Delegate Spark token-transaction signing authority for a card funding source or agent backed by an Embedded Wallet internal account to a Grid-custodied P-256 API key. Grid uses the requested owner and internal account to identify the wallet, generates the keypair server-side, creates an isolated signer identity holding the public key, then policies granting that identity signing and self-revocation authority. The private key is custodied by Grid and never returned. Both activities must be authorized by the wallet owner, so creation is a three-leg signed-retry flow:

1. Call POST /auth/delegated-keys with no signature headers. Grid generates the delegated keypair and the response is 202 with a payloadToSign, requestId, and expiresAt.

2. Use the session API keypair of a verified credential on the requested Embedded Wallet internal account to build an API-key stamp over payloadToSign, then retry the same request with that full stamp as the Grid-Wallet-Signature header and the requestId echoed back as the Request-Id header. The response is a second 202 with a new payloadToSign, requestId, and expiresAt.

3. Stamp the new payloadToSign with the same session keypair and retry once more with the new Request-Id. The signed retry returns 201 with the created DelegatedKey in ACTIVE status. For card keys, a provisioned PENDING_AUTH card using this funding source becomes ACTIVE automatically. Cards still provisioning remain PROCESSING; frozen and closed cards retain their status.

The same request body must be sent on all three legs. A flow abandoned after the second leg leaves the key in PENDING status: the signer identity exists but holds no policies, so it cannot sign or revoke itself. Abandoned PENDING card keys do not block creating another delegated key. For an agent, a PENDING key blocks a new one until it is revoked with DELETE /auth/delegated-keys/{id}; revoking a PENDING key only discards Grid's key material. After activation, Grid uses the custodied key to authorize signing for the card's Embedded Wallet funding account or for policy-approved agent actions in place of a session keypair; the platform never handles the key material.

Each card funding source may have at most one ACTIVE delegated key, and each agent and Embedded Wallet pair at most one unrevoked (PENDING or ACTIVE) delegated key; revoke the existing key before creating a new one. A delegated key authorizes raw-payload signing for the wallet and cannot be scoped to amounts or recipients by the public API. Revoke it with DELETE /auth/delegated-keys/{id} when no longer needed.

{
  "cardId": "Card:019542f5-b3e7-1d02-0000-000000000010",
  "agentId": "Agent:019542f5-b3e7-1d02-0000-000000000042",
  "internalAccountId": "InternalAccount:019542f5-b3e7-1d02-0000-000000000002",
  "nickname": "Payments key"
}

{
  "id": "DelegatedKey:019542f5-b3e7-1d02-0000-000000000021",
  "cardId": "Card:019542f5-b3e7-1d02-0000-000000000010",
  "fundingSourceId": "CardFundingSource:019542f5-b3e7-1d02-0000-000000000011",
  "agentId": "Agent:019542f5-b3e7-1d02-0000-000000000042",
  "accountId": "InternalAccount:019542f5-b3e7-1d02-0000-000000000002",
  "publicKey": "02a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90",
  "nickname": "Settlement service key",
  "status": "ACTIVE",
  "createdAt": "2026-04-08T15:30:01Z",
  "updatedAt": "2026-04-08T15:30:42Z"
}