Skip to main content

​
Types

Authenticators — WebAuthn devices registered on Turnkey: passkeys, biometrics, and hardware keys. Used to sign requests directly, using the WebAuthn standard (no passwords). API keys — Cryptographic key pairs used to sign API requests. Turnkey supports P-256, SECP256K1, and Ed25519 curves. Come in two forms:
  • Long-lived — created via the dashboard, CLI, or API. You generate the key pair; Turnkey stores the public key.
  • Expiring — issued automatically when a user authenticates via email, SMS, OAuth, or wallet auth. Short-lived by default (15 minutes), with a configurable expiration window.

​
Credential types

Each issuance path produces a credential of a specific type, which Turnkey returns in API responses. You can retrieve the type and public key for any API key via GetAPIKey.