Policy examples
Access control
Allow a specific user to create wallets
Allow users with a specific tag to create users
Require two users with a specific tag to add policies
Deny all delete actions for users with a specific tag
Allow a specific user (e.g. API-only user) to create a sub-org
Allow a specific user to perform auth type activities (full list here)
Note: The activity.resource
portion determines which activities can be performed. The activity.action
determines what types of actions can be taken upon those resources.
Allow a specific user to perform a specific activity type (full list here)
Note: Activities may be upgraded over time, and thus new versions may be introduced.
These policies will NOT be valid if an activity type is upgraded and requests are made on the new activity type.
For example, if Turnkey introduces ACTIVITY_TYPE_CREATE_READ_WRITE_SESSION_V3
(upgraded from ACTIVITY_TYPE_CREATE_READ_WRITE_SESSION_V2
)
and a request is made with the newer V3
version, this policy with not allow that user to perform ACTIVITY_TYPE_CREATE_READ_WRITE_SESSION_V3
activities.
Signing control
Allow a specific user to sign transactions with any account address within a specific wallet
Allow a specific user to sign transactions with a specific wallet account address
Allow a specific user to sign transactions with a specific private key
Ethereum (EVM)
Note: see the language section for more details.
Allow ERC-20 transfers for a specific token smart contract
Allow anyone to sign transactions for testnet (Sepolia)
Allow ETH transactions with a specific nonce range
Solana
Note: see the language section for various approaches on writing Solana policies.
Allow Solana transactions that include a transfer from one specific sender
Allow Solana transactions that include a transfer to only one specific recipient
Allow Solana transactions that have exactly one transfer, to one specific recipient
Allow Solana transactions that only use the Solana System Program
Deny all Solana transactions transferring to an undesired address
Allow Solana transactions with specific expected instruction data
Allow Solana transactions whose first instruction involves a specific address
Solana SPL token transfers — Context and Examples
Turnkey’s policy engine supports policies for SPL token transfers. Specifically, we support creating policies for the Transfer
, TransferChecked
and TransferCheckedWithFee
instructions across both the Solana Token Program and the Solana Token 2022 Program.
Some important context for using SPL token policies with Turnkey:
Token Account Addresses For context, Solana implements SPL token balances for a particular wallet address by creating a whole new account called a “token account” which has a pointer in its data field labeled “owner” that points back to the wallet address in question. So to hold a particular token in your Solana wallet, you have to have to create a new token account meant to hold that token, owned by your Solana wallet. For policies related to the receiving token address of an SPL transfer, the token address receiving the tokens will have to be used, NOT the wallet address that is the owner for the receiving token address. This is because, while both the owning wallet address and the receiving token address are specified in the transfer instruction, the owning wallet address of the recipient token address is not specified. For this we highly recommend using the convention of “associated token addresses” to set policies that, for example, allow SPL token transfers to a particular wallet address.
For further context on associated token addresses check out Solana’s documentation on it: https://spl.solana.com/associated-token-account
An example implementation of using a policy to allow transfers to the associated token address of the intended recipient wallet address can be found in our SDK examples here.
Mint Address Accessibility The mint account address of the token will only be accessible when the transaction is constructed using instructions that specify the mint address – TransferChecked
and TransferCheckedWithFee
. For transactions constructed using the simple Transfer
method, the mint account will be considered empty.
Here are some example policies for SPL transfers:
Allow a user to sign Solana transactions that include a single instruction which is an SPL token transfer from a particular sending token address
Allow a user to sign Solana transactions only if ALL of the instructions are SPL transfers TO a particular token address
Allow users with a specific tag to sign Solana transactions only if ALL of the instructions are SPL token transfers with a specific address as the owner of the sending token address
Allow a user to sign Solana transactions that include a single instruction which is an SPL token transfer where the atomic units of the transfer are less than a threshold amount
Allow a user to sign Solana transactions only if ALL of the instructions are SPL token transfers where the token mint address is a particular address
Allow a user to sign Solana transactions that includes a single instruction which is an SPL token transfer where one of the multisig signers of the owner is a particular address
Was this page helpful?