#Key Management

Every credential a wallet holds is bound to a cryptographic key. The wallet signs proofs of possession (when receiving) and presentations (when presenting) with a key from its key store. This section covers generating, importing, and managing those keys.

#The Key Model

• A wallet can have more than one key when using key stores (see Managing Wallets).
• Each key has a key ID (derived from the key itself) and a key type (Ed25519, secp256r1, secp256k1, secp384r1, secp521r1, RSA, RSA3072, or RSA4096).
• Keys are added by generating a new one or importing existing key material.

#Default Key

Many endpoints — receiving, presenting, DID creation — accept an optional keyId. When you omit it, the wallet uses its default key.

By default, the wallet uses the first key across its key stores, then falls back to the staticKey for a store-less wallet. You can override that choice with Set the Default Key. After a default is set, receiving and presenting flows use that key unless a request passes keyId.

To control which key is used:

• set a default key with PUT /wallet/{walletId}/keys/{keyId}/set-default,
• pass keyId explicitly on each call, or
• use a store-less wallet with a single staticKey.

#Generate vs Import

• Generate — the wallet creates a new key of the type you choose.
• Import — you supply existing key material (a JWK) and the wallet stores it.

#Next Steps

• Local Keys — generate, import, list, and delete keys.
• DID Management — create DIDs from your keys.