Keystore

List passkey keystores — self for users, all for admin/super_admin

get

Authorizations

bearer

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Query parameters

pagenumberOptional

Page number (default: 1)

Example: 1

pageSizenumberOptional

Number of items per page (default: 10)

Example: 10

sortstringOptional

Sort field and order. Use - prefix for descending. Example: -createdAt, createdAt

Example: -createdAt

selectstringOptional

Fields to select (comma separated). Use + prefix to include hidden fields. Example: name,status,+holders

populatestringOptional

Relations to populate (comma separated). Example: wallet,token

Responses

200Success

No content

get

/api/keystore

HTTPcURLJavaScriptPython

GET /api/keystore HTTP/1.1
Host: api.radfi.co
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

200Success

No content

get

Path parameters

emailstringRequired

Responses

200Success

No content

get

/api/keystore/passkey/{email}/credentialIds

HTTPcURLJavaScriptPython

GET /api/keystore/passkey/{email}/credentialIds HTTP/1.1
Host: api.radfi.co
Accept: */*

200Success

No content

Device B initiates ECDH passkey sync — returns OTP session

post

Body

application/json

emailstringRequired

Email of the account Device B wants to link to

pubKeyBstringRequired

Device B ephemeral ECDH public key (base64 or hex)

Responses

201Success

post

/api/keystore/passkey/request-link

HTTPcURLJavaScriptPython

POST /api/keystore/passkey/request-link HTTP/1.1
Host: api.radfi.co
Content-Type: application/json
Accept: */*
Content-Length: 33

{
  "email": "text",
  "pubKeyB": "text"
}

201Success

No content

Device A polls for Device B public key to complete ECDH

get

Query parameters

otpstringRequired

Responses

200Success

No content

get

/api/keystore/passkey/pending-link

HTTPcURLJavaScriptPython

GET /api/keystore/passkey/pending-link?otp=text HTTP/1.1
Host: api.radfi.co
Accept: */*

200Success

No content

Device A stores ECDH-encrypted keystore blob for Device B

post

Body

application/json

otpstringRequired

OTP from the request-link session

encryptedForBstringRequired

AES-GCM encrypted mnemonic, key derived via ECDH (base64)

pubKeyAstringRequired

Device A ephemeral ECDH public key (base64 or hex)

Responses

201Success

post

/api/keystore/passkey/approve-link

HTTPcURLJavaScriptPython

POST /api/keystore/passkey/approve-link HTTP/1.1
Host: api.radfi.co
Content-Type: application/json
Accept: */*
Content-Length: 54

{
  "otp": "text",
  "encryptedForB": "text",
  "pubKeyA": "text"
}

201Success

No content

Device B polls for the ECDH-encrypted keystore blob from Device A

get

Query parameters

otpstringRequired

OTP from the request-link session

emailstringRequired

Email address — used to resolve the account for the relay key

Responses

200Success

No content

get

/api/keystore/passkey/relay

HTTPcURLJavaScriptPython

GET /api/keystore/passkey/relay?otp=text&email=text HTTP/1.1
Host: api.radfi.co
Accept: */*

200Success

No content

Device B registers its passkey and saves the decrypted keystore blob

post

Body

application/json

otpstringRequired

OTP from the request-link session

emailstringRequired

Email address — must match the account that owns the OTP session

challengeIdstringRequired

Challenge ID from GET /auth/webauthn/challenge

credentialIdstringRequired

WebAuthn credential ID

webauthnPublicKeystringRequired

DER/SPKI public key (base64)

attestationstringRequired

CBOR attestation object (base64)

clientDataJsonstringRequired

WebAuthn clientDataJSON (base64)

authenticatorDatastringRequired

WebAuthn authenticatorData (base64)

encryptedBlobstringRequired

Keystore blob encrypted with Device B derived key

deviceNamestringOptional

Human-readable device label (e.g. "Work Laptop")

Responses

201Success

post

/api/keystore/passkey/confirm-link

HTTPcURLJavaScriptPython

POST /api/keystore/passkey/confirm-link HTTP/1.1
Host: api.radfi.co
Content-Type: application/json
Accept: */*
Content-Length: 214

{
  "otp": "text",
  "email": "text",
  "challengeId": "text",
  "credentialId": "text",
  "webauthnPublicKey": "text",
  "attestation": "text",
  "clientDataJson": "text",
  "authenticatorData": "text",
  "encryptedBlob": "text",
  "deviceName": "text"
}

201Success

No content

Remove a passkey by ID (blocked if it is the last one)

delete

Path parameters

idstringRequired

Responses

200Success

No content

delete

/api/keystore/passkey/{id}

HTTPcURLJavaScriptPython

DELETE /api/keystore/passkey/{id} HTTP/1.1
Host: api.radfi.co
Accept: */*

200Success

No content

Send password hint to account email

post

Body

application/json

emailstringRequired

Email address of the account to send the password hint to

Responses

201Success

post

/api/keystore/srp/password-hint

HTTPcURLJavaScriptPython

POST /api/keystore/srp/password-hint HTTP/1.1
Host: api.radfi.co
Content-Type: application/json
Accept: */*
Content-Length: 16

{
  "email": "text"
}

201Success

No content