Turnkey Verifiable Cloud quickstart

Prerequisites

This guide assumes you’ve been enabled for Turnkey Verifiable Cloud, and you’ve completed the steps to create an account and an organization as described in the account setup section.

Installation

Install the TVC CLI from crates.io (tvc crate):

cargo install tvc

Create your first verifiable app

With your new organization ID ready, login through the CLI.

tvc login

You will be asked to paste in your organization ID, and prompted to add a new generated API key to your organization. When adding it in the dashboard’s Create API Key modal, click Advanced Settings, then Generate API key via CLI, and paste in the public key printed by tvc login. See Create an API key for the full walkthrough.

This step generates an operator P256 keypair locally for you. It is stored in ~/.config/turnkey/orgs/<name>/operator.json. The public key will be used in the following steps.

Once you’re logged in, choose how you’d like to create your app and deployment. The Dashboard and CLI paths perform the same actions — pick whichever you prefer and follow it end to end.

Dashboard
CLI

Create a new TVC app

Visit the TVC dashboard and click on “Create app”.

A modal should appear:

Name your app something identifiable; for this demo it can be "TVC Hello World". Paste in your operator public key from the TVC CLI login step, then click “Create new TVC App” to create your app.

Create new TVC deployment

Once your app is created, click into it on the dashboard. Click on “Create deployment” to start a new deployment for your app.

This should open a modal with all your deployment settings:

If you do not have your own app, try our helloworld template:

Container Image URL: ghcr.io/tkhq/helloworld:latest@sha256:62e625fef1e82b972925afbf12fab33a42d05e7fa8233ea610176bf71c483bde
- TVC requires a single-platform linux/amd64 image digest, not a multi-platform index digest. If you are building your own image, use docker buildx imagetools inspect <image> to find the linux/amd64-specific digest.
- If you are bringing private container images, TVC supports uploading pull secrets by encrypting them to a known public key. This will be used by TVC infrastructure to access your container images. Read more about pull secrets here.
Executable Path: /tvc_app
Executable Args: --host 0.0.0.0 --port 3000. These arguments are passed to the executable on startup. Here we are telling the helloworld binary to start on port 3000
Public ingress port: 3000. This is the port that will be exposed to the outside world
Health check port: 3000. Our tvc_app binary answers healthchecks on /health on the same port (3000)
Health check type: HTTP.

Executable digest: the hash of the binary file inside the container. For our helloworld example this should be 70b36652b6d3348074b51acac9bdcb43c0f544b609401b6f060799b05eea2738. You can compute it locally with:

# Pull the container image, create a "tmp-extract" container, and extract our helloworld binary
docker create --name tmp-extract ghcr.io/tkhq/helloworld@sha256:62e625fef1e82b972925afbf12fab33a42d05e7fa8233ea610176bf71c483bde /bin/true \
      && docker cp tmp-extract:/tvc_app ./tvc_app \
      && docker rm tmp-extract

# Locally compute the digest of the binary file
sha256sum ./tvc_app
70b36652b6d3348074b51acac9bdcb43c0f544b609401b6f060799b05eea2738

This digest will be to ensure TVC is running the code you expect.

When ready, click “Deploy TVC App”!

Create a new TVC app

Create a local app template by running

tvc app init --output my-app-template.json

This step is purely local: it generates an editable JSON template for your app. Fill in the app name and manifest set name (for this demo, TVC Hello World and TVC Manifest); the CLI auto-populates your operator public key from login and a known quorum key. A completed template looks like this:

{
  "name": "TVC Hello World",
  "quorumPublicKey": "0445...936683e",
  "enableEgress": false,
  "manifestSetId": null,
  "manifestSetParams": {
    "name": "TVC Manifest",
    "threshold": 1,
    "newOperators": [
      {
        "name": "operator-1",
        "publicKey": "04...auto-populated from your login"
      }
    ],
    "existingOperatorIds": []
  },
  "shareSetId": null,
  "shareSetParams": null,
  "dangerousEnableDebugModeDeployments": false
}

The CLI automatically populates this template with a known quorum key, which is sufficient for running verifiable code but not advised for encrypting sensitive data.

dangerousEnableDebugModeDeployments defaults to false, which keeps your app secure and verifiable. See Debug mode for when and how to enable it (for development apps only).

Create your app in TVC by running

tvc app create --config-file my-app-template.json

This creates your app, and saves its quorum key and manifest settings to the Turnkey Verifiable Cloud platform. Check out your new app on the TVC dashboard.

Create new TVC deployment

Start with this local-only step, which generates a deployment template:

tvc deploy init

The generated JSON file is named by its time of creation, but you can name it anything by specifying a name after the --output flag. Open it and fill in each field:

appId is populated with the last app you created. You may edit it to be the id of any app you’ve created in the past.
qosVersion: the QOS release version to use. Currently the only supported version is v2026.2.6.

pivotContainerImageUrl: link to a public image. For this demo, feel free to use

"ghcr.io/tkhq/helloworld@sha256:c9c18f78b05d29ebfc2c60ab7143df4b0a808765a34d6a88bbf99523f473cafd"

pivotPath: location of your binary in the container. Use "/tvc_app" for the demo app.
pivotArgs: arguments passed to the binary on startup. For the helloworld demo, use ["--host", "0.0.0.0", "--port", "3000"]. Leave empty for your own app unless it requires arguments.

expectedPivotDigest: for the demo, use

"cbe01169428f144086bfaef348bbf3db70f9217628996cafd2ecb85d5f2b47a1"

dangerousDeployDebugMode: leave as false for a secure, verifiable deployment. Set to true only for a debug (development) app to view enclave logs; doing so permanently marks the deployment insecure. See Debug mode.
pivotContainerEncryptedPullSecret: your pull secret, if your container image isn’t public. Delete this field otherwise.
publicIngressPort: 3000
healthCheckPort: 3000

healthCheckType: TVC_HEALTH_CHECK_TYPE_HTTP For an arbitrary app, compute the expected digest with

docker create --name tmp-extract <container URL> /bin/true \
  && docker cp tmp-extract:/path/to/binary ./binary \
  && docker rm tmp-extract

sha256sum ./binary

Deploy to TVC by running

tvc deploy create --config-file deploy-YYYY-MM-DD.json [--pull-secret <path-to-pull-secret>.json]

On success you’ll see your deployment ID logged to console. Save the deployment ID for the approval step (you can also find it by clicking into your app on the dashboard):

Deployment created successfully!

Deployment ID: <DEPLOYMENT_UUID>
App ID: <APP_UUID>
Config: deploy-YYYY-MM-DD.json

Find the newly created deployment by clicking into your app on the TVC dashboard.

Once your deployment is created, the remaining steps are the same for both paths.

Approve deployment

By design, your deployment is not live yet. TVC requires approvals by the manifest set to fully deploy your application. Your app should be at the Approval Required stage on the dashboard:

For this demo app, your manifest set is the public key you created at login. To approve your deployment, use the TVC CLI:

tvc deploy approve \
  --deploy-id <DEPLOYMENT_UUID_FROM_CREATING_DEPLOYMENT> \
  --operator-id <OPERATOR_UUID>

You may find your operator ID by clicking into your app, then under Manifest Operators:

This command walks you through approving each section of the QOS manifest. On success you’ll see:

========================================
         MANIFEST APPROVAL
========================================

NAMESPACE
─────────────────────────────────────
  Name:       prod/tvc/<APP_UUID>
  Nonce:      <NONCE>
  Quorum Key: <QUORUM_KEY>

...

========================================
    ALL SECTIONS APPROVED
========================================

Posting approval to Turnkey...

Approval posted successfully!

Approval IDs: ["<APPROVAL_UUID>"]
Manifest ID: <MANIFEST_UUID>
Operator ID: <OPERATOR_UUID>

If you didn’t change anything during the demo, that should be the only required approval from your manifest set. In the dashboard you will see “Action Required” transition to “none”. This means everything is done on your side. You can look at the deployment details in the recap table on on the individual deployment page to know whether your deployment is coming up healthy and whether it’s receiving traffic.

Our infrastructure automatically provisions network ingress for your application. You can visit https://app-<YOUR_APP_UUID>.turnkey.cloud to interact with it. If you used our helloworld template, try visiting /time in your browser!

Only HTTP/1 applications can receive public ingress right now. See Networking and ingress for details.

Verify your deployment

Once the deployment is live, confirm it is healthy by hitting the /health endpoint. Before doing so, check the deployment details from the previous step and ensure Healthy Replicas reads 3/3. If replicas aren’t fully up yet, the endpoint may return a 404.

curl https://app-<YOUR_APP_UUID>.turnkey.cloud/health

A healthy deployment returns:

{"status":"ok"}

Development vs. production

The flow above creates a secure, verifiable app. While you’re iterating on your image, it’s often useful to see your application’s logs from inside the enclave. That’s what debug mode is for. Debug mode is development-only: a debug enclave is not verifiable (its attestation PCRs are zeroed) and its Quorum Key must be treated as public. The recommended setup is two separate apps that run the same image:

a dev app created with debug mode enabled, where you deploy, read logs, and iterate; and
your production app created with debug mode off.

Enabling debug mode permanently marks an app’s Quorum Key as insecure, so your dev and production apps must be different apps, each with its own Quorum Key. Never reuse a Quorum Key between them.

Once your image works in the dev app, deploy the same image to your production app for a secure, attested deployment. See Debug mode for the full details, security implications, and the flags to enable it.

Next steps

Once the deployment is approved, your app can serve traffic and produce App Proofs, which are cryptographic signatures that prove TVC is running the correct, expected software on a legitimate AWS Nitro Enclave. Learn more about app proofs in our documentation. If you are not yet signed up for Turnkey Verifiable Cloud, join the waitlist here!

Get started

Features

Reference

Turnkey Verifiable Cloud quickstart

Prerequisites

Installation

Create your first verifiable app

Approve deployment

Verify your deployment

Development vs. production

Next steps

​Prerequisites

​Installation

​Create your first verifiable app

​Login

​Approve deployment

​Verify your deployment

​Development vs. production

​Next steps

Prerequisites

Installation

Create your first verifiable app

Login

Approve deployment

Verify your deployment

Development vs. production

Next steps