Sign in
chat

Backup private key

Save encrypted private key backup. The private key should be encrypted client-side with the backup password (using PBKDF2/Argon2 for key derivation) before sending. The server only stores the encrypted version and cannot decrypt it. The backup password is separate from Keycloak password and works for all users (including OAuth users).

post/api/chat/backup/private-key

Request body

encrypted_private_keystring required

Private key encrypted with backup password using AES-GCM. Key derived from password using PBKDF2 or Argon2.

encryption_saltstring required

Salt used for key derivation from backup password (base64)

encryption_ivstring nullable

IV/nonce for AES-GCM (base64, optional if included in ciphertext)

key_typestring

Key type: 'RSA-2048', 'RSA-4096', 'ECC-P256'

device_idstring nullable

Device UUID that created this backup (optional, for tracking)

backup_passwordstring required

Password for backup encryption. This is separate from Keycloak password and is used to encrypt/decrypt the backup. Minimum 8 characters, maximum 200 characters.

Example request

{
  "backup_password": "mySecureBackupPassword123",
  "device_id": "device-uuid-optional",
  "encrypted_private_key": "base64-encrypted-private-key...",
  "encryption_iv": "base64-iv...",
  "encryption_salt": "base64-salt...",
  "key_type": "RSA-2048"
}

Response

Successful Response

titlestring

Success title

messagestring

Success message

backup_enabledboolean

Whether backup is enabled

device_idstring nullable

Device UUID that created this backup

Example response

{
  "backup_enabled": true,
  "device_id": "device-uuid",
  "message": "Chiave privata salvata nel backup con successo"
}

Changes

No recorded changes to this endpoint across all 1 revision of this API.