​
Introduction

After authenticating using frequently-used methods like SMS OTP, Email Authentication, or OAuth (e.g., Google), users will make requests to Turnkey with a resulting API key. Each API key includes a Credential field specifying its type and public key. This Credential type can be used to identify how the API key was issued and which specific authentication method was used.

Passkeys, known as Authenticators within the context of Turnkey, also have the same Credential field and are equally distinguished by the credential type.

​
Obtaining an API key’s credential type and public key

To obtain an API key’s credential type and public key you can use the GetAPIKey query. The API Key fields will be returned from this call and the credential type and public_key fields will be in the response. This will return an object that looks like:

{
   "apiKey": {
      "apiKeyId": "<api-key-id>",
      "apiKeyName": "<api-key-name>",
      "createdAt": {
         "nanos": "0",
         "seconds": "1752105687"
      },
      "credential": {
         "publicKey": "<api-key-public-key>",
         "type": "CREDENTIAL_TYPE_API_KEY_P256"
      },
      "updatedAt": {
         "nanos": "0",
         "seconds": "1752105687"
      }
   }
}

​
Credential Types

The table below describes all of the different credential types and what authentication methods correspond to that credential type

TypeAuthentication Method(s)
CREDENTIAL_TYPE_WEBAUTHN_AUTHENTICATORPasskey/Authenticator Authentication
CREDENTIAL_TYPE_API_KEY_P256CreateAPIKeys - curveType API_KEY_CURVE_P256
CREDENTIAL_TYPE_RECOVER_USER_KEY_P256Email Recovery
CREDENTIAL_TYPE_API_KEY_SECP256K1Used for Ethereum and SECP256K1 chainS Wallet Authentication
CREDENTIAL_TYPE_EMAIL_AUTH_KEY_P256Credential Bundle based Email Authentication
CREDENTIAL_TYPE_API_KEY_ED25519Solana and ED25519 chains Wallet Authentication
CREDENTIAL_TYPE_OTP_AUTH_KEY_P256OTP based Email or SMS Authentication
CREDENTIAL_TYPE_READ_WRITE_SESSION_KEY_P256CreateReadWriteSession
CREDENTIAL_TYPE_OAUTH_KEY_P256Social Logins
CREDENTIAL_TYPE_LOGINIndexedDB Authentication; OTP, Passkey, or OAuth