Sign in
Backend Wallets

Register wallet secret.

Changed on

Register a new wallet secret (authentication key).

Registers an ECDSA P-256 public key that will be used to verify X-Wallet-Auth JWT signatures. This is required before using WALLET_AUTH for other backend wallet operations.

Uses provided-key authentication: the request must include a walletAuthToken JWT signed by the private key corresponding to the publicKey being registered. This proves possession of the private key without transmitting it.

Note: Only ONE active secret is allowed per project. This call fails if an active secret already exists; use rotateWalletSecret to replace an existing secret.

post/v2/accounts/backend/register-secret

Request

  • Base URL: https://api.openfort.io
  • URL: https://api.openfort.io/v2/accounts/backend/register-secret
  • Auth: one of:
    • HTTP bearer
    • HTTP bearer

Request body

publicKeystring required

ECDSA P-256 public key for wallet authentication (PEM format). This will be used to verify X-Wallet-Auth JWT signatures.

walletAuthTokenstring required

JWT signed with the private key corresponding to publicKey. This proves possession of the private key without transmitting it.

JWT must include: uris (matching request path), reqHash (SHA-256 of request body), iat (issued at), nbf (not before), and optionally exp (expiration).

keyIdstring

Key identifier for the secret. Used to identify this key in X-Wallet-Auth JWT headers.

Example request

{
  "publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE...",
  "walletAuthToken": "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9...",
  "keyId": "ws_1234567890"
}

Response

Successful response.

object'walletSecret' required

The type of object.

keyIdstring required

The key ID for the registered secret.

registeredAtinteger required

Timestamp when the secret was registered (Unix epoch seconds).

Example response

{
  "keyId": "ws_1234567890"
}

Changes