Skip to main content

​
Types

Authenticators — WebAuthn devices registered on Turnkey: passkeys, biometrics, and hardware keys. Used to sign requests directly, using the WebAuthn standard (no passwords). API keys — Cryptographic key pairs used to sign API requests. Turnkey supports P-256, SECP256K1, and Ed25519 curves. Come in two forms:
  • Long-lived — created via the dashboard, CLI, or API. You generate the key pair; Turnkey stores the public key.
  • Expiring — issued automatically when a user authenticates via email, SMS, OAuth, or wallet auth. Short-lived by default (15 minutes), with a configurable expiration window.

​
API keys and wallet keys

An API key authenticates requests to Turnkey; it is not the wallet private key that holds your crypto assets. Its authority depends on the user it belongs to, the root quorum, and your policies. You can revoke an API key without changing the wallet keys it was authorized to use. Turnkey stores only your API public key. Generate the key pair where you will use it and keep the private key there: Turnkey can verify requests without receiving the secret, and you avoid transporting a private key from another system. Each request signs the complete POST body so the signature authorizes that specific action. See Stamps. API-key stamps must be produced by a key pair whose public key is registered as an API key. Supported API-key curves are P-256, secp256k1, and Ed25519. Wallet private keys that Turnkey manages are not API-key credentials and cannot be used for stamping. You can register an external wallet’s public key as an API key (see WalletStamper), but generate a dedicated key pair for programmatic access instead. Reusing a wallet key couples access to Turnkey with control of that wallet and increases the impact of a compromised key.

​
Lost or compromised API keys

Losing an API key does not delete your wallets or their private keys. If you still have another authorized credential, use it to revoke the missing key in the dashboard or with Delete API keys. A compromised key can authorize whatever its user’s permissions allow, including signing or moving funds if the user has that authority. A non-root user’s key can only perform actions a policy explicitly allows. A root user’s key can perform any action allowed by the root quorum, subject to that quorum’s approval threshold, so do not assume a key is unable to move funds. If it was your only usable credential, you can lose access to the wallets even though the wallet keys still exist. Plan for backup and recovery before a credential is lost; Turnkey cannot restore your credentials for you.

​
Rotate API keys

Keep an independently secured backup credential with sufficient authority to manage credentials. For example, when creating a sub-organization, you can give its root user one API key for routine use and a second key stored securely for recovery. Prefer a standard user with limited permissions for routine operations when your integration permits it. For a planned rotation:
  1. Create a new API key for the intended user.
  2. Update your integration and verify that the new key can perform the required actions.
  3. Delete the old API key using an authorized credential.
If a key is compromised, revoke it promptly using the backup credential. If the same public key is registered in multiple sub-organizations, remove it from each affected sub-organization with ACTIVITY_TYPE_DELETE_API_KEYS. Each removal must meet that sub-organization’s authorization requirements. Contact Support for guidance on your integration.

​
Credential types

Each issuance path produces a credential of a specific type, which Turnkey returns in API responses. You can retrieve the type and public key for any API key via GetAPIKey.