---
title: "Backup private key"
method: POST
path: "/api/chat/backup/private-key"
tags: ["chat"]
---

# Backup private key

`POST /api/chat/backup/private-key`

Save encrypted private key backup. The private key should be encrypted client-side with the backup password (using PBKDF2/Argon2 for key derivation) before sending. The server only stores the encrypted version and cannot decrypt it. The backup password is separate from Keycloak password and works for all users (including OAuth users).

## Request body

- BackupPrivateKeyRequest — Request to backup private key encrypted with backup password.
  - `encrypted_private_key` string, required — Private key encrypted with backup password using AES-GCM. Key derived from password using PBKDF2 or Argon2.
  - `encryption_salt` string, required — Salt used for key derivation from backup password (base64)
  - `encryption_iv` string, nullable — IV/nonce for AES-GCM (base64, optional if included in ciphertext)
  - `key_type` string — Key type: 'RSA-2048', 'RSA-4096', 'ECC-P256'
  - `device_id` string, nullable — Device UUID that created this backup (optional, for tracking)
  - `backup_password` string, required — Password for backup encryption. This is separate from Keycloak password and is used to encrypt/decrypt the backup. Minimum 8 characters, maximum 200 characters.

## Response `200`

Successful Response

- BackupPrivateKeyResponse — Response after backing up private key.
  - `title` string — Success title
  - `message` string — Success message
  - `backup_enabled` boolean — Whether backup is enabled
  - `device_id` string, nullable — Device UUID that created this backup

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.dev/corabea/apis/corabea-api.md) · [All operations](https://skmtc.dev/corabea/apis/corabea-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/corabea/corabea-api/revisions/13c1bce1bdc4/schema)