---
title: "Generate multi-chain wallets for the authenticated user"
method: POST
path: "/v1/treasury/wallets/generate"
tags: ["Treasury Wallets"]
---

# Generate multi-chain wallets for the authenticated user

`POST /v1/treasury/wallets/generate`

## Request

- Base URL: `https://api.1claw.co`
- URL: `https://api.1claw.co/v1/treasury/wallets/generate`
- Auth: HTTP bearer

Generates keypairs for the requested chains (or all supported chains if omitted).
Private keys are stored in a per-org `__treasury-keys` vault with tier-appropriate
MPC custody. Skips chains where the user already has an active wallet. Available
on all tiers (counts toward wallet quota). Human users only — agents get 403.

## Request body

- GenerateTreasuryWalletsRequest
  - `chains` string[]: Chains to generate wallets for (e.g. ["ethereum", "solana"]). Omit for all supported chains.

## Response `201`

Wallets generated

- TreasuryWalletListResponse
  - `wallets` TreasuryWalletResponse[]
    - `id` string, uuid
    - `chain` string
    - `curve` string: Cryptographic curve (e.g. secp256k1, ed25519)
    - `public_key_hex` string
    - `address` string
    - `is_active` boolean
    - `created_at` string, date-time
    - `custody` 'server' | 'client_tss' | 'client_multisig': `server` — 1claw holds the whole private key and can sign alone. `client_tss` — threshold key (2-of-3: 1Claw, the customer's passkey, the customer's offline recovery kit); 1Claw cannot sign alone. `client_multisig`: native 2-of-3 multisig (Tron), three ordinary keys (1Claw's, the passkey-held device key, the kit's recovery key) and the chain's own account permissions; the address is the device key's.
    - `owner_wraps` integer: `client_tss` only (list responses). Passkey wraps of the customer's share; runtime holder wraps are not counted. Superseded by `backup`.
    - `backup` object: `client_tss` only (list responses). Whether the key is backed up and what it still needs. A 2-of-3 key needs a passkey wrap and a recovery kit confirmed for its current share generation. Agents and runtimes refuse a key that is not backed up; the owner can always move funds out.
      - `threshold` '2of2' | '2of3'
      - `passkey_wraps` integer
      - `recovery_code_wraps` integer
      - `generation` integer
      - `kit_generation` integer, nullable
      - `kit_covered` boolean
      - `backed_up` boolean
      - `missing` string[]
    - `multisig_status` 'pending_activation' | 'active': `client_multisig` only. `pending_activation` until the 2-of-3 account permissions are confirmed on chain.
    - `multisig_keys` MultisigKeys
      - `threshold` integer, required: Always 2.
      - `vault` MultisigKeyInfo, required
        - `address` string, required: Base58check Tron address, or a lowercase 0x EVM address for a Safe's owners.
        - `public_key` string, required: Hex SEC1 public key (33 or 65 bytes).
      - `device` MultisigKeyInfo, required
        - `address` string, required: Base58check Tron address, or a lowercase 0x EVM address for a Safe's owners.
        - `public_key` string, required: Hex SEC1 public key (33 or 65 bytes).
      - `recovery` MultisigKeyInfo, required
        - `address` string, required: Base58check Tron address, or a lowercase 0x EVM address for a Safe's owners.
        - `public_key` string, required: Hex SEC1 public key (33 or 65 bytes).

## Other responses

- `400`: Invalid request
- `401`: Authentication required or invalid
- `403`: Insufficient permissions

---

[API](https://skmtc.dev/1claw/apis/1claw-api.md) · [All operations](https://skmtc.dev/1claw/apis/1claw-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1claw/apis/1claw-api/revisions/ae109b496830?raw)