---
title: "Register Subkey"
method: POST
path: "/account/keys/subkeys"
tags: ["Subkey"]
---

# Register Subkey

`POST /account/keys/subkeys`

Register a new subkey for the authenticated account.

## Request body

- RequestsCreateSubkey
  - `allowed_cidrs` string[] — Optional IP CIDR allowlist applied atomically at creation, so the subkey is never live unrestricted. Empty/omitted = unrestricted. Max 50 entries; same format as PUT .../allowed-cidrs (e.g. "203.0.113.0/24"). Not covered by the registration signature: the list is mutable post-creation via the JWT-only allowed-cidrs endpoint, so signing it would add no protection.
  - `encrypted_key` string — Encrypted private key (required if state=pending).
  - `eph_public_key` string — Ephemeral public key for signature verification (required if state=pending).
  - `evm_signature` string — EVM (EIP-191) registration signature, used in place of `signature` / `signature_timestamp` / `signature_expiry` when the account's main key is a secp256k1 key (AccountSignerType == EIP191). The server reconstructs nothing — the raw SIWE message presented to the user is supplied verbatim in `siwe_message` and the personal_sign signature in `evm_signature`. The SIWE message's Statement must equal "Paradex Subkey Registration: 0x<new_subkey_pubkey>" (lowercased pubkey); that line is what binds the authorisation to the specific subkey being registered.
  - `name` string, required — User-friendly name for the subkey.
  - `public_key` string, required — Public key to be registered as a subkey.
  - `signature` string[] — Signature from the account's main StarkNet private key over pedersen_array(account, public_key, signature_timestamp, signature_expiry). Required when the server enforces main-key authorization on subkey registration (feature flag EnableSubkeyRegistrationSignature). Format: [r, s].
  - `signature_expiry` integer — Unix seconds; included in signed message and bounds replay window.
  - `signature_timestamp` integer — Unix seconds; included in signed message.
  - `siwe_message` string
  - `state` string — State of the subkey: 'active' or 'pending'. Defaults to 'active'.

## Response `201`

An empty response

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — IP restrictions not enabled for this account

---

[API](https://skmtc.net/tradeparadex/apis/paradex-rest-api-2.md) · [All operations](https://skmtc.net/tradeparadex/apis/paradex-rest-api-2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/tradeparadex/paradex-rest-api-2/versions/6a76453d754c/schema)