Account API

The account API lets a signed-in application manage its public keys, active sessions, and account history. Public-key discovery is also available without a session so other programs can encrypt to an active account or verify its signatures. Obtain a session through the Authentication API before calling the private account routes.

GET /auth/keys

Bearer token required. Returns public_keys for the signed-in account. An account with no keys returns an empty list.

PUT /auth/keys

Publish the public halves so other programs can verify your signatures and encrypt to you. Private keys stay on the client.

Bearer token required.

{"password":"current password","otp":"123456","public_keys":[SIGNING_JWK, ENCRYPTION_JWK]}

The current password and a fresh authenticator code are required. An empty list removes the linked keys. mesgd stores at most one key of each use.

Signing key:

• kty EC, crv P-256, use sig
• x and y are base64url coordinates

Encryption key:

• kty RSA, use enc
• n and e are base64url integers
• modulus size 2048 to 8192 bits

The response returns canonical public JWKs with key_ops verify or encrypt. These private fields are rejected: d, p, q, dp, dq, qi, oth, k.

Public keys do not authenticate the account. For an account that signs in with a password, the copy in the database is the one mesgd uses after a restart.

GET /user/<name>/keys

No Authorization header is required. <name> is one path segment and uses the same username rules. The body matches GET /auth/keys.

Unknown, pending, and inactive accounts are 404 with {"error":"not_found"}. A valid bearer token is accepted and does not change the body. Other /user paths stay behind the normal gate. .. and a name that fails the username check are 404.

GET /auth/sessions

Bearer token required. Returns sessions, each with id, created_at, expires_at, amr, provider, and current. At most eight sessions are active. Raw JWTs are not returned.

DELETE /auth/sessions/ID

End one session without ending the others. Bearer token required.

{"otp":"123456"}

mesgd revokes that session immediately.

GET /auth/history

Bearer token required. Returns history, newest first, at most 100 events: login, credential failure, logout, session refresh, link and unlink, password reset, and key or session changes. History starts with events the running mesgd records. It has no passwords, authenticator codes, recovery codes, raw tokens, or IP addresses.