MAmatrix
End-to-end encryption

Upload cross-signing keys.

Publishes cross-signing keys for the user.

This API endpoint uses the User-Interactive Authentication API, except when used by an application service.

User-Interactive Authentication MUST be performed for regular clients, except in these cases:

  • there is no existing master signing key uploaded to the homeserver, OR
  • there is an existing master signing key and it exactly matches the master signing key provided in the request body. If there are any additional keys provided in the request (self-signing key, user-signing key) they MUST also match the existing keys stored on the server. In other words, the request contains no new keys.

This allows clients to freely upload one set of keys, but not modify/overwrite keys if they already exist. Allowing clients to upload the same set of keys more than once makes this endpoint idempotent in the case where the response is lost over the network, which would otherwise cause a UIA challenge upon retry.

NOTE: When this endpoint requires User-Interactive Authentication, it uses the m.oauth authentication type if the access token was obtained via the OAuth 2.0 API.

post/_matrix/client/v3/keys/device_signing/upload

Request

Request body

Example request

{
  "auth": {
    "example_credential": "verypoorsharedsecret",
    "session": "xxxxx",
    "type": "example.type.foo"
  },
  "master_key": {
    "keys": {
      "ed25519:base64+master+public+key": "base64+master+public+key"
    },
    "usage": [
      "master"
    ],
    "user_id": "@alice:example.com"
  },
  "self_signing_key": {
    "keys": {
      "ed25519:base64+self+signing+public+key": "base64+self+signing+master+public+key"
    },
    "signatures": {
      "@alice:example.com": {
        "ed25519:base64+master+public+key": "signature+of+self+signing+key"
      }
    },
    "usage": [
      "self_signing"
    ],
    "user_id": "@alice:example.com"
  },
  "user_signing_key": {
    "keys": {
      "ed25519:base64+user+signing+public+key": "base64+user+signing+master+public+key"
    },
    "signatures": {
      "@alice:example.com": {
        "ed25519:base64+master+public+key": "signature+of+user+signing+key"
      }
    },
    "usage": [
      "user_signing"
    ],
    "user_id": "@alice:example.com"
  }
}

Response

The provided keys were successfully uploaded.

object required

Example response

{}

Changes

No recorded changes to this operation across all 1 revision of this API.