---
title: "Set or change the HITL master-key salt"
method: PUT
path: "/api/v1/me/master-key"
tags: ["Settings"]
---

# Set or change the HITL master-key salt

`PUT /api/v1/me/master-key`

## Request

- Base URL: `https://api.proof.holdings`
- URL: `https://api.proof.holdings/api/v1/me/master-key`
- Auth: API key in cookie `auth_token`

Persists the user-level KDF salt generated in the browser. JWT session only. Initial setup (no salt yet) is unguarded; a change (salt already set) requires a prior master_key_change 2FA grant (403 2fa_required otherwise) and is rate-limited. The browser re-wraps every config DEK under the new master key before calling this.

## Request body

- SetMasterKeyBody: HITL master-key KDF salt to set or change
  - `master_kdf_salt` string, required: User-level KDF salt (base64url) generated in the browser. Persisted so the master key is device-independent; the server never derives or sees the master password.
  - `backup_kdf_salt` string: Optional recovery (backup) KDF salt (base64url), written when the user sets up account recovery. Same opaque blob contract as master_kdf_salt.

## Response `200`

Updated HITL master-key salt

- MasterKeyResponse: HITL master-key KDF salt for the authenticated user
  - `master_kdf_salt` string, nullable, required: User-level KDF salt (base64url) for deriving the HITL master key in the browser; null until the user sets a master password
  - `backup_kdf_salt` string, nullable, required: User-level recovery (backup) KDF salt (base64url) for deriving the backup key; null until the user sets up account recovery

## Other responses

- `401`: Unauthorized
- `403`: 2FA required to change an existing master password
- `429`: Rate limit exceeded

---

[API](https://skmtc.dev/proof/apis/proof-holdings-api.md) · [All operations](https://skmtc.dev/proof/apis/proof-holdings-api/llms.txt) · [OpenAPI document](https://skmtc.dev/proof/apis/proof-holdings-api/revisions/b15f506de696?raw)