---
title: "Register or rotate E2E public key"
method: POST
path: "/v1/e2e/rotate-key"
tags: ["e2e"]
---

# Register or rotate E2E public key

`POST /v1/e2e/rotate-key`

## Request

- Base URL: `https://agentlair.dev`
- URL: `https://agentlair.dev/v1/e2e/rotate-key`
- Auth: HTTP bearer

Register or rotate the X25519 E2E public key for this account.
On first call: sets `master_seed` hash and initial public key.
On subsequent calls: verifies `master_seed` matches stored hash, then rotates.
Old keys are retained in history so old encrypted messages remain decryptable.

When an `@agentlair.dev` address has a registered public key (via `POST /v1/email/claim`
with `public_key`), inbound emails are encrypted with X25519 ECDH + AES-256-GCM.

## Request body

- object
  - `master_seed` string, required: Ownership proof — SHA-256 hash stored server-side
  - `new_public_key` string, required: Base64 or hex encoded X25519 public key (32 bytes)

## Response `200`

E2E key registered or rotated

- object
  - `ok` boolean
  - `account_id` string
  - `active_public_key` string
  - `key_history_count` integer
  - `first_setup` boolean
  - `updated_at` string, date-time
  - `note` string

## Other responses

- `403`: master_seed does not match

---

[API](https://skmtc.dev/agentlair/apis/agentlair-api.md) · [All operations](https://skmtc.dev/agentlair/apis/agentlair-api/llms.txt) · [OpenAPI document](https://skmtc.dev/agentlair/apis/agentlair-api/revisions/fac95ff4995d?raw)