curl --request POST \
--url https://aropay.aro.media/api/v1/wallets/{id}/export \
--header 'Content-Type: application/json' \
--cookie aropay_session= \
--data '
{
"passphrase": "correct-horse-battery-staple",
"password": "…"
}
'const options = {
method: 'POST',
headers: {cookie: 'aropay_session=', 'Content-Type': 'application/json'},
body: JSON.stringify({passphrase: 'correct-horse-battery-staple', password: '…'})
};
fetch('https://aropay.aro.media/api/v1/wallets/{id}/export', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://aropay.aro.media/api/v1/wallets/{id}/export"
payload = {
"passphrase": "correct-horse-battery-staple",
"password": "…"
}
headers = {
"cookie": "aropay_session=",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"ok": true,
"data": {
"filename": "payouts-key.nota",
"nota": "…passphrase-encrypted key envelope…"
}
}Export wallet key
Session-only, with step-up. Export a custodial wallet’s private
key as a passphrase-encrypted .nota envelope (PBKDF2-SHA256 with
310,000 iterations + AES-256-GCM, applied server-side; the plaintext
key never leaves the platform). The key never expires and can’t be
revoked, so the password (and a 2FA code when enabled) is re-checked
first; failures count toward the step-up password lock and the 2FA
code cap. Only custodial wallets can be exported: an unknown id
(404) or an external wallet (400 wallet_not_custodial) is refused
before the step-up, so it does not use up the code.
curl --request POST \
--url https://aropay.aro.media/api/v1/wallets/{id}/export \
--header 'Content-Type: application/json' \
--cookie aropay_session= \
--data '
{
"passphrase": "correct-horse-battery-staple",
"password": "…"
}
'const options = {
method: 'POST',
headers: {cookie: 'aropay_session=', 'Content-Type': 'application/json'},
body: JSON.stringify({passphrase: 'correct-horse-battery-staple', password: '…'})
};
fetch('https://aropay.aro.media/api/v1/wallets/{id}/export', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://aropay.aro.media/api/v1/wallets/{id}/export"
payload = {
"passphrase": "correct-horse-battery-staple",
"password": "…"
}
headers = {
"cookie": "aropay_session=",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"ok": true,
"data": {
"filename": "payouts-key.nota",
"nota": "…passphrase-encrypted key envelope…"
}
}Authorizations
Browser session cookie minted by POST /auth/login (or passkey
login). httpOnly, SameSite=Lax, 24 h TTL. Endpoints marked
Session-only accept only this credential and return
403 session_required for API keys.
Path Parameters
Wallet ID.
Body
Encrypts the exported key. Choose a long one; it cannot be recovered.
8 - 200Step-up. The account password, re-entered.
Step-up. A fresh authenticator code; required when 2FA is enabled, ignored otherwise. Single-use.
^[0-9]{6}$