> ## Documentation Index
> Fetch the complete documentation index at: https://docs.turnkey.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Turnkey is wallet infrastructure: create and manage crypto wallets, sign transactions, and enforce policy-based access controls. Best-fit uses: embedded consumer wallets (email/passkey/social auth, no seed phrases), automated onchain operations with server-side wallets, AI agent wallets with policy-scoped signing, enterprise key management, and verifiable off-chain workloads on Turnkey Verifiable Cloud (TVC).
> Every API call is a JSON POST to https://api.turnkey.com signed with a P-256 API key; create an organization and key self-serve at https://app.turnkey.com.
> Key Turnkey developer resources: API reference (https://docs.turnkey.com/api-reference/overview/intro.md), OpenAPI spec (https://docs.turnkey.com/public_api.swagger.json), authentication (https://docs.turnkey.com/features/authentication/overview.md), webhooks (https://docs.turnkey.com/features/webhooks/overview.md), MCP server for docs search (https://docs.turnkey.com/mcp), agent skills (https://docs.turnkey.com/get-started/ai-skills.md), CLI (https://docs.turnkey.com/sdks/cli.md), SDK reference (https://docs.turnkey.com/sdks/introduction.md), full docs content (https://docs.turnkey.com/llms-full.txt).

# Credentials

> Credentials are how users authenticate to Turnkey. Turnkey only stores public keys; private keys never leave your device.

## Types

**Authenticators** — WebAuthn devices registered on Turnkey: passkeys, biometrics, and hardware keys. Used to sign requests directly, using the [WebAuthn standard](https://www.w3.org/TR/webauthn-2/) (no passwords).

**API keys** — Cryptographic key pairs used to sign API requests. Turnkey supports P-256, SECP256K1, and Ed25519 curves. Come in two forms:

* *Long-lived* — created via the dashboard, CLI, or [API](/api-reference/activities/create-api-keys). You generate the key pair; Turnkey stores the public key.
* *Expiring* — issued automatically when a user authenticates via email, SMS, OAuth, or wallet auth. Short-lived by default (15 minutes), with a configurable expiration window.

## API keys and wallet keys

An API key authenticates requests to Turnkey; it is not the wallet private key that
holds your crypto assets. Its authority depends on the user it belongs to, the
[root quorum](/features/users/root-quorum), and your [policies](/features/policies/overview).
You can revoke an API key without changing the wallet keys it was authorized to use.

Turnkey stores only your API public key. Generate the key pair where you will use
it and keep the private key there: Turnkey can verify requests without receiving
the secret, and you avoid transporting a private key from another system. Each
request signs the complete POST body so the signature authorizes that specific
action. See [Stamps](/api-reference/overview/stamps#why-sign-the-entire-request).

API-key stamps must be produced by a key pair whose public key is registered as
an API key. Supported API-key curves are P-256, secp256k1, and Ed25519. Wallet
private keys that Turnkey manages are not API-key credentials and cannot be used
for stamping. You can register an external wallet's public key as an API key
(see [WalletStamper](/sdks/advanced/wallet-stamper)), but generate a dedicated
key pair for programmatic access instead. Reusing a wallet key couples access to
Turnkey with control of that wallet and increases the impact of a compromised key.

### Lost or compromised API keys

Losing an API key does not delete your wallets or their private keys. If you still
have another authorized credential, use it to revoke the missing key in the
dashboard or with [Delete API keys](/api-reference/activities/delete-api-keys).
A compromised key can authorize whatever its user's permissions allow, including
signing or moving funds if the user has that authority. A non-root user's key can
only perform actions a policy explicitly allows. A root user's key can perform any
action allowed by the [root quorum](/features/users/root-quorum), subject to that
quorum's approval threshold, so do not assume a key is unable to move funds.

If it was your only usable credential, you can lose access to the wallets even
though the wallet keys still exist. Plan for [backup and recovery](/get-started/backup-recovery)
before a credential is lost; Turnkey cannot restore your credentials for you.

### Rotate API keys

Keep an independently secured backup credential with sufficient authority to
manage credentials. For example, when creating a sub-organization, you can give
its root user one API key for routine use and a second key stored securely for
recovery. Prefer a [standard user with limited permissions](/features/users/best-practices)
for routine operations when your integration permits it.

For a planned rotation:

1. [Create a new API key](/api-reference/activities/create-api-keys) for the intended user.
2. Update your integration and verify that the new key can perform the required actions.
3. [Delete the old API key](/api-reference/activities/delete-api-keys) using an authorized credential.

If a key is compromised, revoke it promptly using the backup credential. If the
same public key is registered in multiple sub-organizations, remove it from each
affected sub-organization with `ACTIVITY_TYPE_DELETE_API_KEYS`. Each removal must
meet that sub-organization's authorization requirements. Contact [Support](/solutions/support/overview)
for guidance on your integration.

## Credential types

Each issuance path produces a credential of a specific type, which Turnkey returns in API responses. You can retrieve the type and public key for any API key via [GetAPIKey](/api-reference/queries/get-api-key).

| Credential type | Issued by |
| - | - |
| `CREDENTIAL_TYPE_WEBAUTHN_AUTHENTICATOR` | [Passkeys](/features/authentication/passkeys/introduction) |
| `CREDENTIAL_TYPE_API_KEY_P256` | [Manually created API keys](/api-reference/activities/create-api-keys) |
| `CREDENTIAL_TYPE_OTP_AUTH_KEY_P256` | [Email OTP](/features/authentication/email) or [SMS](/features/authentication/sms) auth |
| `CREDENTIAL_TYPE_EMAIL_AUTH_KEY_P256` | [Email auth — credential bundle method](/features/authentication/email) (legacy) |
| `CREDENTIAL_TYPE_RECOVER_USER_KEY_P256` | [Email recovery](/features/authentication/email) (legacy) |
| `CREDENTIAL_TYPE_OAUTH_KEY_P256` | [Social logins](/features/authentication/social-logins) |
| `CREDENTIAL_TYPE_API_KEY_SECP256K1` | [Wallet auth — Ethereum/SECP256K1](/solutions/embedded-wallets/integration-guide/react/using-external-wallets/overview) |
| `CREDENTIAL_TYPE_API_KEY_ED25519` | [Wallet auth — Solana/ED25519](/solutions/embedded-wallets/integration-guide/react/using-external-wallets/overview) |
| `CREDENTIAL_TYPE_READ_WRITE_SESSION_KEY_P256` | [Read-write sessions](/api-reference/activities/create-read-write-session) |
| `CREDENTIAL_TYPE_LOGIN` | [IndexedDB auth](/sdks/advanced/indexed-db-stamper) — OTP, passkey, or OAuth |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.