> ## Documentation Index
> Fetch the complete documentation index at: https://docs.turnkey.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Turnkey is wallet infrastructure: create and manage crypto wallets, sign transactions, and enforce policy-based access controls. Best-fit uses: embedded consumer wallets (email/passkey/social auth, no seed phrases), automated onchain operations with server-side wallets, AI agent wallets with policy-scoped signing, enterprise key management, and verifiable off-chain workloads on Turnkey Verifiable Cloud (TVC).
> Every API call is a JSON POST to https://api.turnkey.com signed with a P-256 API key; create an organization and key self-serve at https://app.turnkey.com.
> Key Turnkey developer resources: API reference (https://docs.turnkey.com/api-reference/overview/intro.md), OpenAPI spec (https://docs.turnkey.com/public_api.swagger.json), authentication (https://docs.turnkey.com/features/authentication/overview.md), webhooks (https://docs.turnkey.com/features/webhooks/overview.md), MCP server for docs search (https://docs.turnkey.com/mcp), skill for building with Turnkey (https://docs.turnkey.com/skill.md), agent skills for operating an organization (https://docs.turnkey.com/get-started/ai-skills.md), CLI (https://docs.turnkey.com/sdks/cli.md), SDK reference (https://docs.turnkey.com/sdks/introduction.md), full docs content (https://docs.turnkey.com/llms-full.txt).

# Mint JWT

> Mint a Turnkey-signed JWT with a given profile. JWT semantics switch on profile.

POST

/

public

/

v1

/

submit

/

mint\_jwt

Activity requests must meet the [signed-request validity window](https://docs.turnkey.com/api-reference/activities/overview.md#signed-request-validity) for `timestampMs` and the applicable [rate limits](https://docs.turnkey.com/reference/rate-limits.md).

### Authorizations

> [tab] API Key
>
> **X-Stamp** `string` *required*
>
> Cryptographically signed (stamped) request to be passed in as a header. For more info, see [here](https://docs.turnkey.com/developer-reference/api-overview/stamps.md).

> [tab] WebAuthn (Passkey)
>
> **X-Stamp-WebAuthn** `string` *required*
>
> Cryptographically signed (stamped) request to be passed in as a header. For more info, see [here](https://docs.turnkey.com/developer-reference/api-overview/stamps.md).

### Body

**type** `enum\<string\>` *required*

Enum options: `ACTIVITY_TYPE_MINT_JWT`

**timestampMs** `string` *required*

Timestamp (in milliseconds) of the request, used to verify liveness of user requests.

**organizationId** `string` *required*

Unique identifier for a given Organization.

**parameters** `object` *required*

The parameters object containing the specific intent data for this activity.

**details**

Navigate to header

parameters.
profile

enum\<string>

required

Enum options: `JWT_PROFILE_HTTP_AUTHZ_V1`

Navigate to header

parameters.
audience

string

required

Origin of the receiving service, as `https://<lowercase host>[:port]` with no default port, path, query, or fragment. At most 256 characters. Becomes the `aud` claim.

**parameters.httpAuthzV1** `object`

httpAuthzV1 field

**details**

Navigate to header

parameters.httpAuthzV1.
method

string

required

HTTP method of the bound request. One of `GET`, `HEAD`, `POST`, `PUT`, `PATCH`, or `DELETE`.

Navigate to header

parameters.httpAuthzV1.
path

string

required

Path of the bound request, starting with `/`.

Navigate to header

parameters.httpAuthzV1.
query

string

Query of the bound request without the leading `?`, or empty for no query.

**parameters.httpAuthzV1.headerNames** `array`

Lowercase names of the bound request headers, in order. At most 32 unique names of at most 64 characters each. Cannot include `authorization` or hop-by-hop headers (`proxy-authorization`, `connection`, `keep-alive`, `proxy-connection`, `te`, `transfer-encoding`, `upgrade`).

**item details**

Array item type: `string`item field

**parameters.httpAuthzV1.headerDigest** `array`

SHA-256 digest of each bound header value, as `sha-256=:<base64>:`. One entry per entry in `header_names`.

**item details**

Array item type: `string`item field

Navigate to header

parameters.httpAuthzV1.
bodyDigest

string

required

SHA-256 digest of the bound request body, as `sha-256=:<base64>:`. For a request with no body, the digest of empty content.

Navigate to header

parameters.httpAuthzV1.
subject

string

required

ID of a user in the organization, as a lowercase UUID. Becomes the `sub` claim.

Navigate to header

parameters.httpAuthzV1.
timeToLiveSeconds

string

required

Lifetime of the JWT in seconds, from 1 to 300. `exp` is `issued_at + time_to_live_seconds`.

Navigate to header

parameters.httpAuthzV1.
issuedAt

string

required

Unix time in seconds. Becomes the `iat` claim.

### Response

A successful response returns the following fields:

**activity** `object` *required*

The activity object containing type, intent, and result

**activity details**

Navigate to header

activity.
id

string

required

Unique identifier for a given Activity object.

Navigate to header

activity.
organizationId

string

required

Unique identifier for a given Organization.

Navigate to header

activity.
status

string

required

The activity status

Navigate to header

activity.
type

string

required

The activity type

Navigate to header

activity.
intent

object

required

The intent of the activity

**intent details**

Navigate to header

activity.intent.
mintJwtIntent

object

required

The mintJwtIntent object

**mintJwtIntent details**

Navigate to header

activity.intent.mintJwtIntent.
profile

enum

required

profile field

Enum options: `JWT_PROFILE_HTTP_AUTHZ_V1`

Navigate to header

activity.intent.mintJwtIntent.
audience

string

required

Origin of the receiving service, as `https://<lowercase host>[:port]` with no default port, path, query, or fragment. At most 256 characters. Becomes the `aud` claim.

Navigate to header

activity.intent.mintJwtIntent.
httpAuthzV1

object

httpAuthzV1 field

**httpAuthzV1 details**

Navigate to header

activity.intent.mintJwtIntent.httpAuthzV1.
method

string

required

HTTP method of the bound request. One of `GET`, `HEAD`, `POST`, `PUT`, `PATCH`, or `DELETE`.

Navigate to header

activity.intent.mintJwtIntent.httpAuthzV1.
path

string

required

Path of the bound request, starting with `/`.

Navigate to header

activity.intent.mintJwtIntent.httpAuthzV1.
query

string

Query of the bound request without the leading `?`, or empty for no query.

Navigate to header

activity.intent.mintJwtIntent.httpAuthzV1.
headerNames

array

Lowercase names of the bound request headers, in order. At most 32 unique names of at most 64 characters each. Cannot include `authorization` or hop-by-hop headers (`proxy-authorization`, `connection`, `keep-alive`, `proxy-connection`, `te`, `transfer-encoding`, `upgrade`).

**headerNames details**

Navigate to header

activity.intent.mintJwtIntent.httpAuthzV1.headerNames.
item

string

required

item field

Navigate to header

activity.intent.mintJwtIntent.httpAuthzV1.
headerDigest

array

SHA-256 digest of each bound header value, as `sha-256=:<base64>:`. One entry per entry in `header_names`.

**headerDigest details**

Navigate to header

activity.intent.mintJwtIntent.httpAuthzV1.headerDigest.
item

string

required

item field

Navigate to header

activity.intent.mintJwtIntent.httpAuthzV1.
bodyDigest

string

required

SHA-256 digest of the bound request body, as `sha-256=:<base64>:`. For a request with no body, the digest of empty content.

Navigate to header

activity.intent.mintJwtIntent.httpAuthzV1.
subject

string

required

ID of a user in the organization, as a lowercase UUID. Becomes the `sub` claim.

Navigate to header

activity.intent.mintJwtIntent.httpAuthzV1.
timeToLiveSeconds

string

required

Lifetime of the JWT in seconds, from 1 to 300. `exp` is `issued_at + time_to_live_seconds`.

Navigate to header

activity.intent.mintJwtIntent.httpAuthzV1.
issuedAt

string

required

Unix time in seconds. Becomes the `iat` claim.

Navigate to header

activity.
result

object

required

The result of the activity

**result details**

Navigate to header

activity.result.
mintJwtResult

object

required

The mintJwtResult object

**mintJwtResult details**

Navigate to header

activity.result.mintJwtResult.
jwt

string

required

Signed JWT in JWS compact serialization.

Navigate to header

activity.result.mintJwtResult.
signingKeyJwk

string

required

Public JWK of the key that signed the JWT. Verifiers should pin this key or fetch it from the issuer's JWKS, not trust it from this response.

Navigate to header

activity.
votes

array

required

A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata.

Navigate to header

activity.
fingerprint

string

required

An artifact verifying a User's action.

Navigate to header

activity.
canApprove

boolean

required

Whether the activity can be approved.

Navigate to header

activity.
canReject

boolean

required

Whether the activity can be rejected.

Navigate to header

activity.
createdAt

string

required

The creation timestamp.

Navigate to header

activity.
updatedAt

string

required

The last update timestamp.

```bash title="cURL" theme={"system"}
curl --request POST \
  --url https://api.turnkey.com/public/v1/submit/mint_jwt \
  --header 'Accept: application/json' \
  --header 'Content-Type: application/json' \
  --header "X-Stamp: <string> (see Authorizations)" \
  --data '{
    "type": "ACTIVITY_TYPE_MINT_JWT",
    "timestampMs": "<string> (e.g. 1746736509954)",
    "organizationId": "<string> (Your Organization ID)",
    "parameters": {
        "profile": "<JWT_PROFILE_HTTP_AUTHZ_V1>",
        "audience": "<string>",
        "httpAuthzV1": {
            "method": "<string>",
            "path": "<string>",
            "query": "<string>",
            "headerNames": [
                "<string>"
            ],
            "headerDigest": [
                "<string>"
            ],
            "bodyDigest": "<string>",
            "subject": "<string>",
            "timeToLiveSeconds": "<string>",
            "issuedAt": "<string>"
        }
    }
}'
```

```javascript title="JavaScript" theme={"system"}
import { Turnkey } from "@turnkey/sdk-server";

const turnkeyClient = new Turnkey({
  apiBaseUrl: "https://api.turnkey.com",
  apiPublicKey: process.env.API_PUBLIC_KEY!,
  apiPrivateKey: process.env.API_PRIVATE_KEY!,
  defaultOrganizationId: process.env.ORGANIZATION_ID!,
});

const response = await turnkeyClient.apiClient().mintJwt({
  profile: "<JWT_PROFILE_HTTP_AUTHZ_V1>" // profile field,
  audience: "<string> (Origin of the receiving service, as `https://<lowercase host>[:port]` with no default port, path, query, or fragment. At most 256 characters. Becomes the `aud` claim.)",
  httpAuthzV1: { // httpAuthzV1 field,
    method: "<string> (HTTP method of the bound request. One of `GET`, `HEAD`, `POST`, `PUT`, `PATCH`, or `DELETE`.)",
    path: "<string> (Path of the bound request, starting with `/`.)",
    query: "<string> (Query of the bound request without the leading `?`, or empty for no query.)",
    headerNames: ["<string>"] // Lowercase names of the bound request headers, in order. At most 32 unique names of at most 64 characters each. Cannot include `authorization` or hop-by-hop headers (`proxy-authorization`, `connection`, `keep-alive`, `proxy-connection`, `te`, `transfer-encoding`, `upgrade`).,
    headerDigest: ["<string>"] // SHA-256 digest of each bound header value, as `sha-256=:<base64>:`. One entry per entry in `header_names`.,
    bodyDigest: "<string> (SHA-256 digest of the bound request body, as `sha-256=:<base64>:`. For a request with no body, the digest of empty content.)",
    subject: "<string> (ID of a user in the organization, as a lowercase UUID. Becomes the `sub` claim.)",
    timeToLiveSeconds: "<string> (Lifetime of the JWT in seconds, from 1 to 300. `exp` is `issued_at + time_to_live_seconds`.)",
    issuedAt: "<string> (Unix time in seconds. Becomes the `iat` claim.)",
  }
});
```

```json 200 theme={"system"}
{
  "activity": {
    "id": "<activity-id>",
    "status": "ACTIVITY_STATUS_COMPLETED",
    "type": "ACTIVITY_TYPE_MINT_JWT",
    "organizationId": "<organization-id>",
    "timestampMs": "<timestamp> (e.g. 1746736509954)",
    "result": {
      "activity": {
        "id": "<string>",
        "organizationId": "<string>",
        "status": "<string>",
        "type": "<string>",
        "intent": {
          "mintJwtIntent": {
            "profile": "<JWT_PROFILE_HTTP_AUTHZ_V1>",
            "audience": "<string>",
            "httpAuthzV1": {
              "method": "<string>",
              "path": "<string>",
              "query": "<string>",
              "headerNames": [
                "<string>"
              ],
              "headerDigest": [
                "<string>"
              ],
              "bodyDigest": "<string>",
              "subject": "<string>",
              "timeToLiveSeconds": "<string>",
              "issuedAt": "<string>"
            }
          }
        },
        "result": {
          "mintJwtResult": {
            "jwt": "<string>",
            "signingKeyJwk": "<string>"
          }
        },
        "votes": "<array>",
        "fingerprint": "<string>",
        "canApprove": "<boolean>",
        "canReject": "<boolean>",
        "createdAt": "<string>",
        "updatedAt": "<string>"
      }
    }
  }
}
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.