# Register a Recovery Key

> Coming soon, upon request — this feature is turned on for your tenant by the Aurea team. [Contact us](https://www.aureahub.com/contact)

Register your tenant's recovery public key: the key Aurea seals its share of your MPC wallets to, so you can check — and if need be rebuild — a wallet's key without Aurea.

## Overview

- **Why.** An [MPC wallet](https://docs.aureahub.com/docs/mpc-config.md) has three shares — the user's device, the backup and Aurea's cosigner — and any two sign. The recovery key covers the case left: one of the user's shares lost while Aurea is unavailable. With it registered, Aurea can hand you, on your request, a **recovery kit** for a wallet: Aurea's share sealed to your key (RSA-OAEP-256 with AES-256-GCM), which only your private key opens. With the kit and one of the wallet's other shares, Aurea's offline recovery utility rebuilds and checks the wallet's public key and address — it never signs. Institutions use it to prove, on a test wallet, that they could rebuild a wallet without Aurea.
- **Only the public key leaves your side.** Generate the key pair on an offline machine, or keep it in your HSM. Aurea keeps the public key and its id; it never sees your private key.
- **The key**: RSA of at least 3072 bits, as a PEM public key — `-----BEGIN PUBLIC KEY-----` (SPKI) or `-----BEGIN RSA PUBLIC KEY-----` (PKCS#1), at most 8192 characters. A private key, a key that is not RSA, a shorter one or one that cannot be read answers `400` at once, and nothing is held for approval.
- **`kid`**, the key's id, is the base64url SHA-256 (no padding) of the key's SPKI encoding: compute it on your side and compare (Implementation).
- **One key per tenant**: registering another replaces it.
- **Who**: your tenant's `owner`, `tenantadmin` or `non_signing_admin`; other roles get `403`.
- **Your tenant's quorum** covers it (`custody.mpc_recovery_key.register`, [Your Tenant's Quorum](https://docs.aureahub.com/docs/guide-tenant-quorum.md)): done at once while your quorum is off (and recorded, in `log`); in `enforce`, `202` `awaiting_quorum` until another administrator approves it, and the one who asked reads the answer with [Read the Answer](https://docs.aureahub.com/docs/quorum-request-result.md).
- While your tenant's [audit trail](https://docs.aureahub.com/docs/audit-events.md) is on, it records `mpc_recovery_key.registered` (category `keys`) with the key's id and size — never the key.

## Coming soon, upon request

The recovery key and the recovery kit are available on request [Coming soon, upon request](https://docs.aureahub.com/docs/feature-availability.md):

| Mode | Register a Recovery Key and Get the Recovery Key |
| --- | --- |
| off | **The default.** Both answer `404` `{ "error": "The MPC recovery kit is not enabled" }` before anything else: nothing is checked, held or kept. |
| on | As this page and [Get the Recovery Key](https://docs.aureahub.com/docs/mpc-recovery-key-get.md) describe. A request held by your quorum is checked again when it is approved: approved once the kit is off, it answers the same `404`. |

These answers carry only `error`, without `statusCode` or `details`.

## Endpoint

### `PUT /v1/tenant/mpc-recovery-key`

Authentication: bearer token required.

Registers (or replaces) your tenant's recovery public key.

**Request body**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `publicKeyPem` | string | yes | The RSA public key, PEM (SPKI or PKCS#1), at least 3072 bits, 1 to 8192 characters. Missing: `422` |

**Responses**

`200` Registered

```json
{
  "kid": "x7Qm2c9Vd1kR4tY8pL0sN3wZ6aE5hJ2uB9fG1oK7qXc",
  "registeredAt": "2026-10-14T09:00:00.000Z"
}
```

`202` Held by your quorum

```json
{
  "state": "awaiting_quorum",
  "requestId": "4e2b9c17-8a3d-4f60-b5e1-7c9d0a2f6b38"
}
```

`400` Key refused

```json
{
  "error": "The recovery key is 2048 bits (at least 3072)"
}
```

`400` A private key

```json
{
  "error": "Register the recovery PUBLIC key only: a private key is never sent"
}
```

`404` Off

```json
{
  "error": "The MPC recovery kit is not enabled"
}
```

Other `400` messages: `The recovery key is a PEM public key (-----BEGIN PUBLIC KEY-----)`, `The recovery key cannot be read`, `The recovery key must be RSA (RSA-OAEP-256, what an HSM unwraps)`.

## Implementation

```bash
# On the offline machine: the key pair (or export the public key from your HSM)
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:4096 -out recovery.key.pem
openssl pkey -in recovery.key.pem -pubout -out recovery.pub.pem   # only this file leaves

# Its id, to compare with the answer's kid
openssl pkey -pubin -in recovery.pub.pem -outform DER \
  | openssl dgst -sha256 -binary | openssl base64 -A | tr '+/' '-_' | tr -d '='

# Register it (an administrator's access token)
curl -X PUT "https://api.aureahub.com/v1/tenant/mpc-recovery-key" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile pem recovery.pub.pem '{publicKeyPem: $pem}')"
```

---

Web version: https://docs.aureahub.com/#mpc-recovery-key-register