Register an API key

POST

/api-keys

• Sandbox (testnets only — Avalanche Fuji, Base Sepolia, Bitcoin signet)

Register a new Ed25519 API key for your org. You generate the keypair and submit only the public key — XKOVA never receives or stores private keys. To rotate, register a new key, switch your clients to it, then revoke the old one. Subject to a per-org key quota.

Authorizations

• stamp

Request Body ^required

object

public_key

required

Hex-encoded 32-byte Ed25519 public key

string

label

string

<= 128 characters

Example

{
  "public_key": "8f2c…a91b",
  "label": "backend-prod"
}

Responses

201

Key registered.

object

id

required

string

public_key

required

string

label

required

string

created_at

required

string format: date-time

revoked

required

boolean

revoked_at

string format: date-time

400

The request body or parameters failed validation.

Failures return a single human-readable error message; the HTTP status carries the category (400 validation, 401 auth, 403 refused, 404 missing, 409 conflict, 429 rate limit). When a signing request is refused for a specific reason, the message names it — for example the amount exceeds a spend limit, the policy denied the recipient, or the intent signature did not verify.

object

error

required

string

code

required

Stable machine slug (invalid_request, unauthorized, forbidden, not_found, conflict, rate_limited); a refused sign names the reason in the message

string

Example

{
  "error": "amount must be a base-10 integer",
  "code": "invalid_request"
}

401

Missing, malformed, or invalid request signature.

Failures return a single human-readable error message; the HTTP status carries the category (400 validation, 401 auth, 403 refused, 404 missing, 409 conflict, 429 rate limit). When a signing request is refused for a specific reason, the message names it — for example the amount exceeds a spend limit, the policy denied the recipient, or the intent signature did not verify.

object

error

required

string

code

required

Stable machine slug (invalid_request, unauthorized, forbidden, not_found, conflict, rate_limited); a refused sign names the reason in the message

string

Example

{
  "error": "request signature did not verify",
  "code": "unauthorized"
}

429

A quota or rate limit was reached. Retry later.

Failures return a single human-readable error message; the HTTP status carries the category (400 validation, 401 auth, 403 refused, 404 missing, 409 conflict, 429 rate limit). When a signing request is refused for a specific reason, the message names it — for example the amount exceeds a spend limit, the policy denied the recipient, or the intent signature did not verify.

object

error

required

string

code

required

Stable machine slug (invalid_request, unauthorized, forbidden, not_found, conflict, rate_limited); a refused sign names the reason in the message

string

Example

{
  "error": "vault quota reached for this org",
  "code": "rate_limited"
}