Create Due Vault

Note: This process uses Pattern 2: Challenge-Response Flow - you'll receive a challenge and need to retry with a signature.

Initial Request

curl --location 'https://api.due.network/v1/vaults' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <token>' \
--data '{}'

Note: The payload is empty {} for vault creation.

Challenge Response

You'll receive a 403 error with a challenge:

{
    "success": false,
    "message": "Please sign the following challenge to proceed",
    "httpCode": 403,
    "code": "ACTION_SIGNATURE_REQUIRED",
    "data": {
        "factors": {
            "Key": {
                "credId": "",
                "clientData": "eyJ0eXBlIjoia2V5LmdldCIsImNoYWxsZW5nZSI6ImNoYWxsZW5nZTFETnVrNmFIZlhNU05vWGZOYUFwQUlVaFZDOGhiQmM4ViIsIm9yaWdpbiI6Imh0dHBzOi8vYXBwLnNhbmRib3guZHVlLm5ldHdvcmsiLCJjcm9zc09yaWdpbiI6ZmFsc2V9",
                "signature": null
            }
        },
        "challengeIdentifier": "chid1DLZSWZlpvQSGTmMrwhUZTpCIFOwaneRi"
    }
}

Sign the Challenge

Sign the base64-encoded clientData:

echo -n "eyJ0eXBlIjoia2V5LmdldCIsImNoYWxsZW5nZSI6ImNoYWxsZW5nZTFETnVrNmFIZlhNU05vWGZOYUFwQUlVaFZDOGhiQmM4ViIsIm9yaWdpbiI6Imh0dHBzOi8vYXBwLnNhbmRib3guZHVlLm5ldHdvcmsiLCJjcm9zc09yaWdpbiI6ZmFsc2V9" | base64 -d | openssl dgst -sha256 -sign private.pem | base64 -w 0 | tr '+/' '-_' | tr -d '='

Important: The signature must be in base64 URL-safe format (not hex).

Complete Vault Creation

Submit the signed challenge following Pattern 2 structure:

curl --location 'https://api.due.network/v1/vaults' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <token>' \
--data '{
    "signature": {
        "challengeIdentifier": "chid1DLZSWZlpvQSGTmMrwhUZTpCIFOwaneRi",
        "firstFactor": {
            "kind": "Key",
            "credentialAssertion": {
                "credId": "passkey_xonETR6gAv3wIyhy8ehjx",
                "clientData": "eyJ0eXBlIjoia2V5LmdldCIsImNoYWxsZW5nZSI6ImNoYWxsZW5nZTFETnVrNmFIZlhNU05vWGZOYUFwQUlVaFZDOGhiQmM4ViIsIm9yaWdpbiI6Imh0dHBzOi8vYXBwLnNhbmRib3guZHVlLm5ldHdvcmsiLCJjcm9zc09yaWdpbiI6ZmFsc2V9",
                "signature": "MEUCIAlkmdPEf0B_5xVr4DKK6uvsN0y1YVzsFe4vAOMlPcn4AiEAkLxs0HAiDbNd8NeYxns3t1CSLfMjmDsg8JkNH2GqPy0"
            }
        }
    }
}'

Response:

{
    "id": "key_2lRmxX5KBYRzMg",
    "address": "0x08bEB4Ad3D8D607646E4d5311eb355Ec2d2396F5"
}

Your vault is now created! Save the vault ID and address for future use.

Important:

The vault ID (key_2lRmxX5KBYRzMg) is used as keyId when signing transactions
You need to add this address to an account before you can use it