---
title: "Pick up the re-sealed keyring after a key reset"
method: GET
path: "/api/v1/linked_devices/self/sealed_key"
tags: ["Devices"]
---

# Pick up the re-sealed keyring after a key reset

`GET /api/v1/linked_devices/self/sealed_key`

## Request

- Base URL: `https://saltapp.ai`
- URL: `https://saltapp.ai/api/v1/linked_devices/self/sealed_key`
- Auth: API key in header `api-key`

A linked computer or reader calls this with its own `sld_` token; a browser sign-in with its JWT (found by its jti). Returns the keyring the phone sealed to THIS device's key (ciphertext only) until it is acked. A browser also gets a fresh `jwt` (`Bearer...`), swapped in on the ack. 404 `{code:"no_pending_key", key_generation, sealed_key_generation, needs_relink}` when nothing waits; `needs_relink` is true when the device is behind the person's key (the 14-day window passed): link it again. A pending key is dropped after 14 days.

## Response `200`

OK.

- object
  - `sealed_key` string
  - `generation` integer
  - `sealed_at` string, date-time
  - `expires_at` string, date-time
  - `jwt` string: Browser sign-ins only.

## Other responses

- `401`: Missing or invalid credentials.
- `404`: No pending key (`no_pending_key`), or not a linked device (`not_a_linked_device`).

---

[API](https://skmtc.dev/saltapp/apis/salt-agent-api.md) · [All operations](https://skmtc.dev/saltapp/apis/salt-agent-api/llms.txt) · [OpenAPI document](https://skmtc.dev/saltapp/apis/salt-agent-api/revisions/a8b8642ab7f8?raw)