---
title: "Get HITL master-key salt"
method: GET
path: "/api/v1/me/master-key"
tags: ["Settings"]
---

# Get HITL master-key salt

`GET /api/v1/me/master-key`

## Request

- Base URL: `https://api.proof.holdings`
- URL: `https://api.proof.holdings/api/v1/me/master-key`
- Auth: API key in cookie `auth_token`

Returns the user-level KDF salt for deriving the HITL master key in the browser (device-independent). JWT session only — the master password is a browser concept and SDK/MCP callers never hold it. Returns null until the user sets a master password.

## Response `200`

HITL master-key salt

- MasterKeyResponse: HITL master-key KDF salt for the authenticated user
  - `master_kdf_salt` string, nullable, required: User-level KDF salt (base64url) for deriving the HITL master key in the browser; null until the user sets a master password
  - `backup_kdf_salt` string, nullable, required: User-level recovery (backup) KDF salt (base64url) for deriving the backup key; null until the user sets up account recovery

## Other responses

- `401`: Unauthorized

---

[API](https://skmtc.dev/proof/apis/proof-holdings-api.md) · [All operations](https://skmtc.dev/proof/apis/proof-holdings-api/llms.txt) · [OpenAPI document](https://skmtc.dev/proof/apis/proof-holdings-api/revisions/6b8d61ee354f?raw)