---
title: "Local Keys"
description: "Generate, import, list, and delete local (JWK) keys in a Wallet API v2 wallet."
stack: "Community Stack (open source) — version 1.1.1"
stack_version: "1.1.1"
stack_comparison: https://docs.walt.id/community-vs-enterprise.md
canonical_url: https://docs.walt.id/community-stack/wallet2/key-management/local
generated: 2026-10-01
---
# Local Keys

Local keys are generated and stored by the wallet as JWKs in the configured database if [persistence](https://docs.walt.id/community-stack/wallet2/configurations/config-files/persistence.md) is enabled. This page covers generating a key, importing existing key material, and listing or deleting keys.

See [Key Management](https://docs.walt.id/community-stack/wallet2/key-management/overview.md) for how the wallet chooses a [default key](https://docs.walt.id/community-stack/wallet2/key-management/overview.md#default-key).

**Note:**

**Local Development:** the API is available at `http://localhost:7006` by default, whether Wallet API v2 runs standalone or via the Docker Compose quick start.

---

## Generate a Key

Create a new key in the wallet's key store.

**Option: CURL**

**Endpoint:** `POST /wallet/{walletId}/keys/generate` | [API Reference](https://docs.walt.id/community-stack/wallet2/full-api-reference.md)

##### Example Request

```bash
curl -X POST http://localhost:7006/wallet/{walletId}/keys/generate \
  -H 'Content-Type: application/json' \
  -d '{ "backend": "jwk", "keyType": "secp256r1" }'
```

**Path Parameters**

- **walletId**: _String_ (required) - The wallet to add the key to. See [Managing Wallets](https://docs.walt.id/community-stack/wallet2/wallets.md).

**Body Parameters**

- **backend**: _String_ (required) - The key backend.
- **keyType**: _String_ (optional) - One of `Ed25519`, `secp256r1`, `secp256k1`, `secp384r1`, `secp521r1`, `RSA`, `RSA3072`, `RSA4096`. Defaults to `secp256r1`.

**Error:**

  Prefer `secp256r1` (ES256) unless you have a specific reason to use another type. The Issuer2 and Verifier2 quick-start examples (and the wallet-attestation flow, if enabled) advertise `ES256` only — an `Ed25519` (EdDSA) key will fail with `invalid_proof` when receiving, or be rejected outright by attestation providers that don't support OKP keys.

---

##### Example Response

```json
{
  "keyId": "UneoCeKrx7t0SBINBZQOaSCCzvhgpK8tRS3NEG4pCfU",
  "keyType": "secp256r1"
}
```

**Response Fields**

- **keyId**: _String_ - The new key's ID. Use it as `keyId` when receiving, presenting, or creating a DID.
- **keyType**: _String_ - The key type.

---

## Import a Key

Import existing key material as a JWK.

**Option: CURL**

**Endpoint:** `POST /wallet/{walletId}/keys/import` | [API Reference](https://docs.walt.id/community-stack/wallet2/full-api-reference.md)

##### Example Request

```bash
curl -X POST http://localhost:7006/wallet/{walletId}/keys/import \
  -H 'Content-Type: application/json' \
  -d '{
    "key": {
      "type": "jwk",
      "jwk": { "kty": "EC", "crv": "P-256", "x": "...", "y": "...", "d": "..." }
    }
  }'
```

**Path Parameters**

- **walletId**: _String_ (required) - The wallet to import the key into.

**Body Parameters**

- **key**: _Object_ (required) - The serialized key. `type` is `jwk`, and `jwk` carries the JWK (include the private `d` component for a signing key).

---

##### Example Response

```json
{
  "keyId": "UneoCeKrx7t0SBINBZQOaSCCzvhgpK8tRS3NEG4pCfU",
  "keyType": "secp256r1"
}
```

---

## List Keys

List the metadata of all keys across the wallet's key stores.

**Option: CURL**

**Endpoint:** `GET /wallet/{walletId}/keys` | [API Reference](https://docs.walt.id/community-stack/wallet2/full-api-reference.md)

##### Example Request

```bash
curl http://localhost:7006/wallet/{walletId}/keys
```

**Path Parameters**

- **walletId**: _String_ (required) - The wallet whose keys you want to list.

---

##### Example Response

```json
[
  { "keyId": "UneoCeKrx7t0SBINBZQOaSCCzvhgpK8tRS3NEG4pCfU", "keyType": "secp256r1" }
]
```

---

## Get a Key

Fetch a single key's metadata.

**Option: CURL**

**Endpoint:** `GET /wallet/{walletId}/keys/{keyId}` | [API Reference](https://docs.walt.id/community-stack/wallet2/full-api-reference.md)

##### Example Request

```bash
curl http://localhost:7006/wallet/{walletId}/keys/{keyId}
```

**Path Parameters**

- **walletId**: _String_ (required) - The wallet holding the key.
- **keyId**: _String_ (required) - The key to fetch. Obtain it from [list keys](#list-keys) or the generate/import response.

---

##### Example Response

```json
{ "keyId": "UneoCeKrx7t0SBINBZQOaSCCzvhgpK8tRS3NEG4pCfU", "keyType": "secp256r1" }
```

---

## Delete a Key

**Option: CURL**

**Endpoint:** `DELETE /wallet/{walletId}/keys/{keyId}` | [API Reference](https://docs.walt.id/community-stack/wallet2/full-api-reference.md)

##### Example Request

```bash
curl -X DELETE http://localhost:7006/wallet/{walletId}/keys/{keyId}
```

**Path Parameters**

- **walletId**: _String_ (required) - The wallet holding the key.
- **keyId**: _String_ (required) - The key to delete.

---

##### Example Response

`204 No Content` on success, or `404 Not Found` if the key doesn't exist.

---

## Set the Default Key

Set the key the wallet uses when a receive, present, or DID creation request omits `keyId`.

**Option: CURL**

**Endpoint:** `PUT /wallet/{walletId}/keys/{keyId}/set-default` | [API Reference](https://docs.walt.id/community-stack/wallet2/full-api-reference.md)

##### Example Request

```bash
curl -X PUT http://localhost:7006/wallet/{walletId}/keys/{keyId}/set-default
```

**Path Parameters**

- **walletId**: _String_ (required) - The wallet holding the key.
- **keyId**: _String_ (required) - The key to make the wallet's default.

---

##### Example Response

`204 No Content` on success, or `404 Not Found` if the key doesn't exist in the wallet.

---

## Next Steps

- [Create a DID](https://docs.walt.id/community-stack/wallet2/did-management.md) from one of your keys.
- [Receive a credential](https://docs.walt.id/community-stack/wallet2/credential-receiving/sd-jwt-vc.md) bound to a key.