# Signer public key

`GET https://api.rarebl.com/open/tx/signer-key`

The X25519 public key you encrypt private keys to when you use hosted signing. Only the signer process can read what you encrypt to it.

**Rate class:** read (5 requests per second, burst 20, per IP). **Available since:** Open API v2.

## Request

Send the parameters as query parameters (GET) or as a JSON object (POST with `Content-Type: application/json`). They are identical either way. No API key is needed: `X-API-KEY` is reserved and ignored.

Example: `curl "https://api.rarebl.com/open/tx/signer-key"`

## Parameters

This endpoint takes no parameters.

## Responses

### API200 (HTTP 200): OK

The current signer key.

```json
{
  "status": 1,
  "code": "API200",
  "message": "success",
  "data": {
    "kid": "k20261115-defd9c",
    "alg": "X25519",
    "publicKey": "wL-KbhcrI3WWpG1nv8sNAoiWUVTyw9yMxfn1_jvoxT4",
    "expiresAt": "2026-12-15T00:12:34.514Z"
  },
  "go": null,
  "meta": {
    "requestid": "0123456789abcdef",
    "notices": []
  }
}
```

| Field | Type | Description |
| --- | --- | --- |
| `data.kid` | string | The key id. Put it in the envelope (`kid`). |
| `data.alg` | string | `X25519`. |
| `data.publicKey` | string | base64url, 32 bytes. |
| `data.expiresAt` | string | ISO 8601. Keys rotate; the previous `kid` stays valid for 7 days, and a key is refused 7 days after its `expiresAt`. |

### API429 (HTTP 429): Too Many Requests

Rate limited (read class: 5 requests per second, burst 20, per IP). A `Retry-After` header says how long to wait, in seconds.

```json
{
  "status": 0,
  "code": "API429",
  "message": "Too many requests. Please retry shortly.",
  "data": null,
  "go": null,
  "meta": {
    "requestid": "0123456789abcdef",
    "notices": []
  }
}
```

### API502 (HTTP 502): Bad Gateway

The node is unavailable, still syncing or timed out. Retry later with a short back-off.

```json
{
  "status": 0,
  "code": "API502",
  "message": "The node is unavailable or timed out. Please try again.",
  "data": null,
  "go": null,
  "meta": {
    "requestid": "0123456789abcdef",
    "notices": []
  }
}
```

## Notes

- Only needed for [hosted signing](https://docs.rarebl.com/guides/hosted-signing). The SDKs fetch it and build the envelope for you: pass the whole `data` object (`{kid, publicKey}`) to `envelope.encrypt`.
- Keys rotate. The previous `kid` stays valid for 7 days after its successor was created, and the current key is refused 7 days after `expiresAt` (the reply is an error once it is overdue). Fetch a fresh key rather than hard-coding one, and fetch it again when tx/sign or tx/send answers `bad_envelope` or an unknown `kid`.
- Read class: 5 requests per second, burst 20.