# Quickstart: Device Takeover

## Prerequisites
- An authenticated user session (JWT).
- A new key pair generated by the client.

## Steps

1.  **Authenticate**:
    ```bash
    export TOKEN="<jwt_token>"
    ```

2.  **Perform Takeover**:
    Submit the new Identity Key and PreKeys to `POST /keys`.

    ```bash
    curl -X POST http://localhost:3000/keys \
      -H "Authorization: Bearer $TOKEN" \
      -H "Content-Type: application/json" \
      -d '{
        "identityKey": "<base64_new_identity_key>",
        "registrationId": 12345,
        "signedPreKey": {
            "keyId": 1,
            "publicKey": "<base64_spk>",
            "signature": "<base64_sig>"
        },
        "oneTimePreKeys": [
            { "keyId": 1, "publicKey": "<base64_otpk_1>" },
            { "keyId": 2, "publicKey": "<base64_otpk_2>" }
        ]
      }'
    ```

3.  **Verify**:
    -   The server responds with `200 OK`.
    -   Previous WebSocket connections are disconnected.
    -   Old pending messages are deleted.

