Settings

Set or change the HITL master-key salt

Persists the user-level KDF salt generated in the browser. JWT session only. Initial setup (no salt yet) is unguarded; a change (salt already set) requires a prior master_key_change 2FA grant (403 2fa_required otherwise) and is rate-limited. The browser re-wraps every config DEK under the new master key before calling this.

put/api/v1/me/master-key

Request

  • Base URL: https://api.proof.holdings
  • URL: https://api.proof.holdings/api/v1/me/master-key
  • Auth: API key in cookie auth_token

Request body

master_kdf_saltstring required

User-level KDF salt (base64url) generated in the browser. Persisted so the master key is device-independent; the server never derives or sees the master password.

backup_kdf_saltstring

Optional recovery (backup) KDF salt (base64url), written when the user sets up account recovery. Same opaque blob contract as master_kdf_salt.

Example request

{
  "master_kdf_salt": "c2FsdF92YWx1ZQ",
  "backup_kdf_salt": "YmFja3Vwc2FsdA"
}

Response

Updated HITL master-key salt

master_kdf_saltstring nullable required

User-level KDF salt (base64url) for deriving the HITL master key in the browser; null until the user sets a master password

backup_kdf_saltstring nullable required

User-level recovery (backup) KDF salt (base64url) for deriving the backup key; null until the user sets up account recovery

Example response

{
  "master_kdf_salt": "c2FsdF92YWx1ZQ",
  "backup_kdf_salt": "YmFja3Vwc2FsdA"
}

Changes

No recorded changes to this operation across all 1 revision of this API.