---
title: "Activate a closed-launch access code"
method: POST
path: "/api/v1/access/activate"
tags: ["Access"]
---

# Activate a closed-launch access code

`POST /api/v1/access/activate`

## Request

- Base URL: `https://api.ekiden.fi`
- URL: `https://api.ekiden.fi/api/v1/access/activate`
- Auth: none declared
- TypeScript: <https://skmtc.dev/ekidenfi/apis/ekiden-gateway/docs/api/v1/access/activate/post.ts> (a function with typed inputs; its response is checked against the schema)

## Request body

- AccessActivateRequest: Public Stage 1 activation request (spec §4). The caller is NOT yet whitelisted. The wallet signs a canonical message that binds the code hash, its root address, and `signed_at`: `ekiden-stage1-activate:{sha256(normalized code)}:{root_address}:{signed_at}` using the same wallet-signature scheme JWT login uses. The root address is derived from `public_key` (never trusted from the client), exactly as `/authorize` does.
  - `code` string, required: Plaintext access code. Normalized (trim + uppercase) and hashed server-side; the plaintext is never persisted (S1-D5).
  - `nonce` string, nullable: Replay nonce bound into the Canton activation message. REQUIRED on the Canton rail, ignored on Aptos.
  - `party_id` string, nullable: Canton party id (`<hint>::<fingerprint>`). REQUIRED on the Canton rail, ignored on Aptos. Canton has no address derivable from the public key alone, so the wallet signs for its party and the server derives the root from that party — the same identity `/authorize` uses. The party's `::<fingerprint>` suffix commits to the public key, so a caller cannot claim someone else's party.
  - `public_key` string, required: Wallet public key, same encoding as `/authorize`'s `public_key`.
  - `signature` string, required: Wallet signature over the canonical activation message.
  - `signed_at` integer, required: Unix seconds at which the message was signed. Must be within the configured signature window of server time.

## Response `200`

Wallet activated

- AccessActivateResponse
  - `activated` boolean, required
  - `badge` boolean, required
  - `multiplier_bps` integer, required

## Other responses

- `400`: Invalid, expired, or revoked code
- `401`: Bad or stale signature
- `404`: Access module disabled
- `409`: Code already used or wallet already activated
- `429`: Rate limited

## Changes

- **2026-09-10** `fad9eecaba2e`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/ekidenfi/apis/ekiden-gateway/changes/api/v1/access/activate/post.md)

---

[API](https://skmtc.dev/ekidenfi/apis/ekiden-gateway.md) - [All operations](https://skmtc.dev/ekidenfi/apis/ekiden-gateway/llms.txt) - [OpenAPI document](https://skmtc.dev/ekidenfi/apis/ekiden-gateway/revisions/fad9eecaba2e?raw)