One-Time Prekeys API¶

Older endpoint notes

Rendered from ProjectInfo/api-docs/keyserver/prekeys.md on docs/encryption-modes-spec. These notes predate the REST API reference, which is canonical wherever the two overlap. They are published because they still cover endpoints the reference does not yet document — check shapes against the reference and the spec errata.

Accessible at /api/keys/prekeys/... — proxied from API to keyserver.

One-time prekeys (OTPs) are X25519 keypairs used once per X3DH session for forward secrecy.

All endpoints require Authorization: Bearer <token>.

POST /api/keys/prekeys¶

Upload a batch of one-time prekeys.

Request:

{
  "prekeys": [
    { "key_id": 1, "public_key": "base64" },
    { "key_id": 2, "public_key": "base64" }
  ]
}

key_id: unique integer per key (monotonically increasing, never reuse IDs)
public_key: X25519 public key (32 bytes, base64)

Response 204

Upload batches of 100 at a time. Call when count drops below 20.

GET /api/keys/prekeys/count¶

Check how many one-time prekeys remain for this device.

Response 200:

{ "count": 87 }

Post-login check: Call this after login. If count < 20, generate 100 new OTP keypairs and upload them. Keep private keys in local secure storage.