# Create keys URL: https://docs.hanzo.ai/docs/openapi/wallet/post-wallet-by-id-keys > Rolls one wallet's signing material through its own custody backend and answers the wallet with whatever address that produced. `POST /v1/wallet/{id}/keys` > [Wallet →](https://docs.hanzo.ai/docs/openapi/wallet) · [All API references →](https://docs.hanzo.ai/docs/openapi) · [Get started →](https://docs.hanzo.ai/docs/guides) | | | | ------------- | ------------------------------------------ | | **Address** | `https://api.hanzo.ai/v1/wallet/{id}/keys` | | **Method** | `POST` | | **Operation** | `post_wallet_by_id_keys` | | **Auth** | `Authorization: Bearer $HANZO_API_KEY` | Rolls one wallet's signing material through its own custody backend and answers the wallet with whatever address that produced. For KMS custody a fresh secp256k1 key is generated and sealed, which CHANGES the address — funds and approvals at the old address do not move. For a Safe the address is counterfactual and the owner shares are ring-managed, so rotation is a no-op and the address is unchanged. A backend that is not configured fails closed with 503 rather than leaving the wallet half-rotated. ## Request 1 field. | Field | In | Type | Required | Description | | ----- | ---- | ------ | -------- | ----------- | | `id` | path | string | yes | | ## Response | Status | Body | Meaning | | --------- | --------------- | ------- | | `200` | wallet.Wallet | ok | | `default` | problem-details | refused | `200` body — 12 fields. | Field | In | Type | Always | Description | | ---------------- | ---- | --------------- | ------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `accountId` | body | string | — | | | `address` | body | string | — | Address is the on-chain address. | | `agent` | body | string | — | | | `chain` | body | string | — | Chain is the EVM chain the wallet is bound to, CAIP-2 "eip155:\" or a bare decimal chain id. | | `createdAt` | body | integer (int64) | — | CreatedAt is when the wallet was provisioned, Unix seconds. | | `custody` | body | string | — | Custody is the backend holding the signing material, fixed at creation: "kms" (a secp256k1 key sealed under KMS and opened in-process), "mpc" or "treasury" (an m-of-n threshold key on the deployed ring, which differ by governance and not by signing mechanics), or "safe" (a Safe contract owned by an MPC key). | | `financeAccount` | body | string | — | FinanceAccount is the finance ledger account bound to this wallet — the lookup that turns a ledger account back into an on-chain signer. | | `id` | body | string | — | ID is the wallet id, minted by the server as "wal\_" + 24 hex. | | `name` | body | string | — | Name is the display label given at creation. | | `org` | body | string | — | | | `project` | body | string | — | | | `tier` | body | string | — | Tier is the wallet tier the ring keys its TierPolicy on: hot, warm, cold, gas, bridge, contract\_admin, validator, quarantine or disaster\_recovery. | Failure carries the platform error shape — see [Errors](https://docs.hanzo.ai/docs/errors). ## Examples **CLI** ```bash hanzo wallet keys ``` **SDK** **.ts** ```ts import { Configuration, WalletApi } from 'hanzoai'; const api = new WalletApi(new Configuration({ accessToken: process.env.HANZO_API_KEY })); const { data } = await api.postWalletByIdKeys({ id: 'id' }); ``` **.py** ```python from hanzoai.cloud import ApiClient, Configuration from hanzoai.cloud.api import WalletApi client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"])) result = WalletApi(client).post_wallet_by_id_keys(id='id') ``` **.go** ```go cfg := hanzoai.NewConfiguration() cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY")) client := hanzoai.NewAPIClient(cfg) resp, _, err := client.WalletAPI.PostWalletByIdKeys(context.Background()).Execute() if err != nil { return err } ``` **.rs** ```rust use hanzo_client::apis::{configuration::Configuration, wallet_api}; let mut cfg = Configuration::new(); cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok(); let result = wallet_api::post_wallet_by_id_keys(&cfg, Default::default()).await?; ``` **.java** ```java import ai.hanzo.cloud.ApiClient; import ai.hanzo.cloud.api.WalletApi; ApiClient client = new ApiClient(); client.setBearerToken(System.getenv("HANZO_API_KEY")); var result = new WalletApi(client).postWalletByIdKeys(); ``` **HTTP** ```bash curl -X POST https://api.hanzo.ai/v1/wallet//keys \ -H "Authorization: Bearer $HANZO_API_KEY" ``` **MCP** MCP reaches **wallet** through the `wallet` tool, which names its 7 operations with its own verbs — this one among them, under a name only MCP declares. `describe` explains any of them: ```bash curl -X POST https://api.hanzo.ai/v1/mcp \ -H "Content-Type: application/json" \ -d '{ "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "describe", "arguments": { "op": "list_wallets" } } }' ``` --- [Wallet API](https://docs.hanzo.ai/docs/openapi/wallet) · [All Hanzo APIs](https://docs.hanzo.ai/docs/openapi) · [Interactive reference](https://docs.hanzo.ai/docs/openapi/reference)