---
title: "Create recovery kit"
method: POST
path: "/users/@me/recovery-kit"
tags: ["Users"]
---

# Create recovery kit

`POST /users/@me/recovery-kit`

## Request

- Base URL: `https://web.fluxer.app/api/v1`
- URL: `https://web.fluxer.app/api/v1/users/@me/recovery-kit`
- Auth: API key in header `Authorization`

Create a recovery kit for the current account and return its recovery key. The key is shown only once and any previous kit stops working. Only available on instances where people sign in with a username. Requires sudo mode verification.

## Request body

- SudoVerificationSchema
  - `password` string
  - `mfa_method` 'totp' | 'webauthn': MFA method to use for verification
  - `mfa_code` string: MFA verification code from an authenticator app
  - `webauthn_response` WebAuthnAuthenticationResponse
    - `id` string, required
    - `rawId` string, required
    - `type` 'public-key', required
    - `authenticatorAttachment` 'cross-platform' | 'platform'
    - `clientExtensionResults` object, required
      - `appid` boolean
      - `credProps` object
        - `rk` boolean
      - `hmacCreateSecret` boolean
    - `response` object, required
      - `clientDataJSON` string, required
      - `authenticatorData` string, required
      - `signature` string, required
      - `userHandle` string
  - `webauthn_challenge` string: WebAuthn challenge string

## Response `200`

Success

- RecoveryKitCreateResponse
  - `recovery_key` string, required: New recovery key as 8 groups of 4 joined by dashes, shown only once. Any previous kit stops working
  - `created_at` string, date-time, required: ISO 8601 timestamp when the recovery kit was created

## Other responses

- `400`: Bad Request - The request was malformed or contained invalid data
- `401`: Unauthorized - Authentication is required or the token is invalid
- `403`: Forbidden - You do not have permission to perform this action
- `429`: Too Many Requests - You are being rate limited
- `500`: Internal Server Error - An unexpected error occurred

## Changes

> 39 revisions in range; 2 not diffed.

- **2026-10-06** `3af1fd7f2456`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/fluxer/apis/fluxer-api/changes/users/@me/recovery-kit/post.md)

---

[API](https://skmtc.dev/fluxer/apis/fluxer-api.md) - [All operations](https://skmtc.dev/fluxer/apis/fluxer-api/llms.txt) - [OpenAPI document](https://skmtc.dev/fluxer/apis/fluxer-api/revisions/9534dbe80d92?raw)