw-api.md) · [All operations](https://skmtc.dev/1claw/apis/1claw-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1claw/apis/1claw-api/revisions/ae109b496830?raw)