---
title: "Overview"
description: "How keys work in the Wallet API v2 — generating, importing, and the default key."
stack: "Community Stack (open source) — version 1.1.1"
stack_version: "1.1.1"
stack_comparison: https://docs.walt.id/community-vs-enterprise.md
canonical_url: https://docs.walt.id/community-stack/wallet2/key-management/overview
generated: 2026-10-01
---
# Key Management

Every credential a wallet holds is bound to a cryptographic **key**. The wallet signs proofs of possession (when receiving) and presentations (when presenting) with a key from its key store. This section covers generating, importing, and managing those keys.

## The Key Model

- A wallet can have more than one key when using **key stores** (see [Managing Wallets](https://docs.walt.id/community-stack/wallet2/wallets.md)).
- Each key has a **key ID** (derived from the key itself) and a **key type** (`Ed25519`, `secp256r1`, `secp256k1`, `secp384r1`, `secp521r1`, `RSA`, `RSA3072`, or `RSA4096`).
- Keys are added by **generating** a new one or **importing** existing key material.

## Default Key

Many endpoints — receiving, presenting, DID creation — accept an optional `keyId`. When you omit it, the wallet uses its **default key**.

By default, the wallet uses the first key across its key stores, then falls back to the `staticKey` for a [store-less wallet](https://docs.walt.id/community-stack/wallet2/wallets.md#store-less-wallets). You can override that choice with [Set the Default Key](https://docs.walt.id/community-stack/wallet2/key-management/local.md#set-the-default-key). After a default is set, receiving and presenting flows use that key unless a request passes `keyId`.

To control which key is used:

- set a default key with `PUT /wallet/{walletId}/keys/{keyId}/set-default`,
- pass `keyId` explicitly on each call, or
- use a store-less wallet with a single `staticKey`.

## Generate vs Import

- **[Generate](https://docs.walt.id/community-stack/wallet2/key-management/local.md)** — the wallet creates a new key of the type you choose.
- **[Import](https://docs.walt.id/community-stack/wallet2/key-management/local.md)** — you supply existing key material (a JWK) and the wallet stores it.

**Note:**

Keys are currently **local only** (JWKs stored in memory or in the chosen database if persistence is enabled). Support for external KMS backends (AWS KMS, Azure Key Vault, HashiCorp Vault, OCI Vault) is planned.

## Next Steps

- [Local Keys](https://docs.walt.id/community-stack/wallet2/key-management/local.md) — generate, import, list, and delete keys.
- [DID Management](https://docs.walt.id/community-stack/wallet2/did-management.md) — create DIDs from your keys.