# Approve activity Source: https://docs.turnkey.com/api-reference/activities/approve-activity Approve an activity. Enum options: `ACTIVITY_TYPE_APPROVE_ACTIVITY` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

An artifact verifying a User's action. Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The approveActivityIntent object An artifact verifying a User's action. The result of the activity A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/approve_activity \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_APPROVE_ACTIVITY", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "fingerprint": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().approveActivity({ fingerprint: " (An artifact verifying a User's action.)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_APPROVE_ACTIVITY", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "approveActivityIntent": { "fingerprint": "" } }, "result": " (approved activity result, if completed)", "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Broadcast EVM transaction Source: https://docs.turnkey.com/api-reference/activities/broadcast-evm-transaction Submit a transaction intent describing an EVM transaction you would like to broadcast. Enum options: `ACTIVITY_TYPE_ETH_SEND_TRANSACTION_V2` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

A wallet or private key address to sign with. This does not support private key IDs. Enum options: `eip155:1`, `eip155:11155111`, `eip155:8453`, `eip155:84532`, `eip155:137`, `eip155:80002`, `eip155:56`, `eip155:97` Whether to sponsor this transaction via Gas Station. If false or unset, the EOA pays gas. A single call uses EIP-1559; multiple calls use EIP-7702 batch execution via Gas Station. Outer transaction nonce. Omit to auto-fetch. Maximum amount of gas for the outer transaction. Omit to auto-estimate. Maximum total fee per gas unit (base fee + priority fee) in wei. Omit to auto-estimate. Maximum priority fee (tip) per gas unit in wei. Omit to auto-estimate. Unix timestamp in seconds for EIP-712 execution deadline. Only used when sponsor=true. The gas station delegate contract nonce. Only used when sponsor=true. Omit to auto-fetch.

Ordered list of calls to execute. Must contain between 1 and 50 entries. A single entry with sponsor=false uses EIP-1559; multiple entries use EIP-7702 batch execution via Gas Station.

Recipient address as a hex string with 0x prefix. Amount of native asset to send in wei. Hex-encoded call data for contract interactions. Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The ethSendTransactionIntentV2 object A wallet or private key address to sign with. This does not support private key IDs. CAIP-2 chain ID (e.g., 'eip155:1' for Ethereum mainnet). Enum options: `eip155:1`, `eip155:11155111`, `eip155:8453`, `eip155:84532`, `eip155:137`, `eip155:80002`, `eip155:56`, `eip155:97` Whether to sponsor this transaction via Gas Station. If false or unset, the EOA pays gas. A single call uses EIP-1559; multiple calls use EIP-7702 batch execution via Gas Station. Outer transaction nonce. Omit to auto-fetch. Maximum amount of gas for the outer transaction. Omit to auto-estimate. Maximum total fee per gas unit (base fee + priority fee) in wei. Omit to auto-estimate. Maximum priority fee (tip) per gas unit in wei. Omit to auto-estimate. Unix timestamp in seconds for EIP-712 execution deadline. Only used when sponsor=true. The gas station delegate contract nonce. Only used when sponsor=true. Omit to auto-fetch. Ordered list of calls to execute. Must contain between 1 and 50 entries. A single entry with sponsor=false uses EIP-1559; multiple entries use EIP-7702 batch execution via Gas Station. Recipient address as a hex string with 0x prefix. Amount of native asset to send in wei. Hex-encoded call data for contract interactions. The result of the activity The ethSendTransactionResultV2 object The send\_transaction\_status ID associated with the transaction submission A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/eth_send_transaction \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_ETH_SEND_TRANSACTION_V2", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "from": "", "caip2": "", "sponsor": "", "nonce": "", "gasLimit": "", "maxFeePerGas": "", "maxPriorityFeePerGas": "", "deadline": "", "gasStationNonce": "", "calls": [ { "to": "", "value": "", "data": "" } ] } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().ethSendTransaction({ from: " (A wallet or private key address to sign with. This does not support private key IDs.)", caip2: "" // CAIP-2 chain ID (e.g., 'eip155:1' for Ethereum mainnet)., sponsor: true // Whether to sponsor this transaction via Gas Station. If false or unset, the EOA pays gas. A single call uses EIP-1559; multiple calls use EIP-7702 batch execution via Gas Station., nonce: " (Outer transaction nonce. Omit to auto-fetch.)", gasLimit: " (Maximum amount of gas for the outer transaction. Omit to auto-estimate.)", maxFeePerGas: " (Maximum total fee per gas unit (base fee + priority fee) in wei. Omit to auto-estimate.)", maxPriorityFeePerGas: " (Maximum priority fee (tip) per gas unit in wei. Omit to auto-estimate.)", deadline: " (Unix timestamp in seconds for EIP-712 execution deadline. Only used when sponsor=true.)", gasStationNonce: " (The gas station delegate contract nonce. Only used when sponsor=true. Omit to auto-fetch.)", calls: [{ // Ordered list of calls to execute. Must contain between 1 and 50 entries. A single entry with sponsor=false uses EIP-1559; multiple entries use EIP-7702 batch execution via Gas Station., to: " (Recipient address as a hex string with 0x prefix.)", value: " (Amount of native asset to send in wei.)", data: " (Hex-encoded call data for contract interactions.)", }] }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_ETH_SEND_TRANSACTION_V2", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "ethSendTransactionIntentV2": { "from": "", "caip2": "", "sponsor": "", "nonce": "", "gasLimit": "", "maxFeePerGas": "", "maxPriorityFeePerGas": "", "deadline": "", "gasStationNonce": "", "calls": [ { "to": "", "value": "", "data": "" } ] } }, "result": { "ethSendTransactionResultV2": { "sendTransactionStatusId": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Broadcast SVM transaction Source: https://docs.turnkey.com/api-reference/activities/broadcast-svm-transaction Submit a transaction intent describing an SVM transaction you would like to broadcast. Enum options: `ACTIVITY_TYPE_SOL_SEND_TRANSACTION` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

Base64-encoded serialized unsigned Solana transaction A wallet or private key address to sign with. This does not support private key IDs. Whether to sponsor this transaction via Gas Station. Enum options: `solana:mainnet`, `solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp`, `solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdpKuc147dw2N9d`, `solana:devnet`, `solana:EtWTRABZaYq6iMfeYKouRu166VU2xqa1`, `solana:EtWTRABZaYq6iMfeYKouRu166VU2xqa1wcaWoxPkrZBG` user-provided blockhash for replay protection / deadline control. If omitted and sponsor=true, we fetch a fresh blockhash during execution Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The solSendTransactionIntent object Base64-encoded serialized unsigned Solana transaction A wallet or private key address to sign with. This does not support private key IDs. Whether to sponsor this transaction via Gas Station. CAIP-2 chain ID (e.g., 'solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp' for Solana mainnet). Human-readable Solana aliases ('solana:mainnet', 'solana:devnet') are also accepted and normalized to canonical CAIP-2 values. Enum options: `solana:mainnet`, `solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp`, `solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdpKuc147dw2N9d`, `solana:devnet`, `solana:EtWTRABZaYq6iMfeYKouRu166VU2xqa1`, `solana:EtWTRABZaYq6iMfeYKouRu166VU2xqa1wcaWoxPkrZBG` user-provided blockhash for replay protection / deadline control. If omitted and sponsor=true, we fetch a fresh blockhash during execution The result of the activity The solSendTransactionResult object The send\_transaction\_status ID associated with the transaction submission A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/sol_send_transaction \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_SOL_SEND_TRANSACTION", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "unsignedTransaction": "", "signWith": "", "sponsor": "", "caip2": "", "recentBlockhash": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().solSendTransaction({ unsignedTransaction: " (Base64-encoded serialized unsigned Solana transaction)", signWith: " (A wallet or private key address to sign with. This does not support private key IDs.)", sponsor: true // Whether to sponsor this transaction via Gas Station., caip2: "" // CAIP-2 chain ID (e.g., 'solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp' for Solana mainnet). Human-readable Solana aliases ('solana:mainnet', 'solana:devnet') are also accepted and normalized to canonical CAIP-2 values., recentBlockhash: " (user-provided blockhash for replay protection / deadline control. If omitted and sponsor=true, we fetch a fresh blockhash during execution)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_SOL_SEND_TRANSACTION", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "solSendTransactionIntent": { "unsignedTransaction": "", "signWith": "", "sponsor": "", "caip2": "", "recentBlockhash": "" } }, "result": { "solSendTransactionResult": { "sendTransactionStatusId": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Claim Spark transfer Source: https://docs.turnkey.com/api-reference/activities/claim-spark-transfer Construct receiver-side encrypted operator packages to claim a Spark transfer. Does not perform FROST signing. Enum options: `ACTIVITY_TYPE_SPARK_CLAIM_TRANSFER` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

A Spark wallet account address identifying the wallet.

claim field

Leaves being claimed.

Leaf identifier (UUID). ECIES ciphertext (hex-encoded) containing the inbound transfer secret. Decrypted inside the enclave using the wallet's Identity key. Hex-encoded 64-byte compact ECDSA signature binding (leaf\_id, transfer\_id, ciphertext) to the sender's identity key. Verified inside the enclave before decryption. Shamir threshold for reconstructing the per-leaf claim secret.

Operators that will receive Shamir shares.

Spark operator identifier (UUID). Operator's ECIES encryption pubkey (hex-encoded compressed secp256k1 point). Spark transfer identifier (UUID). Used together with each leaf's sender\_signature to verify the sender bound this ciphertext to this transfer. Sender's compressed secp256k1 identity public key (hex-encoded, 33 bytes). Used to verify the per-leaf sender\_signature fields. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The sparkClaimTransferIntent object A Spark wallet account address identifying the wallet. claim field Leaves being claimed. Leaf identifier (UUID). ECIES ciphertext (hex-encoded) containing the inbound transfer secret. Decrypted inside the enclave using the wallet's Identity key. Hex-encoded 64-byte compact ECDSA signature binding (leaf\_id, transfer\_id, ciphertext) to the sender's identity key. Verified inside the enclave before decryption. Shamir threshold for reconstructing the per-leaf claim secret. Operators that will receive Shamir shares. Spark operator identifier (UUID). Operator's ECIES encryption pubkey (hex-encoded compressed secp256k1 point). Spark transfer identifier (UUID). Used together with each leaf's sender\_signature to verify the sender bound this ciphertext to this transfer. Sender's compressed secp256k1 identity public key (hex-encoded, 33 bytes). Used to verify the per-leaf sender\_signature fields. The result of the activity The sparkClaimTransferResult object Per-operator ECIES-encrypted packages. Spark operator identifier (UUID). ECIES ciphertext (hex-encoded) opaque to Turnkey after emission. Newly-derived SigningLeaf public keys, one per leaf, in input order. The Spark leaf\_id this public key was derived for. Hex-encoded compressed secp256k1 point (33 bytes) for the SigningLeaf derivation at leaf\_id. A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/spark_claim_transfer \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_SPARK_CLAIM_TRANSFER", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "signWith": "", "claim": { "leaves": [ { "leafId": "", "ciphertext": "", "senderSignature": "" } ], "threshold": "", "operatorRecipients": [ { "operatorId": "", "encryptionPublicKey": "" } ], "transferId": "", "senderIdentityPublicKey": "" } } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().sparkClaimTransfer({ signWith: " (A Spark wallet account address identifying the wallet.)", claim: { // claim field, leaves: [{ // Leaves being claimed., leafId: " (Leaf identifier (UUID).)", ciphertext: " (ECIES ciphertext (hex-encoded) containing the inbound transfer secret. Decrypted inside the enclave using the wallet's Identity key.)", senderSignature: " (Hex-encoded 64-byte compact ECDSA signature binding (leaf_id, transfer_id, ciphertext) to the sender's identity key. Verified inside the enclave before decryption.)", }], threshold: 0 // Shamir threshold for reconstructing the per-leaf claim secret., operatorRecipients: [{ // Operators that will receive Shamir shares., operatorId: " (Spark operator identifier (UUID).)", encryptionPublicKey: " (Operator's ECIES encryption pubkey (hex-encoded compressed secp256k1 point).)", }], transferId: " (Spark transfer identifier (UUID). Used together with each leaf's sender_signature to verify the sender bound this ciphertext to this transfer.)", senderIdentityPublicKey: " (Sender's compressed secp256k1 identity public key (hex-encoded, 33 bytes). Used to verify the per-leaf sender_signature fields.)", } }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_SPARK_CLAIM_TRANSFER", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "sparkClaimTransferIntent": { "signWith": "", "claim": { "leaves": [ { "leafId": "", "ciphertext": "", "senderSignature": "" } ], "threshold": "", "operatorRecipients": [ { "operatorId": "", "encryptionPublicKey": "" } ], "transferId": "", "senderIdentityPublicKey": "" } } }, "result": { "sparkClaimTransferResult": { "operatorPackages": [ { "operatorId": "", "encryptedPackage": "" } ], "newLeafPublicKeys": [ { "leafId": "", "publicKey": "" } ] } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Create a Fiat On Ramp Credential Source: https://docs.turnkey.com/api-reference/activities/create-a-fiat-on-ramp-credential Create a fiat on ramp provider credential Enum options: `ACTIVITY_TYPE_CREATE_FIAT_ON_RAMP_CREDENTIAL` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

Enum options: `FIAT_ON_RAMP_PROVIDER_COINBASE`, `FIAT_ON_RAMP_PROVIDER_MOONPAY` Project ID for the on-ramp provider. Some providers, like Coinbase, require this additional identifier Publishable API key for the on-ramp provider Secret API key for the on-ramp provider encrypted to our on-ramp encryption public key Private API key for the on-ramp provider encrypted to our on-ramp encryption public key. Some providers, like Coinbase, require this additional key. If the on-ramp credential is a sandbox credential Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The createFiatOnRampCredentialIntent object onrampProvider field Enum options: `FIAT_ON_RAMP_PROVIDER_COINBASE`, `FIAT_ON_RAMP_PROVIDER_MOONPAY` Project ID for the on-ramp provider. Some providers, like Coinbase, require this additional identifier Publishable API key for the on-ramp provider Secret API key for the on-ramp provider encrypted to our on-ramp encryption public key Private API key for the on-ramp provider encrypted to our on-ramp encryption public key. Some providers, like Coinbase, require this additional key. If the on-ramp credential is a sandbox credential The result of the activity The createFiatOnRampCredentialResult object Unique identifier of the Fiat On-Ramp credential that was created A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/create_fiat_on_ramp_credential \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_CREATE_FIAT_ON_RAMP_CREDENTIAL", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "onrampProvider": "", "projectId": "", "publishableApiKey": "", "encryptedSecretApiKey": "", "encryptedPrivateApiKey": "", "sandboxMode": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().createFiatOnRampCredential({ onrampProvider: "" // onrampProvider field, projectId: " (Project ID for the on-ramp provider. Some providers, like Coinbase, require this additional identifier)", publishableApiKey: " (Publishable API key for the on-ramp provider)", encryptedSecretApiKey: " (Secret API key for the on-ramp provider encrypted to our on-ramp encryption public key)", encryptedPrivateApiKey: " (Private API key for the on-ramp provider encrypted to our on-ramp encryption public key. Some providers, like Coinbase, require this additional key.)", sandboxMode: true // If the on-ramp credential is a sandbox credential }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_CREATE_FIAT_ON_RAMP_CREDENTIAL", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "createFiatOnRampCredentialIntent": { "onrampProvider": "", "projectId": "", "publishableApiKey": "", "encryptedSecretApiKey": "", "encryptedPrivateApiKey": "", "sandboxMode": "" } }, "result": { "createFiatOnRampCredentialResult": { "fiatOnRampCredentialId": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Create a TVC App Source: https://docs.turnkey.com/api-reference/activities/create-a-tvc-app Create a new TVC application Enum options: `ACTIVITY_TYPE_CREATE_TVC_APP` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

The name of the new TVC application Quorum public key to use for this application Unique identifier for an existing TVC operator set to use as the Manifest Set for this TVC application. If left empty, a new Manifest Set configuration is required

manifestSetParams field

Short description for this new operator set

Operators to create as part of this new operator set

The name for this new operator Public key for this operator

Existing operators to use as part of this new operator set

Array item type: string

item field

 The threshold of operators needed to reach consensus in this new Operator Set Unique identifier for an existing TVC operator set to use as the Share Set for this TVC application. If left empty, a new Share Set configuration is required

shareSetParams field

Short description for this new operator set

Operators to create as part of this new operator set

The name for this new operator Public key for this operator

Existing operators to use as part of this new operator set

Array item type: string

item field

 The threshold of operators needed to reach consensus in this new Operator Set Enables network egress for this TVC app. Default if not provided: false. When true, this app may create deployments in debug-mode. Debug-mode deployments expose logs and emit zero'd attestation PCRs, so remote attestation cannot succeed. Cannot be changed after app creation. Setting this true means the app's quorum key is considered permanently insecure, and a new app with a fresh quorum key must be created. Default if not provided: false. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The createTvcAppIntent object The name of the new TVC application Quorum public key to use for this application Unique identifier for an existing TVC operator set to use as the Manifest Set for this TVC application. If left empty, a new Manifest Set configuration is required manifestSetParams field Short description for this new operator set Operators to create as part of this new operator set The name for this new operator Public key for this operator Existing operators to use as part of this new operator set item field The threshold of operators needed to reach consensus in this new Operator Set Unique identifier for an existing TVC operator set to use as the Share Set for this TVC application. If left empty, a new Share Set configuration is required shareSetParams field Short description for this new operator set Operators to create as part of this new operator set The name for this new operator Public key for this operator Existing operators to use as part of this new operator set item field The threshold of operators needed to reach consensus in this new Operator Set Enables network egress for this TVC app. Default if not provided: false. When true, this app may create deployments in debug-mode. Debug-mode deployments expose logs and emit zero'd attestation PCRs, so remote attestation cannot succeed. Cannot be changed after app creation. Setting this true means the app's quorum key is considered permanently insecure, and a new app with a fresh quorum key must be created. Default if not provided: false. The result of the activity The createTvcAppResult object The unique identifier for the TVC application The unique identifier for the TVC manifest set The unique identifier(s) of the manifest set operators item field The required number of approvals for the manifest set A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/create_tvc_app \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_CREATE_TVC_APP", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "name": "", "quorumPublicKey": "", "manifestSetId": "", "manifestSetParams": { "name": "", "newOperators": [ { "name": "", "publicKey": "" } ], "existingOperatorIds": [ "" ], "threshold": "" }, "shareSetId": "", "shareSetParams": { "name": "", "newOperators": [ { "name": "", "publicKey": "" } ], "existingOperatorIds": [ "" ], "threshold": "" }, "enableEgress": "", "enableDebugModeDeployments": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().createTvcApp({ name: " (The name of the new TVC application)", quorumPublicKey: " (Quorum public key to use for this application)", manifestSetId: " (Unique identifier for an existing TVC operator set to use as the Manifest Set for this TVC application. If left empty, a new Manifest Set configuration is required)", manifestSetParams: { // manifestSetParams field, name: " (Short description for this new operator set)", newOperators: [{ // Operators to create as part of this new operator set, name: " (The name for this new operator)", publicKey: " (Public key for this operator)", }], existingOperatorIds: [""] // Existing operators to use as part of this new operator set, threshold: 0 // The threshold of operators needed to reach consensus in this new Operator Set, }, shareSetId: " (Unique identifier for an existing TVC operator set to use as the Share Set for this TVC application. If left empty, a new Share Set configuration is required)", shareSetParams: { // shareSetParams field, name: " (Short description for this new operator set)", newOperators: [{ // Operators to create as part of this new operator set, name: " (The name for this new operator)", publicKey: " (Public key for this operator)", }], existingOperatorIds: [""] // Existing operators to use as part of this new operator set, threshold: 0 // The threshold of operators needed to reach consensus in this new Operator Set, }, enableEgress: true // Enables network egress for this TVC app. Default if not provided: false., enableDebugModeDeployments: true // When true, this app may create deployments in debug-mode. Debug-mode deployments expose logs and emit zero'd attestation PCRs, so remote attestation cannot succeed. Cannot be changed after app creation. Setting this true means the app's quorum key is considered permanently insecure, and a new app with a fresh quorum key must be created. Default if not provided: false. }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_CREATE_TVC_APP", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "createTvcAppIntent": { "name": "", "quorumPublicKey": "", "manifestSetId": "", "manifestSetParams": { "name": "", "newOperators": [ { "name": "", "publicKey": "" } ], "existingOperatorIds": [ "" ], "threshold": "" }, "shareSetId": "", "shareSetParams": { "name": "", "newOperators": [ { "name": "", "publicKey": "" } ], "existingOperatorIds": [ "" ], "threshold": "" }, "enableEgress": "", "enableDebugModeDeployments": "" } }, "result": { "createTvcAppResult": { "appId": "", "manifestSetId": "", "manifestSetOperatorIds": [ "" ], "manifestSetThreshold": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Create a TVC Deployment Source: https://docs.turnkey.com/api-reference/activities/create-a-tvc-deployment Create a new TVC Deployment Enum options: `ACTIVITY_TYPE_CREATE_TVC_DEPLOYMENT` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

The unique identifier of the to-be-deployed TVC application The QuorumOS version to use to deploy this application URL of the container containing the pivot binary Location of the binary in the pivot container

Arguments to pass to the pivot binary at startup. Encoded as a list of strings, for example \["--foo", "bar"]

Array item type: string

item field

 Digest of the pivot binary in the pivot container. This value will be inserted in the QOS manifest to ensure application integrity. Optional nonce to ensure uniqueness of the deployment manifest. If not provided, it defaults to the current Unix timestamp in seconds. Optional encrypted pull secret to authorize Turnkey to pull the pivot container image. If your image is public, leave this empty. Optional flag to indicate whether to deploy the TVC app in debug mode, which includes additional logging and debugging tools. Default is false. Enum options: `TVC_HEALTH_CHECK_TYPE_HTTP`, `TVC_HEALTH_CHECK_TYPE_GRPC` Port to use for health checks. Port to use for public ingress. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The createTvcDeploymentIntent object The unique identifier of the to-be-deployed TVC application The QuorumOS version to use to deploy this application URL of the container containing the pivot binary Location of the binary in the pivot container Arguments to pass to the pivot binary at startup. Encoded as a list of strings, for example \["--foo", "bar"] item field Digest of the pivot binary in the pivot container. This value will be inserted in the QOS manifest to ensure application integrity. Optional nonce to ensure uniqueness of the deployment manifest. If not provided, it defaults to the current Unix timestamp in seconds. Optional encrypted pull secret to authorize Turnkey to pull the pivot container image. If your image is public, leave this empty. Optional flag to indicate whether to deploy the TVC app in debug mode, which includes additional logging and debugging tools. Default is false. healthCheckType field Enum options: `TVC_HEALTH_CHECK_TYPE_HTTP`, `TVC_HEALTH_CHECK_TYPE_GRPC` Port to use for health checks. Port to use for public ingress. The result of the activity The createTvcDeploymentResult object The unique identifier for the TVC deployment The unique identifier for the TVC manifest A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/create_tvc_deployment \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_CREATE_TVC_DEPLOYMENT", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "appId": "", "qosVersion": "", "pivotContainerImageUrl": "", "pivotPath": "", "pivotArgs": [ "" ], "expectedPivotDigest": "", "nonce": "", "pivotContainerEncryptedPullSecret": "", "debugMode": "", "healthCheckType": "", "healthCheckPort": "", "publicIngressPort": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().createTvcDeployment({ appId: " (The unique identifier of the to-be-deployed TVC application)", qosVersion: " (The QuorumOS version to use to deploy this application)", pivotContainerImageUrl: " (URL of the container containing the pivot binary)", pivotPath: " (Location of the binary in the pivot container)", pivotArgs: [""] // Arguments to pass to the pivot binary at startup. Encoded as a list of strings, for example ["--foo", "bar"], expectedPivotDigest: " (Digest of the pivot binary in the pivot container. This value will be inserted in the QOS manifest to ensure application integrity.)", nonce: 0 // Optional nonce to ensure uniqueness of the deployment manifest. If not provided, it defaults to the current Unix timestamp in seconds., pivotContainerEncryptedPullSecret: " (Optional encrypted pull secret to authorize Turnkey to pull the pivot container image. If your image is public, leave this empty.)", debugMode: true // Optional flag to indicate whether to deploy the TVC app in debug mode, which includes additional logging and debugging tools. Default is false., healthCheckType: "" // healthCheckType field, healthCheckPort: 0 // Port to use for health checks., publicIngressPort: 0 // Port to use for public ingress. }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_CREATE_TVC_DEPLOYMENT", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "createTvcDeploymentIntent": { "appId": "", "qosVersion": "", "pivotContainerImageUrl": "", "pivotPath": "", "pivotArgs": [ "" ], "expectedPivotDigest": "", "nonce": "", "pivotContainerEncryptedPullSecret": "", "debugMode": "", "healthCheckType": "", "healthCheckPort": "", "publicIngressPort": "" } }, "result": { "createTvcDeploymentResult": { "deploymentId": "", "manifestId": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Create an OAuth 2.0 Credential Source: https://docs.turnkey.com/api-reference/activities/create-an-oauth-20-credential Enable authentication for end users with an OAuth 2.0 provider Enum options: `ACTIVITY_TYPE_CREATE_OAUTH2_CREDENTIAL` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

Enum options: `OAUTH2_PROVIDER_X`, `OAUTH2_PROVIDER_DISCORD` The Client ID issued by the OAuth 2.0 provider The client secret issued by the OAuth 2.0 provider encrypted to the TLS Fetcher quorum key Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The createOauth2CredentialIntent object provider field Enum options: `OAUTH2_PROVIDER_X`, `OAUTH2_PROVIDER_DISCORD` The Client ID issued by the OAuth 2.0 provider The client secret issued by the OAuth 2.0 provider encrypted to the TLS Fetcher quorum key The result of the activity The createOauth2CredentialResult object Unique identifier of the OAuth 2.0 credential that was created A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/create_oauth2_credential \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_CREATE_OAUTH2_CREDENTIAL", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "provider": "", "clientId": "", "encryptedClientSecret": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().createOauth2Credential({ provider: "" // provider field, clientId: " (The Client ID issued by the OAuth 2.0 provider)", encryptedClientSecret: " (The client secret issued by the OAuth 2.0 provider encrypted to the TLS Fetcher quorum key)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_CREATE_OAUTH2_CREDENTIAL", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "createOauth2CredentialIntent": { "provider": "", "clientId": "", "encryptedClientSecret": "" } }, "result": { "createOauth2CredentialResult": { "oauth2CredentialId": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Create API keys Source: https://docs.turnkey.com/api-reference/activities/create-api-keys Add API keys to an existing user. Enum options: `ACTIVITY_TYPE_CREATE_API_KEYS_V2` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

A list of API Keys.

Human-readable name for an API Key. The public component of a cryptographic key pair used to sign messages and transactions. Enum options: `API_KEY_CURVE_P256`, `API_KEY_CURVE_SECP256K1`, `API_KEY_CURVE_ED25519` Optional window (in seconds) indicating how long the API Key should last. Unique identifier for a given User. Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The createApiKeysIntentV2 object A list of API Keys. Human-readable name for an API Key. The public component of a cryptographic key pair used to sign messages and transactions. curveType field Enum options: `API_KEY_CURVE_P256`, `API_KEY_CURVE_SECP256K1`, `API_KEY_CURVE_ED25519` Optional window (in seconds) indicating how long the API Key should last. Unique identifier for a given User. The result of the activity The createApiKeysResult object A list of API Key IDs. item field A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/create_api_keys \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_CREATE_API_KEYS_V2", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "apiKeys": [ { "apiKeyName": "", "publicKey": "", "curveType": "", "expirationSeconds": "" } ], "userId": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().createApiKeys({ apiKeys: [{ // A list of API Keys., apiKeyName: " (Human-readable name for an API Key.)", publicKey: " (The public component of a cryptographic key pair used to sign messages and transactions.)", curveType: "" // curveType field, expirationSeconds: " (Optional window (in seconds) indicating how long the API Key should last.)", }], userId: " (Unique identifier for a given User.)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_CREATE_API_KEYS_V2", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "createApiKeysIntentV2": { "apiKeys": [ { "apiKeyName": "", "publicKey": "", "curveType": "", "expirationSeconds": "" } ], "userId": "" } }, "result": { "createApiKeysResult": { "apiKeyIds": [ "" ] } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Create authenticators Source: https://docs.turnkey.com/api-reference/activities/create-authenticators Create authenticators to authenticate requests to Turnkey. Enum options: `ACTIVITY_TYPE_CREATE_AUTHENTICATORS_V2` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

A list of Authenticators.

Human-readable name for an Authenticator. Challenge presented for authentication purposes.

attestation field

The cbor encoded then base64 url encoded id of the credential. A base64 url encoded payload containing metadata about the signing context and the challenge. A base64 url encoded payload containing authenticator data and any attestation the webauthn provider chooses. Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` Unique identifier for a given User. Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The createAuthenticatorsIntentV2 object A list of Authenticators. Human-readable name for an Authenticator. Challenge presented for authentication purposes. attestation field The cbor encoded then base64 url encoded id of the credential. A base64 url encoded payload containing metadata about the signing context and the challenge. A base64 url encoded payload containing authenticator data and any attestation the webauthn provider chooses. The type of authenticator transports. item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` Unique identifier for a given User. The result of the activity The createAuthenticatorsResult object A list of Authenticator IDs. item field A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/create_authenticators \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_CREATE_AUTHENTICATORS_V2", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "authenticators": [ { "authenticatorName": "", "challenge": "", "attestation": { "credentialId": "", "clientDataJson": "", "attestationObject": "", "transports": [ "" ] } } ], "userId": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().createAuthenticators({ authenticators: [{ // A list of Authenticators., authenticatorName: " (Human-readable name for an Authenticator.)", challenge: " (Challenge presented for authentication purposes.)", attestation: { // attestation field, credentialId: " (The cbor encoded then base64 url encoded id of the credential.)", clientDataJson: " (A base64 url encoded payload containing metadata about the signing context and the challenge.)", attestationObject: " (A base64 url encoded payload containing authenticator data and any attestation the webauthn provider chooses.)", transports: "" // The type of authenticator transports., }, }], userId: " (Unique identifier for a given User.)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_CREATE_AUTHENTICATORS_V2", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "createAuthenticatorsIntentV2": { "authenticators": [ { "authenticatorName": "", "challenge": "", "attestation": { "credentialId": "", "clientDataJson": "", "attestationObject": "", "transports": [ "" ] } } ], "userId": "" } }, "result": { "createAuthenticatorsResult": { "authenticatorIds": [ "" ] } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Create invitations Source: https://docs.turnkey.com/api-reference/activities/create-invitations Create invitations to join an existing organization. Enum options: `ACTIVITY_TYPE_CREATE_INVITATIONS` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

A list of Invitations.

The name of the intended Invitation recipient. The email address of the intended Invitation recipient.

A list of tags assigned to the Invitation recipient. This field, if not needed, should be an empty array in your request body.

Array item type: string

item field

 Enum options: `ACCESS_TYPE_WEB`, `ACCESS_TYPE_API`, `ACCESS_TYPE_ALL` Unique identifier for the Sender of an Invitation. Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The createInvitationsIntent object A list of Invitations. The name of the intended Invitation recipient. The email address of the intended Invitation recipient. A list of tags assigned to the Invitation recipient. This field, if not needed, should be an empty array in your request body. item field accessType field Enum options: `ACCESS_TYPE_WEB`, `ACCESS_TYPE_API`, `ACCESS_TYPE_ALL` Unique identifier for the Sender of an Invitation. The result of the activity The createInvitationsResult object A list of Invitation IDs item field A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/create_invitations \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_CREATE_INVITATIONS", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "invitations": [ { "receiverUserName": "", "receiverUserEmail": "", "receiverUserTags": [ "" ], "accessType": "", "senderUserId": "" } ] } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().createInvitations({ invitations: [{ // A list of Invitations., receiverUserName: " (The name of the intended Invitation recipient.)", receiverUserEmail: " (The email address of the intended Invitation recipient.)", receiverUserTags: [""] // A list of tags assigned to the Invitation recipient. This field, if not needed, should be an empty array in your request body., accessType: "" // accessType field, senderUserId: " (Unique identifier for the Sender of an Invitation.)", }] }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_CREATE_INVITATIONS", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "createInvitationsIntent": { "invitations": [ { "receiverUserName": "", "receiverUserEmail": "", "receiverUserTags": [ "" ], "accessType": "", "senderUserId": "" } ] } }, "result": { "createInvitationsResult": { "invitationIds": [ "" ] } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Create MFA policy Source: https://docs.turnkey.com/api-reference/activities/create-mfa-policy Create a new MFA policy for a user. Enum options: `ACTIVITY_TYPE_CREATE_MFA_POLICY` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

The ID of the User to add the MFA Policy to. Human-readable name for a Policy. A condition expression that evaluates to true or false, determining when this MFA policy applies.

An ordered list of authentication requirements. Each requirement must be satisfied sequentially to complete MFA.

A list of authentication methods for this MFA step. If only one method is provided, it is required. If multiple are provided, the user must satisfy ANY one of them.

Enum options: `AUTHENTICATION_TYPE_EMAIL_OTP`, `AUTHENTICATION_TYPE_SMS_OTP`, `AUTHENTICATION_TYPE_PASSKEY`, `AUTHENTICATION_TYPE_API_KEY`, `AUTHENTICATION_TYPE_OAUTH`, `AUTHENTICATION_TYPE_SESSION` Optional specific authenticator ID required (e.g., UUID of a passkey authenticator). If not provided, any authenticator of the specified type can be used. The order in which this MFA policy is evaluated, starting from 0, relative to other MFA policies. Lower order values are evaluated first. Notes for an MFA Policy. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The createMfaPolicyIntent object The ID of the User to add the MFA Policy to. Human-readable name for a Policy. A condition expression that evaluates to true or false, determining when this MFA policy applies. An ordered list of authentication requirements. Each requirement must be satisfied sequentially to complete MFA. A list of authentication methods for this MFA step. If only one method is provided, it is required. If multiple are provided, the user must satisfy ANY one of them. type field Enum options: `AUTHENTICATION_TYPE_EMAIL_OTP`, `AUTHENTICATION_TYPE_SMS_OTP`, `AUTHENTICATION_TYPE_PASSKEY`, `AUTHENTICATION_TYPE_API_KEY`, `AUTHENTICATION_TYPE_OAUTH`, `AUTHENTICATION_TYPE_SESSION` Optional specific authenticator ID required (e.g., UUID of a passkey authenticator). If not provided, any authenticator of the specified type can be used. The order in which this MFA policy is evaluated, starting from 0, relative to other MFA policies. Lower order values are evaluated first. Notes for an MFA Policy. The result of the activity The createMfaPolicyResult object Unique identifier for a given MFA Policy. A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/create_mfa_policy \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_CREATE_MFA_POLICY", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "userId": "", "mfaPolicyName": "", "condition": "", "requiredAuthenticationMethods": [ { "any": [ { "type": "", "id": "" } ] } ], "order": "", "notes": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().createMfaPolicy({ userId: " (The ID of the User to add the MFA Policy to.)", mfaPolicyName: " (Human-readable name for a Policy.)", condition: " (A condition expression that evaluates to true or false, determining when this MFA policy applies.)", requiredAuthenticationMethods: [""] // An ordered list of authentication requirements. Each requirement must be satisfied sequentially to complete MFA., order: 0 // The order in which this MFA policy is evaluated, starting from 0, relative to other MFA policies. Lower order values are evaluated first., notes: " (Notes for an MFA Policy.)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_CREATE_MFA_POLICY", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "createMfaPolicyIntent": { "userId": "", "mfaPolicyName": "", "condition": "", "requiredAuthenticationMethods": [ { "any": [ { "type": "", "id": "" } ] } ], "order": "", "notes": "" } }, "result": { "createMfaPolicyResult": { "mfaPolicyId": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Create Oauth providers Source: https://docs.turnkey.com/api-reference/activities/create-oauth-providers Create Oauth providers for a specified user. Enum options: `ACTIVITY_TYPE_CREATE_OAUTH_PROVIDERS_V2` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

The ID of the User to add an Oauth provider to

A list of Oauth providers.

Human-readable name to identify a Provider. Base64 encoded OIDC token

oidcClaims field

The issuer identifier from the OIDC token (iss claim) The subject identifier from the OIDC token (sub claim) The audience from the OIDC token (aud claim) Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The createOauthProvidersIntentV2 object The ID of the User to add an Oauth provider to A list of Oauth providers. Human-readable name to identify a Provider. Base64 encoded OIDC token oidcClaims field The issuer identifier from the OIDC token (iss claim) The subject identifier from the OIDC token (sub claim) The audience from the OIDC token (aud claim) The result of the activity The createOauthProvidersResultV2 object A list of unique identifiers for Oauth Providers item field A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/create_oauth_providers \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_CREATE_OAUTH_PROVIDERS_V2", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "userId": "", "oauthProviders": [ { "providerName": "", "oidcToken": "", "oidcClaims": { "iss": "", "sub": "", "aud": "" } } ] } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().createOauthProviders({ userId: " (The ID of the User to add an Oauth provider to)", oauthProviders: [{ // A list of Oauth providers., providerName: " (Human-readable name to identify a Provider.)", oidcToken: " (Base64 encoded OIDC token)", oidcClaims: { // oidcClaims field, iss: " (The issuer identifier from the OIDC token (iss claim))", sub: " (The subject identifier from the OIDC token (sub claim))", aud: " (The audience from the OIDC token (aud claim))", }, }] }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_CREATE_OAUTH_PROVIDERS_V2", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "createOauthProvidersIntentV2": { "userId": "", "oauthProviders": [ { "providerName": "", "oidcToken": "", "oidcClaims": { "iss": "", "sub": "", "aud": "" } } ] } }, "result": { "createOauthProvidersResultV2": { "providerIds": [ "" ] } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Create policies Source: https://docs.turnkey.com/api-reference/activities/create-policies Create new policies. Enum options: `ACTIVITY_TYPE_CREATE_POLICIES` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

An array of policy intents to be created.

Human-readable name for a Policy. Enum options: `EFFECT_ALLOW`, `EFFECT_DENY` The condition expression that triggers the Effect The consensus expression that triggers the Effect Notes for a Policy. Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The createPoliciesIntent object An array of policy intents to be created. Human-readable name for a Policy. effect field Enum options: `EFFECT_ALLOW`, `EFFECT_DENY` The condition expression that triggers the Effect The consensus expression that triggers the Effect Notes for a Policy. The result of the activity The createPoliciesResult object A list of unique identifiers for the created policies. item field A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/create_policies \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_CREATE_POLICIES", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "policies": [ { "policyName": "", "effect": "", "condition": "", "consensus": "", "notes": "" } ] } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().createPolicies({ policies: [{ // An array of policy intents to be created., policyName: " (Human-readable name for a Policy.)", effect: "" // effect field, condition: " (The condition expression that triggers the Effect)", consensus: " (The consensus expression that triggers the Effect)", notes: " (Notes for a Policy.)", }] }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_CREATE_POLICIES", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "createPoliciesIntent": { "policies": [ { "policyName": "", "effect": "", "condition": "", "consensus": "", "notes": "" } ] } }, "result": { "createPoliciesResult": { "policyIds": [ "" ] } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Create policy Source: https://docs.turnkey.com/api-reference/activities/create-policy Create a new policy. Enum options: `ACTIVITY_TYPE_CREATE_POLICY_V3` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

Human-readable name for a Policy. Enum options: `EFFECT_ALLOW`, `EFFECT_DENY` The condition expression that triggers the Effect The consensus expression that triggers the Effect Notes for a Policy. Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The createPolicyIntentV3 object Human-readable name for a Policy. effect field Enum options: `EFFECT_ALLOW`, `EFFECT_DENY` The condition expression that triggers the Effect The consensus expression that triggers the Effect Notes for a Policy. The result of the activity The createPolicyResult object Unique identifier for a given Policy. A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/create_policy \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_CREATE_POLICY_V3", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "policyName": "", "effect": "", "condition": "", "consensus": "", "notes": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().createPolicy({ policyName: " (Human-readable name for a Policy.)", effect: "" // effect field, condition: " (The condition expression that triggers the Effect)", consensus: " (The consensus expression that triggers the Effect)", notes: " (Notes for a Policy.)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_CREATE_POLICY_V3", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "createPolicyIntentV3": { "policyName": "", "effect": "", "condition": "", "consensus": "", "notes": "" } }, "result": { "createPolicyResult": { "policyId": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Create private key tag Source: https://docs.turnkey.com/api-reference/activities/create-private-key-tag Create a private key tag and add it to private keys. Enum options: `ACTIVITY_TYPE_CREATE_PRIVATE_KEY_TAG` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

Human-readable name for a Private Key Tag.

A list of Private Key IDs.

Array item type: string

item field

 Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The createPrivateKeyTagIntent object Human-readable name for a Private Key Tag. A list of Private Key IDs. item field The result of the activity The createPrivateKeyTagResult object Unique identifier for a given Private Key Tag. A list of Private Key IDs. item field A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/create_private_key_tag \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_CREATE_PRIVATE_KEY_TAG", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "privateKeyTagName": "", "privateKeyIds": [ "" ] } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().createPrivateKeyTag({ privateKeyTagName: " (Human-readable name for a Private Key Tag.)", privateKeyIds: [""] // A list of Private Key IDs. }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_CREATE_PRIVATE_KEY_TAG", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "createPrivateKeyTagIntent": { "privateKeyTagName": "", "privateKeyIds": [ "" ] } }, "result": { "createPrivateKeyTagResult": { "privateKeyTagId": "", "privateKeyIds": [ "" ] } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Create private keys Source: https://docs.turnkey.com/api-reference/activities/create-private-keys Create new private keys. Enum options: `ACTIVITY_TYPE_CREATE_PRIVATE_KEYS_V2` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

A list of Private Keys.

Human-readable name for a Private Key. Enum options: `CURVE_SECP256K1`, `CURVE_ED25519`, `CURVE_P256`

A list of Private Key Tag IDs. This field, if not needed, should be an empty array in your request body.

Array item type: string

item field

 Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The createPrivateKeysIntentV2 object A list of Private Keys. Human-readable name for a Private Key. curve field Enum options: `CURVE_SECP256K1`, `CURVE_ED25519`, `CURVE_P256` A list of Private Key Tag IDs. This field, if not needed, should be an empty array in your request body. item field Cryptocurrency-specific formats for a derived address (e.g., Ethereum). item field Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` The result of the activity The createPrivateKeysResultV2 object A list of Private Key IDs and addresses. privateKeyId field addresses field format field Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` address field A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/create_private_keys \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_CREATE_PRIVATE_KEYS_V2", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "privateKeys": [ { "privateKeyName": "", "curve": "", "privateKeyTags": [ "" ], "addressFormats": [ "" ] } ] } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().createPrivateKeys({ privateKeys: [{ // A list of Private Keys., privateKeyName: " (Human-readable name for a Private Key.)", curve: "" // curve field, privateKeyTags: [""] // A list of Private Key Tag IDs. This field, if not needed, should be an empty array in your request body., addressFormats: "" // Cryptocurrency-specific formats for a derived address (e.g., Ethereum)., }] }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_CREATE_PRIVATE_KEYS_V2", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "createPrivateKeysIntentV2": { "privateKeys": [ { "privateKeyName": "", "curve": "", "privateKeyTags": [ "" ], "addressFormats": [ "" ] } ] } }, "result": { "createPrivateKeysResultV2": { "privateKeys": [ { "privateKeyId": "", "addresses": [ { "format": "", "address": "" } ] } ] } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Create read only session Source: https://docs.turnkey.com/api-reference/activities/create-read-only-session Create a read only session for a user (valid for 1 hour). Enum options: `ACTIVITY_TYPE_CREATE_READ_ONLY_SESSION` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization. The parameters object containing the specific intent data for this activity. Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The createReadOnlySessionIntent object The result of the activity The createReadOnlySessionResult object Unique identifier for a given Organization. If the request is being made by a user and their Sub-Organization ID is unknown, this can be the Parent Organization ID. However, using the Sub-Organization ID is preferred due to performance reasons. Human-readable name for an Organization. Unique identifier for a given User. Human-readable name for a User. String representing a read only session UTC timestamp in seconds representing the expiry time for the read only session. A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/create_read_only_session \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_CREATE_READ_ONLY_SESSION", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": {} }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().createReadOnlySession({}); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_CREATE_READ_ONLY_SESSION", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "createReadOnlySessionIntent": {} }, "result": { "createReadOnlySessionResult": { "organizationId": "", "organizationName": "", "userId": "", "username": "", "session": "", "sessionExpiry": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Create read write session Source: https://docs.turnkey.com/api-reference/activities/create-read-write-session Create a read write session for a user. Enum options: `ACTIVITY_TYPE_CREATE_READ_WRITE_SESSION_V2` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

Client-side public key generated by the user, to which the read write session bundle (credentials) will be encrypted. Optional unique identifier for a given User. If none provided, the read write session will be created for the user who is making the request. Optional human-readable name for an API Key. If none provided, default to Read Write Session - \ Expiration window (in seconds) indicating how long the API key is valid for. If not provided, a default of 15 minutes will be used. Invalidate all other previously generated ReadWriteSession API keys Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The createReadWriteSessionIntentV2 object Client-side public key generated by the user, to which the read write session bundle (credentials) will be encrypted. Optional unique identifier for a given User. If none provided, the read write session will be created for the user who is making the request. Optional human-readable name for an API Key. If none provided, default to Read Write Session - \ Expiration window (in seconds) indicating how long the API key is valid for. If not provided, a default of 15 minutes will be used. Invalidate all other previously generated ReadWriteSession API keys The result of the activity The createReadWriteSessionResultV2 object Unique identifier for a given Organization. If the request is being made by a user and their Sub-Organization ID is unknown, this can be the Parent Organization ID. However, using the Sub-Organization ID is preferred due to performance reasons. Human-readable name for an Organization. Unique identifier for a given User. Human-readable name for a User. Unique identifier for the created API key. HPKE encrypted credential bundle A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/create_read_write_session \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_CREATE_READ_WRITE_SESSION_V2", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "targetPublicKey": "", "userId": "", "apiKeyName": "", "expirationSeconds": "", "invalidateExisting": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().createReadWriteSession({ targetPublicKey: " (Client-side public key generated by the user, to which the read write session bundle (credentials) will be encrypted.)", userId: " (Optional unique identifier for a given User. If none provided, the read write session will be created for the user who is making the request.)", apiKeyName: " (Optional human-readable name for an API Key. If none provided, default to Read Write Session - )", expirationSeconds: " (Expiration window (in seconds) indicating how long the API key is valid for. If not provided, a default of 15 minutes will be used.)", invalidateExisting: true // Invalidate all other previously generated ReadWriteSession API keys }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_CREATE_READ_WRITE_SESSION_V2", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "createReadWriteSessionIntentV2": { "targetPublicKey": "", "userId": "", "apiKeyName": "", "expirationSeconds": "", "invalidateExisting": "" } }, "result": { "createReadWriteSessionResultV2": { "organizationId": "", "organizationName": "", "userId": "", "username": "", "apiKeyId": "", "credentialBundle": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Create session profile Source: https://docs.turnkey.com/api-reference/activities/create-session-profile Create a new session profile for an organization. Enum options: `ACTIVITY_TYPE_CREATE_SESSION_PROFILE` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

Human-readable name for a Session Profile. The scope string that defines the permissions for this Session Profile. The duration in seconds for which sessions created with this Session Profile are valid. If not set, expiration will be determined by the value passed in to the intent of login activities. Notes for a Session Profile. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The createSessionProfileIntent object Human-readable name for a Session Profile. The scope string that defines the permissions for this Session Profile. The duration in seconds for which sessions created with this Session Profile are valid. If not set, expiration will be determined by the value passed in to the intent of login activities. Notes for a Session Profile. The result of the activity The createSessionProfileResult object Unique identifier for a given Session Profile. A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/create_session_profile \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_CREATE_SESSION_PROFILE", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "sessionProfileName": "", "scope": "", "expirationSeconds": "", "notes": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().createSessionProfile({ sessionProfileName: " (Human-readable name for a Session Profile.)", scope: " (The scope string that defines the permissions for this Session Profile.)", expirationSeconds: " (The duration in seconds for which sessions created with this Session Profile are valid. If not set, expiration will be determined by the value passed in to the intent of login activities.)", notes: " (Notes for a Session Profile.)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_CREATE_SESSION_PROFILE", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "createSessionProfileIntent": { "sessionProfileName": "", "scope": "", "expirationSeconds": "", "notes": "" } }, "result": { "createSessionProfileResult": { "sessionProfileId": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Create smart contract interface Source: https://docs.turnkey.com/api-reference/activities/create-smart-contract-interface Create an ABI/IDL in JSON. Enum options: `ACTIVITY_TYPE_CREATE_SMART_CONTRACT_INTERFACE` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

Corresponding contract address or program ID ABI/IDL as a JSON string. Limited to 400kb Enum options: `SMART_CONTRACT_INTERFACE_TYPE_ETHEREUM`, `SMART_CONTRACT_INTERFACE_TYPE_SOLANA` Human-readable name for a Smart Contract Interface. Notes for a Smart Contract Interface. Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The createSmartContractInterfaceIntent object Corresponding contract address or program ID ABI/IDL as a JSON string. Limited to 400kb type field Enum options: `SMART_CONTRACT_INTERFACE_TYPE_ETHEREUM`, `SMART_CONTRACT_INTERFACE_TYPE_SOLANA` Human-readable name for a Smart Contract Interface. Notes for a Smart Contract Interface. The result of the activity The createSmartContractInterfaceResult object The ID of the created Smart Contract Interface. A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/create_smart_contract_interface \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_CREATE_SMART_CONTRACT_INTERFACE", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "smartContractAddress": "", "smartContractInterface": "", "type": "", "label": "", "notes": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().createSmartContractInterface({ smartContractAddress: " (Corresponding contract address or program ID)", smartContractInterface: " (ABI/IDL as a JSON string. Limited to 400kb)", type: "" // type field, label: " (Human-readable name for a Smart Contract Interface.)", notes: " (Notes for a Smart Contract Interface.)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_CREATE_SMART_CONTRACT_INTERFACE", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "createSmartContractInterfaceIntent": { "smartContractAddress": "", "smartContractInterface": "", "type": "", "label": "", "notes": "" } }, "result": { "createSmartContractInterfaceResult": { "smartContractInterfaceId": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Create sub-organization Source: https://docs.turnkey.com/api-reference/activities/create-sub-organization Create a new sub-organization. Enum options: `ACTIVITY_TYPE_CREATE_SUB_ORGANIZATION_V8` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

Name for this sub-organization

Root users to create within this sub-organization

Human-readable name for a User. The user's email address. The user's phone number in E.164 format e.g. +13214567890

A list of API Key parameters. This field, if not needed, should be an empty array in your request body.

Human-readable name for an API Key. The public component of a cryptographic key pair used to sign messages and transactions. Enum options: `API_KEY_CURVE_P256`, `API_KEY_CURVE_SECP256K1`, `API_KEY_CURVE_ED25519` Optional window (in seconds) indicating how long the API Key should last.

A list of Authenticator parameters. This field, if not needed, should be an empty array in your request body.

Human-readable name for an Authenticator. Challenge presented for authentication purposes.

attestation field

The cbor encoded then base64 url encoded id of the credential. A base64 url encoded payload containing metadata about the signing context and the challenge. A base64 url encoded payload containing authenticator data and any attestation the webauthn provider chooses. Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID`

A list of Oauth providers. This field, if not needed, should be an empty array in your request body.

Human-readable name to identify a Provider. Base64 encoded OIDC token

oidcClaims field

The issuer identifier from the OIDC token (iss claim) The subject identifier from the OIDC token (sub claim) The audience from the OIDC token (aud claim) The threshold of unique approvals to reach root quorum. This value must be less than or equal to the number of root users

wallet field

Human-readable name for a Wallet.

A list of wallet Accounts. This field, if not needed, should be an empty array in your request body.

Enum options: `CURVE_SECP256K1`, `CURVE_ED25519`, `CURVE_P256` Enum options: `PATH_FORMAT_BIP32` Path used to generate a wallet Account. Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` Optional human-readable name for the account. Length of mnemonic to generate the Wallet seed. Defaults to 12. Accepted values: 12, 15, 18, 21, 24. Disable email recovery for the sub-organization Disable email auth for the sub-organization Disable OTP SMS auth for the sub-organization Disable OTP email auth for the sub-organization Signed JWT containing a unique id, expiry, verification type, contact

clientSignature field

The public component of a cryptographic key pair used to create the signature. Enum options: `CLIENT_SIGNATURE_SCHEME_API_P256` The message that was signed. The cryptographic signature over the message. Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The createSubOrganizationIntentV8 object Name for this sub-organization Root users to create within this sub-organization Human-readable name for a User. The user's email address. The user's phone number in E.164 format e.g. +13214567890 A list of API Key parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an API Key. The public component of a cryptographic key pair used to sign messages and transactions. curveType field Enum options: `API_KEY_CURVE_P256`, `API_KEY_CURVE_SECP256K1`, `API_KEY_CURVE_ED25519` Optional window (in seconds) indicating how long the API Key should last. A list of Authenticator parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an Authenticator. Challenge presented for authentication purposes. attestation field The cbor encoded then base64 url encoded id of the credential. A base64 url encoded payload containing metadata about the signing context and the challenge. A base64 url encoded payload containing authenticator data and any attestation the webauthn provider chooses. The type of authenticator transports. item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` A list of Oauth providers. This field, if not needed, should be an empty array in your request body. Human-readable name to identify a Provider. Base64 encoded OIDC token oidcClaims field The issuer identifier from the OIDC token (iss claim) The subject identifier from the OIDC token (sub claim) The audience from the OIDC token (aud claim) The threshold of unique approvals to reach root quorum. This value must be less than or equal to the number of root users wallet field Human-readable name for a Wallet. A list of wallet Accounts. This field, if not needed, should be an empty array in your request body. curve field Enum options: `CURVE_SECP256K1`, `CURVE_ED25519`, `CURVE_P256` pathFormat field Enum options: `PATH_FORMAT_BIP32` Path used to generate a wallet Account. addressFormat field Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` Optional human-readable name for the account. Length of mnemonic to generate the Wallet seed. Defaults to 12. Accepted values: 12, 15, 18, 21, 24. Disable email recovery for the sub-organization Disable email auth for the sub-organization Disable OTP SMS auth for the sub-organization Disable OTP email auth for the sub-organization Signed JWT containing a unique id, expiry, verification type, contact clientSignature field The public component of a cryptographic key pair used to create the signature. scheme field Enum options: `CLIENT_SIGNATURE_SCHEME_API_P256` The message that was signed. The cryptographic signature over the message. The result of the activity The createSubOrganizationResultV8 object subOrganizationId field wallet field walletId field A list of account addresses. item field rootUserIds field item field A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/create_sub_organization \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_CREATE_SUB_ORGANIZATION_V8", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "subOrganizationName": "", "rootUsers": [ { "userName": "", "userEmail": "", "userPhoneNumber": "", "apiKeys": [ { "apiKeyName": "", "publicKey": "", "curveType": "", "expirationSeconds": "" } ], "authenticators": [ { "authenticatorName": "", "challenge": "", "attestation": { "credentialId": "", "clientDataJson": "", "attestationObject": "", "transports": [ "" ] } } ], "oauthProviders": [ { "providerName": "", "oidcToken": "", "oidcClaims": { "iss": "", "sub": "", "aud": "" } } ] } ], "rootQuorumThreshold": "", "wallet": { "walletName": "", "accounts": [ { "curve": "", "pathFormat": "", "path": "", "addressFormat": "", "name": "" } ], "mnemonicLength": "" }, "disableEmailRecovery": "", "disableEmailAuth": "", "disableSmsAuth": "", "disableOtpEmailAuth": "", "verificationToken": "", "clientSignature": { "publicKey": "", "scheme": "", "message": "", "signature": "" } } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().createSubOrganization({ subOrganizationName: " (Name for this sub-organization)", rootUsers: [{ // Root users to create within this sub-organization, userName: " (Human-readable name for a User.)", userEmail: " (The user's email address.)", userPhoneNumber: " (The user's phone number in E.164 format e.g. +13214567890)", apiKeys: [{ // A list of API Key parameters. This field, if not needed, should be an empty array in your request body., apiKeyName: " (Human-readable name for an API Key.)", publicKey: " (The public component of a cryptographic key pair used to sign messages and transactions.)", curveType: "" // curveType field, expirationSeconds: " (Optional window (in seconds) indicating how long the API Key should last.)", }], authenticators: [{ // A list of Authenticator parameters. This field, if not needed, should be an empty array in your request body., authenticatorName: " (Human-readable name for an Authenticator.)", challenge: " (Challenge presented for authentication purposes.)", attestation: { // attestation field, credentialId: " (The cbor encoded then base64 url encoded id of the credential.)", clientDataJson: " (A base64 url encoded payload containing metadata about the signing context and the challenge.)", attestationObject: " (A base64 url encoded payload containing authenticator data and any attestation the webauthn provider chooses.)", transports: "" // The type of authenticator transports., }, }], oauthProviders: [{ // A list of Oauth providers. This field, if not needed, should be an empty array in your request body., providerName: " (Human-readable name to identify a Provider.)", oidcToken: " (Base64 encoded OIDC token)", oidcClaims: { // oidcClaims field, iss: " (The issuer identifier from the OIDC token (iss claim))", sub: " (The subject identifier from the OIDC token (sub claim))", aud: " (The audience from the OIDC token (aud claim))", }, }], }], rootQuorumThreshold: 0 // The threshold of unique approvals to reach root quorum. This value must be less than or equal to the number of root users, wallet: { // wallet field, walletName: " (Human-readable name for a Wallet.)", accounts: [{ // A list of wallet Accounts. This field, if not needed, should be an empty array in your request body., curve: "" // curve field, pathFormat: "" // pathFormat field, path: " (Path used to generate a wallet Account.)", addressFormat: "" // addressFormat field, name: " (Optional human-readable name for the account.)", }], mnemonicLength: 0 // Length of mnemonic to generate the Wallet seed. Defaults to 12. Accepted values: 12, 15, 18, 21, 24., }, disableEmailRecovery: true // Disable email recovery for the sub-organization, disableEmailAuth: true // Disable email auth for the sub-organization, disableSmsAuth: true // Disable OTP SMS auth for the sub-organization, disableOtpEmailAuth: true // Disable OTP email auth for the sub-organization, verificationToken: " (Signed JWT containing a unique id, expiry, verification type, contact)", clientSignature: { // clientSignature field, publicKey: " (The public component of a cryptographic key pair used to create the signature.)", scheme: "" // scheme field, message: " (The message that was signed.)", signature: " (The cryptographic signature over the message.)", } }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_CREATE_SUB_ORGANIZATION_V8", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "createSubOrganizationIntentV8": { "subOrganizationName": "", "rootUsers": [ { "userName": "", "userEmail": "", "userPhoneNumber": "", "apiKeys": [ { "apiKeyName": "", "publicKey": "", "curveType": "", "expirationSeconds": "" } ], "authenticators": [ { "authenticatorName": "", "challenge": "", "attestation": { "credentialId": "", "clientDataJson": "", "attestationObject": "", "transports": [ "" ] } } ], "oauthProviders": [ { "providerName": "", "oidcToken": "", "oidcClaims": { "iss": "", "sub": "", "aud": "" } } ] } ], "rootQuorumThreshold": "", "wallet": { "walletName": "", "accounts": [ { "curve": "", "pathFormat": "", "path": "", "addressFormat": "", "name": "" } ], "mnemonicLength": "" }, "disableEmailRecovery": "", "disableEmailAuth": "", "disableSmsAuth": "", "disableOtpEmailAuth": "", "verificationToken": "", "clientSignature": { "publicKey": "", "scheme": "", "message": "", "signature": "" } } }, "result": { "createSubOrganizationResultV8": { "subOrganizationId": "", "wallet": { "walletId": "", "addresses": [ "" ] }, "rootUserIds": [ "" ] } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Create TVC Manifest Approvals Source: https://docs.turnkey.com/api-reference/activities/create-tvc-manifest-approvals Post one or more manifest approvals for a TVC Manifest Enum options: `ACTIVITY_TYPE_CREATE_TVC_MANIFEST_APPROVALS` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

Unique identifier of the TVC deployment to approve

List of manifest approvals

Unique identifier of the operator providing this approval Signature from the operator approving the manifest A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The createTvcManifestApprovalsIntent object Unique identifier of the TVC deployment to approve List of manifest approvals Unique identifier of the operator providing this approval Signature from the operator approving the manifest The result of the activity The createTvcManifestApprovalsResult object The unique identifier(s) for the manifest approvals item field A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/create_tvc_manifest_approvals \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_CREATE_TVC_MANIFEST_APPROVALS", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "manifestId": "", "approvals": [ { "operatorId": "", "signature": "" } ] } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().createTvcManifestApprovals({ manifestId: " (Unique identifier of the TVC deployment to approve)", approvals: [{ // List of manifest approvals, operatorId: " (Unique identifier of the operator providing this approval)", signature: " (Signature from the operator approving the manifest)", }] }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_CREATE_TVC_MANIFEST_APPROVALS", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "createTvcManifestApprovalsIntent": { "manifestId": "", "approvals": [ { "operatorId": "", "signature": "" } ] } }, "result": { "createTvcManifestApprovalsResult": { "approvalIds": [ "" ] } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Create user tag Source: https://docs.turnkey.com/api-reference/activities/create-user-tag Create a user tag and add it to users. Enum options: `ACTIVITY_TYPE_CREATE_USER_TAG` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

Human-readable name for a User Tag.

A list of User IDs.

Array item type: string

item field

 Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The createUserTagIntent object Human-readable name for a User Tag. A list of User IDs. item field The result of the activity The createUserTagResult object Unique identifier for a given User Tag. A list of User IDs. item field A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/create_user_tag \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_CREATE_USER_TAG", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "userTagName": "", "userIds": [ "" ] } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().createUserTag({ userTagName: " (Human-readable name for a User Tag.)", userIds: [""] // A list of User IDs. }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_CREATE_USER_TAG", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "createUserTagIntent": { "userTagName": "", "userIds": [ "" ] } }, "result": { "createUserTagResult": { "userTagId": "", "userIds": [ "" ] } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Create users Source: https://docs.turnkey.com/api-reference/activities/create-users Create users in an existing organization. Enum options: `ACTIVITY_TYPE_CREATE_USERS_V4` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

A list of Users.

Human-readable name for a User. The user's email address. The user's phone number in E.164 format e.g. +13214567890

A list of API Key parameters. This field, if not needed, should be an empty array in your request body.

Human-readable name for an API Key. The public component of a cryptographic key pair used to sign messages and transactions. Enum options: `API_KEY_CURVE_P256`, `API_KEY_CURVE_SECP256K1`, `API_KEY_CURVE_ED25519` Optional window (in seconds) indicating how long the API Key should last.

A list of Authenticator parameters. This field, if not needed, should be an empty array in your request body.

Human-readable name for an Authenticator. Challenge presented for authentication purposes.

attestation field

The cbor encoded then base64 url encoded id of the credential. A base64 url encoded payload containing metadata about the signing context and the challenge. A base64 url encoded payload containing authenticator data and any attestation the webauthn provider chooses. Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID`

A list of Oauth providers. This field, if not needed, should be an empty array in your request body.

Human-readable name to identify a Provider. Base64 encoded OIDC token

oidcClaims field

The issuer identifier from the OIDC token (iss claim) The subject identifier from the OIDC token (sub claim) The audience from the OIDC token (aud claim)

A list of User Tag IDs. This field, if not needed, should be an empty array in your request body.

Array item type: string

item field

 Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The createUsersIntentV4 object A list of Users. Human-readable name for a User. The user's email address. The user's phone number in E.164 format e.g. +13214567890 A list of API Key parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an API Key. The public component of a cryptographic key pair used to sign messages and transactions. curveType field Enum options: `API_KEY_CURVE_P256`, `API_KEY_CURVE_SECP256K1`, `API_KEY_CURVE_ED25519` Optional window (in seconds) indicating how long the API Key should last. A list of Authenticator parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an Authenticator. Challenge presented for authentication purposes. attestation field The cbor encoded then base64 url encoded id of the credential. A base64 url encoded payload containing metadata about the signing context and the challenge. A base64 url encoded payload containing authenticator data and any attestation the webauthn provider chooses. The type of authenticator transports. item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` A list of Oauth providers. This field, if not needed, should be an empty array in your request body. Human-readable name to identify a Provider. Base64 encoded OIDC token oidcClaims field The issuer identifier from the OIDC token (iss claim) The subject identifier from the OIDC token (sub claim) The audience from the OIDC token (aud claim) A list of User Tag IDs. This field, if not needed, should be an empty array in your request body. item field The result of the activity The createUsersResult object A list of User IDs. item field A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/create_users \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_CREATE_USERS_V4", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "users": [ { "userName": "", "userEmail": "", "userPhoneNumber": "", "apiKeys": [ { "apiKeyName": "", "publicKey": "", "curveType": "", "expirationSeconds": "" } ], "authenticators": [ { "authenticatorName": "", "challenge": "", "attestation": { "credentialId": "", "clientDataJson": "", "attestationObject": "", "transports": [ "" ] } } ], "oauthProviders": [ { "providerName": "", "oidcToken": "", "oidcClaims": { "iss": "", "sub": "", "aud": "" } } ], "userTags": [ "" ] } ] } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().createUsers({ users: [{ // A list of Users., userName: " (Human-readable name for a User.)", userEmail: " (The user's email address.)", userPhoneNumber: " (The user's phone number in E.164 format e.g. +13214567890)", apiKeys: [{ // A list of API Key parameters. This field, if not needed, should be an empty array in your request body., apiKeyName: " (Human-readable name for an API Key.)", publicKey: " (The public component of a cryptographic key pair used to sign messages and transactions.)", curveType: "" // curveType field, expirationSeconds: " (Optional window (in seconds) indicating how long the API Key should last.)", }], authenticators: [{ // A list of Authenticator parameters. This field, if not needed, should be an empty array in your request body., authenticatorName: " (Human-readable name for an Authenticator.)", challenge: " (Challenge presented for authentication purposes.)", attestation: { // attestation field, credentialId: " (The cbor encoded then base64 url encoded id of the credential.)", clientDataJson: " (A base64 url encoded payload containing metadata about the signing context and the challenge.)", attestationObject: " (A base64 url encoded payload containing authenticator data and any attestation the webauthn provider chooses.)", transports: "" // The type of authenticator transports., }, }], oauthProviders: [{ // A list of Oauth providers. This field, if not needed, should be an empty array in your request body., providerName: " (Human-readable name to identify a Provider.)", oidcToken: " (Base64 encoded OIDC token)", oidcClaims: { // oidcClaims field, iss: " (The issuer identifier from the OIDC token (iss claim))", sub: " (The subject identifier from the OIDC token (sub claim))", aud: " (The audience from the OIDC token (aud claim))", }, }], userTags: [""] // A list of User Tag IDs. This field, if not needed, should be an empty array in your request body., }] }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_CREATE_USERS_V4", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "createUsersIntentV4": { "users": [ { "userName": "", "userEmail": "", "userPhoneNumber": "", "apiKeys": [ { "apiKeyName": "", "publicKey": "", "curveType": "", "expirationSeconds": "" } ], "authenticators": [ { "authenticatorName": "", "challenge": "", "attestation": { "credentialId": "", "clientDataJson": "", "attestationObject": "", "transports": [ "" ] } } ], "oauthProviders": [ { "providerName": "", "oidcToken": "", "oidcClaims": { "iss": "", "sub": "", "aud": "" } } ], "userTags": [ "" ] } ] } }, "result": { "createUsersResult": { "userIds": [ "" ] } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Create wallet Source: https://docs.turnkey.com/api-reference/activities/create-wallet Create a wallet and derive addresses. Enum options: `ACTIVITY_TYPE_CREATE_WALLET` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

Human-readable name for a Wallet.

A list of wallet Accounts. This field, if not needed, should be an empty array in your request body.

Enum options: `CURVE_SECP256K1`, `CURVE_ED25519`, `CURVE_P256` Enum options: `PATH_FORMAT_BIP32` Path used to generate a wallet Account. Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` Optional human-readable name for the account. Length of mnemonic to generate the Wallet seed. Defaults to 12. Accepted values: 12, 15, 18, 21, 24. Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The createWalletIntent object Human-readable name for a Wallet. A list of wallet Accounts. This field, if not needed, should be an empty array in your request body. curve field Enum options: `CURVE_SECP256K1`, `CURVE_ED25519`, `CURVE_P256` pathFormat field Enum options: `PATH_FORMAT_BIP32` Path used to generate a wallet Account. addressFormat field Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` Optional human-readable name for the account. Length of mnemonic to generate the Wallet seed. Defaults to 12. Accepted values: 12, 15, 18, 21, 24. The result of the activity The createWalletResult object Unique identifier for a Wallet. A list of account addresses. item field A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/create_wallet \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_CREATE_WALLET", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "walletName": "", "accounts": [ { "curve": "", "pathFormat": "", "path": "", "addressFormat": "", "name": "" } ], "mnemonicLength": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().createWallet({ walletName: " (Human-readable name for a Wallet.)", accounts: [{ // A list of wallet Accounts. This field, if not needed, should be an empty array in your request body., curve: "" // curve field, pathFormat: "" // pathFormat field, path: " (Path used to generate a wallet Account.)", addressFormat: "" // addressFormat field, name: " (Optional human-readable name for the account.)", }], mnemonicLength: 0 // Length of mnemonic to generate the Wallet seed. Defaults to 12. Accepted values: 12, 15, 18, 21, 24. }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_CREATE_WALLET", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "createWalletIntent": { "walletName": "", "accounts": [ { "curve": "", "pathFormat": "", "path": "", "addressFormat": "", "name": "" } ], "mnemonicLength": "" } }, "result": { "createWalletResult": { "walletId": "", "addresses": [ "" ] } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Create wallet accounts Source: https://docs.turnkey.com/api-reference/activities/create-wallet-accounts Derive additional addresses using an existing wallet. Enum options: `ACTIVITY_TYPE_CREATE_WALLET_ACCOUNTS` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

Unique identifier for a given Wallet.

A list of wallet Accounts.

Enum options: `CURVE_SECP256K1`, `CURVE_ED25519`, `CURVE_P256` Enum options: `PATH_FORMAT_BIP32` Path used to generate a wallet Account. Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` Optional human-readable name for the account. Indicates if the wallet accounts should be persisted. This is helpful if you'd like to see the addresses of different derivation paths without actually creating the accounts. Defaults to true. Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The createWalletAccountsIntent object Unique identifier for a given Wallet. A list of wallet Accounts. curve field Enum options: `CURVE_SECP256K1`, `CURVE_ED25519`, `CURVE_P256` pathFormat field Enum options: `PATH_FORMAT_BIP32` Path used to generate a wallet Account. addressFormat field Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` Optional human-readable name for the account. Indicates if the wallet accounts should be persisted. This is helpful if you'd like to see the addresses of different derivation paths without actually creating the accounts. Defaults to true. The result of the activity The createWalletAccountsResult object A list of derived addresses. item field A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/create_wallet_accounts \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_CREATE_WALLET_ACCOUNTS", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "walletId": "", "accounts": [ { "curve": "", "pathFormat": "", "path": "", "addressFormat": "", "name": "" } ], "persist": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().createWalletAccounts({ walletId: " (Unique identifier for a given Wallet.)", accounts: [{ // A list of wallet Accounts., curve: "" // curve field, pathFormat: "" // pathFormat field, path: " (Path used to generate a wallet Account.)", addressFormat: "" // addressFormat field, name: " (Optional human-readable name for the account.)", }], persist: true // Indicates if the wallet accounts should be persisted. This is helpful if you'd like to see the addresses of different derivation paths without actually creating the accounts. Defaults to true. }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_CREATE_WALLET_ACCOUNTS", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "createWalletAccountsIntent": { "walletId": "", "accounts": [ { "curve": "", "pathFormat": "", "path": "", "addressFormat": "", "name": "" } ], "persist": "" } }, "result": { "createWalletAccountsResult": { "addresses": [ "" ] } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Create webhook endpoint Source: https://docs.turnkey.com/api-reference/activities/create-webhook-endpoint Create a webhook endpoint for an organization. Enum options: `ACTIVITY_TYPE_CREATE_WEBHOOK_ENDPOINT` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

The destination URL for webhook delivery. Human-readable name for this webhook endpoint.

Event subscriptions to create for this endpoint.

The event type to subscribe to (for example, ACTIVITY\_UPDATES, BALANCE\_CONFIRMED\_UPDATES, or BALANCE\_FINALIZED\_UPDATES). JSON-encoded filter criteria for this subscription. Whether this subscription is active. Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The createWebhookEndpointIntent object The destination URL for webhook delivery. Human-readable name for this webhook endpoint. Event subscriptions to create for this endpoint. The event type to subscribe to (for example, ACTIVITY\_UPDATES, BALANCE\_CONFIRMED\_UPDATES, or BALANCE\_FINALIZED\_UPDATES). JSON-encoded filter criteria for this subscription. Whether this subscription is active. The result of the activity The createWebhookEndpointResult object Unique identifier of the created webhook endpoint. webhookEndpoint field Unique identifier of the webhook endpoint. Unique identifier for a given Organization. The destination URL for webhook delivery. Human-readable name for this webhook endpoint. Whether this webhook endpoint is active. Current subscriptions attached to this endpoint. The event type to subscribe to (for example, ACTIVITY\_UPDATES, BALANCE\_CONFIRMED\_UPDATES, or BALANCE\_FINALIZED\_UPDATES). JSON-encoded filter criteria for this subscription. Whether this subscription is active. A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/create_webhook_endpoint \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_CREATE_WEBHOOK_ENDPOINT", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "url": "", "name": "", "subscriptions": [ { "eventType": "", "filtersJson": "", "isActive": "" } ] } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().createWebhookEndpoint({ url: " (The destination URL for webhook delivery.)", name: " (Human-readable name for this webhook endpoint.)", subscriptions: [{ // Event subscriptions to create for this endpoint., eventType: " (The event type to subscribe to (for example, ACTIVITY_UPDATES, BALANCE_CONFIRMED_UPDATES, or BALANCE_FINALIZED_UPDATES).)", filtersJson: " (JSON-encoded filter criteria for this subscription.)", isActive: true // Whether this subscription is active., }] }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_CREATE_WEBHOOK_ENDPOINT", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "createWebhookEndpointIntent": { "url": "", "name": "", "subscriptions": [ { "eventType": "", "filtersJson": "", "isActive": "" } ] } }, "result": { "createWebhookEndpointResult": { "endpointId": "", "webhookEndpoint": { "endpointId": "", "organizationId": "", "url": "", "name": "", "isActive": "", "subscriptions": [ { "eventType": "", "filtersJson": "", "isActive": "" } ] } } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Delete a Fiat On Ramp Credential Source: https://docs.turnkey.com/api-reference/activities/delete-a-fiat-on-ramp-credential Delete a fiat on ramp provider credential Enum options: `ACTIVITY_TYPE_DELETE_FIAT_ON_RAMP_CREDENTIAL` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

The ID of the fiat on-ramp credential to delete Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The deleteFiatOnRampCredentialIntent object The ID of the fiat on-ramp credential to delete The result of the activity The deleteFiatOnRampCredentialResult object Unique identifier of the Fiat On-Ramp credential that was deleted A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/delete_fiat_on_ramp_credential \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_DELETE_FIAT_ON_RAMP_CREDENTIAL", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "fiatOnrampCredentialId": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().deleteFiatOnRampCredential({ fiatOnrampCredentialId: " (The ID of the fiat on-ramp credential to delete)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_DELETE_FIAT_ON_RAMP_CREDENTIAL", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "deleteFiatOnRampCredentialIntent": { "fiatOnrampCredentialId": "" } }, "result": { "deleteFiatOnRampCredentialResult": { "fiatOnRampCredentialId": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Delete a TVC App and all of its deployments Source: https://docs.turnkey.com/api-reference/activities/delete-a-tvc-app-and-all-of-its-deployments Delete a TVC App and all of its deployments Enum options: `ACTIVITY_TYPE_DELETE_TVC_APP_AND_DEPLOYMENTS` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

The unique identifier of the TVC app to delete. The app and all associated deployments will be removed. Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The deleteTvcAppAndDeploymentsIntent object The unique identifier of the TVC app to delete. The app and all associated deployments will be removed. The result of the activity The deleteTvcAppAndDeploymentsResult object The unique identifier of the deleted TVC app. A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/delete_tvc_app_and_deployments \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_DELETE_TVC_APP_AND_DEPLOYMENTS", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "appId": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().deleteTvcAppAndDeployments({ appId: " (The unique identifier of the TVC app to delete. The app and all associated deployments will be removed.)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_DELETE_TVC_APP_AND_DEPLOYMENTS", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "deleteTvcAppAndDeploymentsIntent": { "appId": "" } }, "result": { "deleteTvcAppAndDeploymentsResult": { "appId": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Delete a TVC Deployment Source: https://docs.turnkey.com/api-reference/activities/delete-a-tvc-deployment Delete a TVC Deployment Enum options: `ACTIVITY_TYPE_DELETE_TVC_DEPLOYMENT` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

The unique identifier of the TVC deployment to delete. Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The deleteTvcDeploymentIntent object The unique identifier of the TVC deployment to delete. The result of the activity The deleteTvcDeploymentResult object The unique identifier of the deleted TVC deployment. A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/delete_tvc_deployment \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_DELETE_TVC_DEPLOYMENT", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "deploymentId": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().deleteTvcDeployment({ deploymentId: " (The unique identifier of the TVC deployment to delete.)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_DELETE_TVC_DEPLOYMENT", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "deleteTvcDeploymentIntent": { "deploymentId": "" } }, "result": { "deleteTvcDeploymentResult": { "deploymentId": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Delete an OAuth 2.0 Credential Source: https://docs.turnkey.com/api-reference/activities/delete-an-oauth-20-credential Disable authentication for end users with an OAuth 2.0 provider Enum options: `ACTIVITY_TYPE_DELETE_OAUTH2_CREDENTIAL` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

The ID of the OAuth 2.0 credential to delete Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The deleteOauth2CredentialIntent object The ID of the OAuth 2.0 credential to delete The result of the activity The deleteOauth2CredentialResult object Unique identifier of the OAuth 2.0 credential that was deleted A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/delete_oauth2_credential \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_DELETE_OAUTH2_CREDENTIAL", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "oauth2CredentialId": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().deleteOauth2Credential({ oauth2CredentialId: " (The ID of the OAuth 2.0 credential to delete)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_DELETE_OAUTH2_CREDENTIAL", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "deleteOauth2CredentialIntent": { "oauth2CredentialId": "" } }, "result": { "deleteOauth2CredentialResult": { "oauth2CredentialId": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Delete API keys Source: https://docs.turnkey.com/api-reference/activities/delete-api-keys Remove api keys from a user. Enum options: `ACTIVITY_TYPE_DELETE_API_KEYS` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

Unique identifier for a given User.

A list of API Key IDs.

Array item type: string

item field

 Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The deleteApiKeysIntent object Unique identifier for a given User. A list of API Key IDs. item field The result of the activity The deleteApiKeysResult object A list of API Key IDs. item field A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/delete_api_keys \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_DELETE_API_KEYS", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "userId": "", "apiKeyIds": [ "" ] } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().deleteApiKeys({ userId: " (Unique identifier for a given User.)", apiKeyIds: [""] // A list of API Key IDs. }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_DELETE_API_KEYS", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "deleteApiKeysIntent": { "userId": "", "apiKeyIds": [ "" ] } }, "result": { "deleteApiKeysResult": { "apiKeyIds": [ "" ] } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Delete authenticators Source: https://docs.turnkey.com/api-reference/activities/delete-authenticators Remove authenticators from a user. Enum options: `ACTIVITY_TYPE_DELETE_AUTHENTICATORS` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

Unique identifier for a given User.

A list of Authenticator IDs.

Array item type: string

item field

 Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The deleteAuthenticatorsIntent object Unique identifier for a given User. A list of Authenticator IDs. item field The result of the activity The deleteAuthenticatorsResult object Unique identifier for a given Authenticator. item field A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/delete_authenticators \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_DELETE_AUTHENTICATORS", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "userId": "", "authenticatorIds": [ "" ] } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().deleteAuthenticators({ userId: " (Unique identifier for a given User.)", authenticatorIds: [""] // A list of Authenticator IDs. }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_DELETE_AUTHENTICATORS", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "deleteAuthenticatorsIntent": { "userId": "", "authenticatorIds": [ "" ] } }, "result": { "deleteAuthenticatorsResult": { "authenticatorIds": [ "" ] } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Delete invitation Source: https://docs.turnkey.com/api-reference/activities/delete-invitation Delete an existing invitation. Enum options: `ACTIVITY_TYPE_DELETE_INVITATION` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

Unique identifier for a given Invitation object. Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The deleteInvitationIntent object Unique identifier for a given Invitation object. The result of the activity The deleteInvitationResult object Unique identifier for a given Invitation. A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/delete_invitation \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_DELETE_INVITATION", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "invitationId": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().deleteInvitation({ invitationId: " (Unique identifier for a given Invitation object.)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_DELETE_INVITATION", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "deleteInvitationIntent": { "invitationId": "" } }, "result": { "deleteInvitationResult": { "invitationId": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Delete MFA policy Source: https://docs.turnkey.com/api-reference/activities/delete-mfa-policy Delete an MFA policy for a user. Enum options: `ACTIVITY_TYPE_DELETE_MFA_POLICY` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

The ID of the User to delete the MFA Policy from. Unique identifier for a given MFA Policy. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The deleteMfaPolicyIntent object The ID of the User to delete the MFA Policy from. Unique identifier for a given MFA Policy. The result of the activity The deleteMfaPolicyResult object Unique identifier for a given MFA Policy. A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/delete_mfa_policy \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_DELETE_MFA_POLICY", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "userId": "", "mfaPolicyId": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().deleteMfaPolicy({ userId: " (The ID of the User to delete the MFA Policy from.)", mfaPolicyId: " (Unique identifier for a given MFA Policy.)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_DELETE_MFA_POLICY", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "deleteMfaPolicyIntent": { "userId": "", "mfaPolicyId": "" } }, "result": { "deleteMfaPolicyResult": { "mfaPolicyId": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Delete Oauth providers Source: https://docs.turnkey.com/api-reference/activities/delete-oauth-providers Remove Oauth providers for a specified user. Enum options: `ACTIVITY_TYPE_DELETE_OAUTH_PROVIDERS` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

The ID of the User to remove an Oauth provider from

Unique identifier for a given Provider.

Array item type: string

item field

 Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The deleteOauthProvidersIntent object The ID of the User to remove an Oauth provider from Unique identifier for a given Provider. item field The result of the activity The deleteOauthProvidersResult object A list of unique identifiers for Oauth Providers item field A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/delete_oauth_providers \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_DELETE_OAUTH_PROVIDERS", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "userId": "", "providerIds": [ "" ] } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().deleteOauthProviders({ userId: " (The ID of the User to remove an Oauth provider from)", providerIds: [""] // Unique identifier for a given Provider. }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_DELETE_OAUTH_PROVIDERS", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "deleteOauthProvidersIntent": { "userId": "", "providerIds": [ "" ] } }, "result": { "deleteOauthProvidersResult": { "providerIds": [ "" ] } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Delete policies Source: https://docs.turnkey.com/api-reference/activities/delete-policies Delete existing policies. Enum options: `ACTIVITY_TYPE_DELETE_POLICIES` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

List of unique identifiers for policies within an organization

Array item type: string

item field

 Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The deletePoliciesIntent object List of unique identifiers for policies within an organization item field The result of the activity The deletePoliciesResult object A list of unique identifiers for the deleted policies. item field A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/delete_policies \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_DELETE_POLICIES", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "policyIds": [ "" ] } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().deletePolicies({ policyIds: [""] // List of unique identifiers for policies within an organization }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_DELETE_POLICIES", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "deletePoliciesIntent": { "policyIds": [ "" ] } }, "result": { "deletePoliciesResult": { "policyIds": [ "" ] } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Delete policy Source: https://docs.turnkey.com/api-reference/activities/delete-policy Delete an existing policy. Enum options: `ACTIVITY_TYPE_DELETE_POLICY` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

Unique identifier for a given Policy. Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The deletePolicyIntent object Unique identifier for a given Policy. The result of the activity The deletePolicyResult object Unique identifier for a given Policy. A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/delete_policy \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_DELETE_POLICY", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "policyId": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().deletePolicy({ policyId: " (Unique identifier for a given Policy.)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_DELETE_POLICY", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "deletePolicyIntent": { "policyId": "" } }, "result": { "deletePolicyResult": { "policyId": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Delete private key tags Source: https://docs.turnkey.com/api-reference/activities/delete-private-key-tags Delete private key tags within an organization. Enum options: `ACTIVITY_TYPE_DELETE_PRIVATE_KEY_TAGS` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

A list of Private Key Tag IDs.

Array item type: string

item field

 Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The deletePrivateKeyTagsIntent object A list of Private Key Tag IDs. item field The result of the activity The deletePrivateKeyTagsResult object A list of Private Key Tag IDs. item field A list of Private Key IDs. item field A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/delete_private_key_tags \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_DELETE_PRIVATE_KEY_TAGS", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "privateKeyTagIds": [ "" ] } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().deletePrivateKeyTags({ privateKeyTagIds: [""] // A list of Private Key Tag IDs. }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_DELETE_PRIVATE_KEY_TAGS", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "deletePrivateKeyTagsIntent": { "privateKeyTagIds": [ "" ] } }, "result": { "deletePrivateKeyTagsResult": { "privateKeyTagIds": [ "" ], "privateKeyIds": [ "" ] } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Delete private keys Source: https://docs.turnkey.com/api-reference/activities/delete-private-keys Delete private keys for an organization. Enum options: `ACTIVITY_TYPE_DELETE_PRIVATE_KEYS` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

List of unique identifiers for private keys within an organization

Array item type: string

item field

 Optional parameter for deleting the private keys, even if any have not been previously exported. If they have been exported, this field is ignored. Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The deletePrivateKeysIntent object List of unique identifiers for private keys within an organization item field Optional parameter for deleting the private keys, even if any have not been previously exported. If they have been exported, this field is ignored. The result of the activity The deletePrivateKeysResult object A list of private key unique identifiers that were removed item field A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/delete_private_keys \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_DELETE_PRIVATE_KEYS", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "privateKeyIds": [ "" ], "deleteWithoutExport": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().deletePrivateKeys({ privateKeyIds: [""] // List of unique identifiers for private keys within an organization, deleteWithoutExport: true // Optional parameter for deleting the private keys, even if any have not been previously exported. If they have been exported, this field is ignored. }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_DELETE_PRIVATE_KEYS", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "deletePrivateKeysIntent": { "privateKeyIds": [ "" ], "deleteWithoutExport": "" } }, "result": { "deletePrivateKeysResult": { "privateKeyIds": [ "" ] } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Delete smart contract interface Source: https://docs.turnkey.com/api-reference/activities/delete-smart-contract-interface Delete a smart contract interface. Enum options: `ACTIVITY_TYPE_DELETE_SMART_CONTRACT_INTERFACE` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

The ID of a Smart Contract Interface intended for deletion. Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The deleteSmartContractInterfaceIntent object The ID of a Smart Contract Interface intended for deletion. The result of the activity The deleteSmartContractInterfaceResult object The ID of the deleted Smart Contract Interface. A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/delete_smart_contract_interface \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_DELETE_SMART_CONTRACT_INTERFACE", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "smartContractInterfaceId": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().deleteSmartContractInterface({ smartContractInterfaceId: " (The ID of a Smart Contract Interface intended for deletion.)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_DELETE_SMART_CONTRACT_INTERFACE", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "deleteSmartContractInterfaceIntent": { "smartContractInterfaceId": "" } }, "result": { "deleteSmartContractInterfaceResult": { "smartContractInterfaceId": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Delete sub-organization Source: https://docs.turnkey.com/api-reference/activities/delete-sub-organization Delete a sub-organization. Enum options: `ACTIVITY_TYPE_DELETE_SUB_ORGANIZATION` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

Sub-organization deletion, by default, requires associated wallets and private keys to be exported for security reasons. Set this boolean to true to force sub-organization deletion even if some wallets or private keys within it have not been exported yet. Default: false. Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The deleteSubOrganizationIntent object Sub-organization deletion, by default, requires associated wallets and private keys to be exported for security reasons. Set this boolean to true to force sub-organization deletion even if some wallets or private keys within it have not been exported yet. Default: false. The result of the activity The deleteSubOrganizationResult object Unique identifier of the sub organization that was removed A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/delete_sub_organization \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_DELETE_SUB_ORGANIZATION", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "deleteWithoutExport": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().deleteSubOrganization({ deleteWithoutExport: true // Sub-organization deletion, by default, requires associated wallets and private keys to be exported for security reasons. Set this boolean to true to force sub-organization deletion even if some wallets or private keys within it have not been exported yet. Default: false. }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_DELETE_SUB_ORGANIZATION", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "deleteSubOrganizationIntent": { "deleteWithoutExport": "" } }, "result": { "deleteSubOrganizationResult": { "subOrganizationUuid": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Delete user tags Source: https://docs.turnkey.com/api-reference/activities/delete-user-tags Delete user tags within an organization. Enum options: `ACTIVITY_TYPE_DELETE_USER_TAGS` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

A list of User Tag IDs.

Array item type: string

item field

 Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The deleteUserTagsIntent object A list of User Tag IDs. item field The result of the activity The deleteUserTagsResult object A list of User Tag IDs. item field A list of User IDs. item field A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/delete_user_tags \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_DELETE_USER_TAGS", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "userTagIds": [ "" ] } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().deleteUserTags({ userTagIds: [""] // A list of User Tag IDs. }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_DELETE_USER_TAGS", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "deleteUserTagsIntent": { "userTagIds": [ "" ] } }, "result": { "deleteUserTagsResult": { "userTagIds": [ "" ], "userIds": [ "" ] } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Delete users Source: https://docs.turnkey.com/api-reference/activities/delete-users Delete users within an organization. Enum options: `ACTIVITY_TYPE_DELETE_USERS` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

A list of User IDs.

Array item type: string

item field

 Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The deleteUsersIntent object A list of User IDs. item field The result of the activity The deleteUsersResult object A list of User IDs. item field A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/delete_users \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_DELETE_USERS", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "userIds": [ "" ] } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().deleteUsers({ userIds: [""] // A list of User IDs. }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_DELETE_USERS", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "deleteUsersIntent": { "userIds": [ "" ] } }, "result": { "deleteUsersResult": { "userIds": [ "" ] } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Delete wallet accounts Source: https://docs.turnkey.com/api-reference/activities/delete-wallet-accounts Delete wallet accounts for an organization. Enum options: `ACTIVITY_TYPE_DELETE_WALLET_ACCOUNTS` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

List of unique identifiers for wallet accounts within an organization

Array item type: string

item field

 Optional parameter for deleting the wallet accounts, even if any have not been previously exported. If they have been exported, this field is ignored. Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The deleteWalletAccountsIntent object List of unique identifiers for wallet accounts within an organization item field Optional parameter for deleting the wallet accounts, even if any have not been previously exported. If they have been exported, this field is ignored. The result of the activity The deleteWalletAccountsResult object A list of wallet account unique identifiers that were removed item field A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/delete_wallet_accounts \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_DELETE_WALLET_ACCOUNTS", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "walletAccountIds": [ "" ], "deleteWithoutExport": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().deleteWalletAccounts({ walletAccountIds: [""] // List of unique identifiers for wallet accounts within an organization, deleteWithoutExport: true // Optional parameter for deleting the wallet accounts, even if any have not been previously exported. If they have been exported, this field is ignored. }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_DELETE_WALLET_ACCOUNTS", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "deleteWalletAccountsIntent": { "walletAccountIds": [ "" ], "deleteWithoutExport": "" } }, "result": { "deleteWalletAccountsResult": { "walletAccountIds": [ "" ] } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Delete wallets Source: https://docs.turnkey.com/api-reference/activities/delete-wallets Delete wallets for an organization. Enum options: `ACTIVITY_TYPE_DELETE_WALLETS` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

List of unique identifiers for wallets within an organization

Array item type: string

item field

 Optional parameter for deleting the wallets, even if any have not been previously exported. If they have been exported, this field is ignored. Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The deleteWalletsIntent object List of unique identifiers for wallets within an organization item field Optional parameter for deleting the wallets, even if any have not been previously exported. If they have been exported, this field is ignored. The result of the activity The deleteWalletsResult object A list of wallet unique identifiers that were removed item field A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/delete_wallets \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_DELETE_WALLETS", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "walletIds": [ "" ], "deleteWithoutExport": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().deleteWallets({ walletIds: [""] // List of unique identifiers for wallets within an organization, deleteWithoutExport: true // Optional parameter for deleting the wallets, even if any have not been previously exported. If they have been exported, this field is ignored. }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_DELETE_WALLETS", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "deleteWalletsIntent": { "walletIds": [ "" ], "deleteWithoutExport": "" } }, "result": { "deleteWalletsResult": { "walletIds": [ "" ] } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Delete webhook endpoint Source: https://docs.turnkey.com/api-reference/activities/delete-webhook-endpoint Delete a webhook endpoint for an organization. Enum options: `ACTIVITY_TYPE_DELETE_WEBHOOK_ENDPOINT` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

Unique identifier of the webhook endpoint to delete. Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The deleteWebhookEndpointIntent object Unique identifier of the webhook endpoint to delete. The result of the activity The deleteWebhookEndpointResult object Unique identifier of the deleted webhook endpoint. A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/delete_webhook_endpoint \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_DELETE_WEBHOOK_ENDPOINT", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "endpointId": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().deleteWebhookEndpoint({ endpointId: " (Unique identifier of the webhook endpoint to delete.)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_DELETE_WEBHOOK_ENDPOINT", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "deleteWebhookEndpointIntent": { "endpointId": "" } }, "result": { "deleteWebhookEndpointResult": { "endpointId": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Export private key Source: https://docs.turnkey.com/api-reference/activities/export-private-key Export a private key. Enum options: `ACTIVITY_TYPE_EXPORT_PRIVATE_KEY` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

Unique identifier for a given Private Key. Client-side public key generated by the user, to which the export bundle will be encrypted. Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The exportPrivateKeyIntent object Unique identifier for a given Private Key. Client-side public key generated by the user, to which the export bundle will be encrypted. The result of the activity The exportPrivateKeyResult object Unique identifier for a given Private Key. Export bundle containing a private key encrypted to the client's target public key. A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/export_private_key \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_EXPORT_PRIVATE_KEY", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "privateKeyId": "", "targetPublicKey": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().exportPrivateKey({ privateKeyId: " (Unique identifier for a given Private Key.)", targetPublicKey: " (Client-side public key generated by the user, to which the export bundle will be encrypted.)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_EXPORT_PRIVATE_KEY", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "exportPrivateKeyIntent": { "privateKeyId": "", "targetPublicKey": "" } }, "result": { "exportPrivateKeyResult": { "privateKeyId": "", "exportBundle": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Export wallet Source: https://docs.turnkey.com/api-reference/activities/export-wallet Export a wallet. Enum options: `ACTIVITY_TYPE_EXPORT_WALLET` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

Unique identifier for a given Wallet. Client-side public key generated by the user, to which the export bundle will be encrypted. Enum options: `MNEMONIC_LANGUAGE_ENGLISH`, `MNEMONIC_LANGUAGE_SIMPLIFIED_CHINESE`, `MNEMONIC_LANGUAGE_TRADITIONAL_CHINESE`, `MNEMONIC_LANGUAGE_CZECH`, `MNEMONIC_LANGUAGE_FRENCH`, `MNEMONIC_LANGUAGE_ITALIAN`, `MNEMONIC_LANGUAGE_JAPANESE`, `MNEMONIC_LANGUAGE_KOREAN`, `MNEMONIC_LANGUAGE_SPANISH` Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The exportWalletIntent object Unique identifier for a given Wallet. Client-side public key generated by the user, to which the export bundle will be encrypted. language field Enum options: `MNEMONIC_LANGUAGE_ENGLISH`, `MNEMONIC_LANGUAGE_SIMPLIFIED_CHINESE`, `MNEMONIC_LANGUAGE_TRADITIONAL_CHINESE`, `MNEMONIC_LANGUAGE_CZECH`, `MNEMONIC_LANGUAGE_FRENCH`, `MNEMONIC_LANGUAGE_ITALIAN`, `MNEMONIC_LANGUAGE_JAPANESE`, `MNEMONIC_LANGUAGE_KOREAN`, `MNEMONIC_LANGUAGE_SPANISH` The result of the activity The exportWalletResult object Unique identifier for a given Wallet. Export bundle containing a wallet mnemonic + optional newline passphrase encrypted by the client's target public key. A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/export_wallet \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_EXPORT_WALLET", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "walletId": "", "targetPublicKey": "", "language": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().exportWallet({ walletId: " (Unique identifier for a given Wallet.)", targetPublicKey: " (Client-side public key generated by the user, to which the export bundle will be encrypted.)", language: "" // language field }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_EXPORT_WALLET", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "exportWalletIntent": { "walletId": "", "targetPublicKey": "", "language": "" } }, "result": { "exportWalletResult": { "walletId": "", "exportBundle": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Export wallet account Source: https://docs.turnkey.com/api-reference/activities/export-wallet-account Export a wallet account. Enum options: `ACTIVITY_TYPE_EXPORT_WALLET_ACCOUNT` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

Address to identify Wallet Account. Client-side public key generated by the user, to which the export bundle will be encrypted. Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The exportWalletAccountIntent object Address to identify Wallet Account. Client-side public key generated by the user, to which the export bundle will be encrypted. The result of the activity The exportWalletAccountResult object Address to identify Wallet Account. Export bundle containing a private key encrypted by the client's target public key. A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/export_wallet_account \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_EXPORT_WALLET_ACCOUNT", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "address": "", "targetPublicKey": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().exportWalletAccount({ address: " (Address to identify Wallet Account.)", targetPublicKey: " (Client-side public key generated by the user, to which the export bundle will be encrypted.)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_EXPORT_WALLET_ACCOUNT", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "exportWalletAccountIntent": { "address": "", "targetPublicKey": "" } }, "result": { "exportWalletAccountResult": { "address": "", "exportBundle": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Import private key Source: https://docs.turnkey.com/api-reference/activities/import-private-key Import a private key. Enum options: `ACTIVITY_TYPE_IMPORT_PRIVATE_KEY` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

The ID of the User importing a Private Key. Human-readable name for a Private Key. Bundle containing a raw private key encrypted to the enclave's target public key. Enum options: `CURVE_SECP256K1`, `CURVE_ED25519`, `CURVE_P256` Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The importPrivateKeyIntent object The ID of the User importing a Private Key. Human-readable name for a Private Key. Bundle containing a raw private key encrypted to the enclave's target public key. curve field Enum options: `CURVE_SECP256K1`, `CURVE_ED25519`, `CURVE_P256` Cryptocurrency-specific formats for a derived address (e.g., Ethereum). item field Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` The result of the activity The importPrivateKeyResult object Unique identifier for a Private Key. A list of addresses. format field Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` address field A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/import_private_key \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_IMPORT_PRIVATE_KEY", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "userId": "", "privateKeyName": "", "encryptedBundle": "", "curve": "", "addressFormats": [ "" ] } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().importPrivateKey({ userId: " (The ID of the User importing a Private Key.)", privateKeyName: " (Human-readable name for a Private Key.)", encryptedBundle: " (Bundle containing a raw private key encrypted to the enclave's target public key.)", curve: "" // curve field, addressFormats: "" // Cryptocurrency-specific formats for a derived address (e.g., Ethereum). }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_IMPORT_PRIVATE_KEY", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "importPrivateKeyIntent": { "userId": "", "privateKeyName": "", "encryptedBundle": "", "curve": "", "addressFormats": [ "" ] } }, "result": { "importPrivateKeyResult": { "privateKeyId": "", "addresses": [ { "format": "", "address": "" } ] } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Import wallet Source: https://docs.turnkey.com/api-reference/activities/import-wallet Import a wallet. Enum options: `ACTIVITY_TYPE_IMPORT_WALLET` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

The ID of the User importing a Wallet. Human-readable name for a Wallet. Bundle containing a wallet mnemonic encrypted to the enclave's target public key.

A list of wallet Accounts.

Enum options: `CURVE_SECP256K1`, `CURVE_ED25519`, `CURVE_P256` Enum options: `PATH_FORMAT_BIP32` Path used to generate a wallet Account. Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` Optional human-readable name for the account. Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The importWalletIntent object The ID of the User importing a Wallet. Human-readable name for a Wallet. Bundle containing a wallet mnemonic encrypted to the enclave's target public key. A list of wallet Accounts. curve field Enum options: `CURVE_SECP256K1`, `CURVE_ED25519`, `CURVE_P256` pathFormat field Enum options: `PATH_FORMAT_BIP32` Path used to generate a wallet Account. addressFormat field Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` Optional human-readable name for the account. The result of the activity The importWalletResult object Unique identifier for a Wallet. A list of account addresses. item field A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/import_wallet \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_IMPORT_WALLET", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "userId": "", "walletName": "", "encryptedBundle": "", "accounts": [ { "curve": "", "pathFormat": "", "path": "", "addressFormat": "", "name": "" } ] } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().importWallet({ userId: " (The ID of the User importing a Wallet.)", walletName: " (Human-readable name for a Wallet.)", encryptedBundle: " (Bundle containing a wallet mnemonic encrypted to the enclave's target public key.)", accounts: [{ // A list of wallet Accounts., curve: "" // curve field, pathFormat: "" // pathFormat field, path: " (Path used to generate a wallet Account.)", addressFormat: "" // addressFormat field, name: " (Optional human-readable name for the account.)", }] }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_IMPORT_WALLET", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "importWalletIntent": { "userId": "", "walletName": "", "encryptedBundle": "", "accounts": [ { "curve": "", "pathFormat": "", "path": "", "addressFormat": "", "name": "" } ] } }, "result": { "importWalletResult": { "walletId": "", "addresses": [ "" ] } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Init email recovery Source: https://docs.turnkey.com/api-reference/activities/init-email-recovery Initialize a new email recovery. Enum options: `ACTIVITY_TYPE_INIT_USER_EMAIL_RECOVERY_V2` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

Email of the user starting recovery Client-side public key generated by the user, to which the recovery bundle will be encrypted. Expiration window (in seconds) indicating how long the recovery credential is valid for. If not provided, a default of 15 minutes will be used.

emailCustomization field

The name of the application. This field is required and will be used in email notifications if an email template is not provided. A URL pointing to a logo in PNG format. Note this logo will be resized to fit into 340px x 124px. A template for the URL to be used in a magic link button, e.g. `https://dapp.xyz/%s`. The auth bundle will be interpolated into the `%s`. JSON object containing key/value pairs to be used with custom templates. Unique identifier for a given Email Template. If not specified, the default is the most recent Email Template. Optional custom email address from which to send the OTP email Optional custom sender name for use with sendFromEmailAddress; if left empty, will default to 'Notifications' Optional custom email address to use as reply-to Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The initUserEmailRecoveryIntentV2 object Email of the user starting recovery Client-side public key generated by the user, to which the recovery bundle will be encrypted. Expiration window (in seconds) indicating how long the recovery credential is valid for. If not provided, a default of 15 minutes will be used. emailCustomization field The name of the application. This field is required and will be used in email notifications if an email template is not provided. A URL pointing to a logo in PNG format. Note this logo will be resized to fit into 340px x 124px. A template for the URL to be used in a magic link button, e.g. `https://dapp.xyz/%s`. The auth bundle will be interpolated into the `%s`. JSON object containing key/value pairs to be used with custom templates. Unique identifier for a given Email Template. If not specified, the default is the most recent Email Template. Optional custom email address from which to send the OTP email Optional custom sender name for use with sendFromEmailAddress; if left empty, will default to 'Notifications' Optional custom email address to use as reply-to The result of the activity The initUserEmailRecoveryResult object Unique identifier for the user being recovered. A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/init_user_email_recovery \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_INIT_USER_EMAIL_RECOVERY_V2", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "email": "", "targetPublicKey": "", "expirationSeconds": "", "emailCustomization": { "appName": "", "logoUrl": "", "magicLinkTemplate": "", "templateVariables": "", "templateId": "" }, "sendFromEmailAddress": "", "sendFromEmailSenderName": "", "replyToEmailAddress": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().initUserEmailRecovery({ email: " (Email of the user starting recovery)", targetPublicKey: " (Client-side public key generated by the user, to which the recovery bundle will be encrypted.)", expirationSeconds: " (Expiration window (in seconds) indicating how long the recovery credential is valid for. If not provided, a default of 15 minutes will be used.)", emailCustomization: { // emailCustomization field, appName: " (The name of the application. This field is required and will be used in email notifications if an email template is not provided.)", logoUrl: " (A URL pointing to a logo in PNG format. Note this logo will be resized to fit into 340px x 124px.)", magicLinkTemplate: " (A template for the URL to be used in a magic link button, e.g. `https://dapp.xyz/%s`. The auth bundle will be interpolated into the `%s`.)", templateVariables: " (JSON object containing key/value pairs to be used with custom templates.)", templateId: " (Unique identifier for a given Email Template. If not specified, the default is the most recent Email Template.)", }, sendFromEmailAddress: " (Optional custom email address from which to send the OTP email)", sendFromEmailSenderName: " (Optional custom sender name for use with sendFromEmailAddress; if left empty, will default to 'Notifications')", replyToEmailAddress: " (Optional custom email address to use as reply-to)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_INIT_USER_EMAIL_RECOVERY_V2", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "initUserEmailRecoveryIntentV2": { "email": "", "targetPublicKey": "", "expirationSeconds": "", "emailCustomization": { "appName": "", "logoUrl": "", "magicLinkTemplate": "", "templateVariables": "", "templateId": "" }, "sendFromEmailAddress": "", "sendFromEmailSenderName": "", "replyToEmailAddress": "" } }, "result": { "initUserEmailRecoveryResult": { "userId": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Init fiat on ramp Source: https://docs.turnkey.com/api-reference/activities/init-fiat-on-ramp Initiate a fiat on ramp flow. Enum options: `ACTIVITY_TYPE_INIT_FIAT_ON_RAMP` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

Enum options: `FIAT_ON_RAMP_PROVIDER_COINBASE`, `FIAT_ON_RAMP_PROVIDER_MOONPAY` Destination wallet address for the buy transaction. Enum options: `FIAT_ON_RAMP_BLOCKCHAIN_NETWORK_BITCOIN`, `FIAT_ON_RAMP_BLOCKCHAIN_NETWORK_ETHEREUM`, `FIAT_ON_RAMP_BLOCKCHAIN_NETWORK_SOLANA`, `FIAT_ON_RAMP_BLOCKCHAIN_NETWORK_BASE` Enum options: `FIAT_ON_RAMP_CRYPTO_CURRENCY_BTC`, `FIAT_ON_RAMP_CRYPTO_CURRENCY_ETH`, `FIAT_ON_RAMP_CRYPTO_CURRENCY_SOL`, `FIAT_ON_RAMP_CRYPTO_CURRENCY_USDC` Enum options: `FIAT_ON_RAMP_CURRENCY_AUD`, `FIAT_ON_RAMP_CURRENCY_BGN`, `FIAT_ON_RAMP_CURRENCY_BRL`, `FIAT_ON_RAMP_CURRENCY_CAD`, `FIAT_ON_RAMP_CURRENCY_CHF`, `FIAT_ON_RAMP_CURRENCY_COP`, `FIAT_ON_RAMP_CURRENCY_CZK`, `FIAT_ON_RAMP_CURRENCY_DKK`, `FIAT_ON_RAMP_CURRENCY_DOP`, `FIAT_ON_RAMP_CURRENCY_EGP`, `FIAT_ON_RAMP_CURRENCY_EUR`, `FIAT_ON_RAMP_CURRENCY_GBP`, `FIAT_ON_RAMP_CURRENCY_HKD`, `FIAT_ON_RAMP_CURRENCY_IDR`, `FIAT_ON_RAMP_CURRENCY_ILS`, `FIAT_ON_RAMP_CURRENCY_JOD`, `FIAT_ON_RAMP_CURRENCY_KES`, `FIAT_ON_RAMP_CURRENCY_KWD`, `FIAT_ON_RAMP_CURRENCY_LKR`, `FIAT_ON_RAMP_CURRENCY_MXN`, `FIAT_ON_RAMP_CURRENCY_NGN`, `FIAT_ON_RAMP_CURRENCY_NOK`, `FIAT_ON_RAMP_CURRENCY_NZD`, `FIAT_ON_RAMP_CURRENCY_OMR`, `FIAT_ON_RAMP_CURRENCY_PEN`, `FIAT_ON_RAMP_CURRENCY_PLN`, `FIAT_ON_RAMP_CURRENCY_RON`, `FIAT_ON_RAMP_CURRENCY_SEK`, `FIAT_ON_RAMP_CURRENCY_THB`, `FIAT_ON_RAMP_CURRENCY_TRY`, `FIAT_ON_RAMP_CURRENCY_TWD`, `FIAT_ON_RAMP_CURRENCY_USD`, `FIAT_ON_RAMP_CURRENCY_VND`, `FIAT_ON_RAMP_CURRENCY_ZAR` Specifies a preset fiat amount for the transaction, e.g., '100'. Must be greater than '20'. If not provided, the user will be prompted to enter an amount. Enum options: `FIAT_ON_RAMP_PAYMENT_METHOD_CREDIT_DEBIT_CARD`, `FIAT_ON_RAMP_PAYMENT_METHOD_APPLE_PAY`, `FIAT_ON_RAMP_PAYMENT_METHOD_GBP_BANK_TRANSFER`, `FIAT_ON_RAMP_PAYMENT_METHOD_GBP_OPEN_BANKING_PAYMENT`, `FIAT_ON_RAMP_PAYMENT_METHOD_GOOGLE_PAY`, `FIAT_ON_RAMP_PAYMENT_METHOD_SEPA_BANK_TRANSFER`, `FIAT_ON_RAMP_PAYMENT_METHOD_PIX_INSTANT_PAYMENT`, `FIAT_ON_RAMP_PAYMENT_METHOD_PAYPAL`, `FIAT_ON_RAMP_PAYMENT_METHOD_VENMO`, `FIAT_ON_RAMP_PAYMENT_METHOD_MOONPAY_BALANCE`, `FIAT_ON_RAMP_PAYMENT_METHOD_CRYPTO_ACCOUNT`, `FIAT_ON_RAMP_PAYMENT_METHOD_FIAT_WALLET`, `FIAT_ON_RAMP_PAYMENT_METHOD_ACH_BANK_ACCOUNT` ISO 3166-1 two-digit country code for Coinbase representing the purchasing user’s country of residence, e.g., US, GB. ISO 3166-2 two-digit country subdivision code for Coinbase representing the purchasing user’s subdivision of residence within their country, e.g. NY. Required if country\_code=US. Optional flag to indicate whether to use the sandbox mode to simulate transactions for the on-ramp provider. Default is false. Optional MoonPay Widget URL to sign when using MoonPay client SDKs with URL Signing enabled. Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The initFiatOnRampIntent object onrampProvider field Enum options: `FIAT_ON_RAMP_PROVIDER_COINBASE`, `FIAT_ON_RAMP_PROVIDER_MOONPAY` Destination wallet address for the buy transaction. network field Enum options: `FIAT_ON_RAMP_BLOCKCHAIN_NETWORK_BITCOIN`, `FIAT_ON_RAMP_BLOCKCHAIN_NETWORK_ETHEREUM`, `FIAT_ON_RAMP_BLOCKCHAIN_NETWORK_SOLANA`, `FIAT_ON_RAMP_BLOCKCHAIN_NETWORK_BASE` cryptoCurrencyCode field Enum options: `FIAT_ON_RAMP_CRYPTO_CURRENCY_BTC`, `FIAT_ON_RAMP_CRYPTO_CURRENCY_ETH`, `FIAT_ON_RAMP_CRYPTO_CURRENCY_SOL`, `FIAT_ON_RAMP_CRYPTO_CURRENCY_USDC` fiatCurrencyCode field Enum options: `FIAT_ON_RAMP_CURRENCY_AUD`, `FIAT_ON_RAMP_CURRENCY_BGN`, `FIAT_ON_RAMP_CURRENCY_BRL`, `FIAT_ON_RAMP_CURRENCY_CAD`, `FIAT_ON_RAMP_CURRENCY_CHF`, `FIAT_ON_RAMP_CURRENCY_COP`, `FIAT_ON_RAMP_CURRENCY_CZK`, `FIAT_ON_RAMP_CURRENCY_DKK`, `FIAT_ON_RAMP_CURRENCY_DOP`, `FIAT_ON_RAMP_CURRENCY_EGP`, `FIAT_ON_RAMP_CURRENCY_EUR`, `FIAT_ON_RAMP_CURRENCY_GBP`, `FIAT_ON_RAMP_CURRENCY_HKD`, `FIAT_ON_RAMP_CURRENCY_IDR`, `FIAT_ON_RAMP_CURRENCY_ILS`, `FIAT_ON_RAMP_CURRENCY_JOD`, `FIAT_ON_RAMP_CURRENCY_KES`, `FIAT_ON_RAMP_CURRENCY_KWD`, `FIAT_ON_RAMP_CURRENCY_LKR`, `FIAT_ON_RAMP_CURRENCY_MXN`, `FIAT_ON_RAMP_CURRENCY_NGN`, `FIAT_ON_RAMP_CURRENCY_NOK`, `FIAT_ON_RAMP_CURRENCY_NZD`, `FIAT_ON_RAMP_CURRENCY_OMR`, `FIAT_ON_RAMP_CURRENCY_PEN`, `FIAT_ON_RAMP_CURRENCY_PLN`, `FIAT_ON_RAMP_CURRENCY_RON`, `FIAT_ON_RAMP_CURRENCY_SEK`, `FIAT_ON_RAMP_CURRENCY_THB`, `FIAT_ON_RAMP_CURRENCY_TRY`, `FIAT_ON_RAMP_CURRENCY_TWD`, `FIAT_ON_RAMP_CURRENCY_USD`, `FIAT_ON_RAMP_CURRENCY_VND`, `FIAT_ON_RAMP_CURRENCY_ZAR` Specifies a preset fiat amount for the transaction, e.g., '100'. Must be greater than '20'. If not provided, the user will be prompted to enter an amount. paymentMethod field Enum options: `FIAT_ON_RAMP_PAYMENT_METHOD_CREDIT_DEBIT_CARD`, `FIAT_ON_RAMP_PAYMENT_METHOD_APPLE_PAY`, `FIAT_ON_RAMP_PAYMENT_METHOD_GBP_BANK_TRANSFER`, `FIAT_ON_RAMP_PAYMENT_METHOD_GBP_OPEN_BANKING_PAYMENT`, `FIAT_ON_RAMP_PAYMENT_METHOD_GOOGLE_PAY`, `FIAT_ON_RAMP_PAYMENT_METHOD_SEPA_BANK_TRANSFER`, `FIAT_ON_RAMP_PAYMENT_METHOD_PIX_INSTANT_PAYMENT`, `FIAT_ON_RAMP_PAYMENT_METHOD_PAYPAL`, `FIAT_ON_RAMP_PAYMENT_METHOD_VENMO`, `FIAT_ON_RAMP_PAYMENT_METHOD_MOONPAY_BALANCE`, `FIAT_ON_RAMP_PAYMENT_METHOD_CRYPTO_ACCOUNT`, `FIAT_ON_RAMP_PAYMENT_METHOD_FIAT_WALLET`, `FIAT_ON_RAMP_PAYMENT_METHOD_ACH_BANK_ACCOUNT` ISO 3166-1 two-digit country code for Coinbase representing the purchasing user’s country of residence, e.g., US, GB. ISO 3166-2 two-digit country subdivision code for Coinbase representing the purchasing user’s subdivision of residence within their country, e.g. NY. Required if country\_code=US. Optional flag to indicate whether to use the sandbox mode to simulate transactions for the on-ramp provider. Default is false. Optional MoonPay Widget URL to sign when using MoonPay client SDKs with URL Signing enabled. The result of the activity The initFiatOnRampResult object Unique URL for a given fiat on-ramp flow. Unique identifier used to retrieve transaction statuses for a given fiat on-ramp flow. Optional signature of the MoonPay Widget URL. The signature is generated if the Init Fiat On Ramp intent includes the urlForSignature field. The signature can be used to initialize the MoonPay SDKs when URL signing is enabled for your project. A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/init_fiat_on_ramp \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_INIT_FIAT_ON_RAMP", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "onrampProvider": "", "walletAddress": "", "network": "", "cryptoCurrencyCode": "", "fiatCurrencyCode": "", "fiatCurrencyAmount": "", "paymentMethod": "", "countryCode": "", "countrySubdivisionCode": "", "sandboxMode": "", "urlForSignature": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().initFiatOnRamp({ onrampProvider: "" // onrampProvider field, walletAddress: " (Destination wallet address for the buy transaction.)", network: "" // network field, cryptoCurrencyCode: "" // cryptoCurrencyCode field, fiatCurrencyCode: "" // fiatCurrencyCode field, fiatCurrencyAmount: " (Specifies a preset fiat amount for the transaction, e.g., '100'. Must be greater than '20'. If not provided, the user will be prompted to enter an amount.)", paymentMethod: "" // paymentMethod field, countryCode: " (ISO 3166-1 two-digit country code for Coinbase representing the purchasing user’s country of residence, e.g., US, GB.)", countrySubdivisionCode: " (ISO 3166-2 two-digit country subdivision code for Coinbase representing the purchasing user’s subdivision of residence within their country, e.g. NY. Required if country_code=US.)", sandboxMode: true // Optional flag to indicate whether to use the sandbox mode to simulate transactions for the on-ramp provider. Default is false., urlForSignature: " (Optional MoonPay Widget URL to sign when using MoonPay client SDKs with URL Signing enabled.)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_INIT_FIAT_ON_RAMP", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "initFiatOnRampIntent": { "onrampProvider": "", "walletAddress": "", "network": "", "cryptoCurrencyCode": "", "fiatCurrencyCode": "", "fiatCurrencyAmount": "", "paymentMethod": "", "countryCode": "", "countrySubdivisionCode": "", "sandboxMode": "", "urlForSignature": "" } }, "result": { "initFiatOnRampResult": { "onRampUrl": "", "onRampTransactionId": "", "onRampUrlSignature": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Init generic OTP Source: https://docs.turnkey.com/api-reference/activities/init-generic-otp Initiate a generic OTP activity. Enum options: `ACTIVITY_TYPE_INIT_OTP_V3` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

Whether to send OTP via SMS or email. Possible values: OTP\_TYPE\_SMS, OTP\_TYPE\_EMAIL Email or phone number to send the OTP code to The name of the application. Optional length of the OTP code. Default = 9

emailCustomization field

A URL pointing to a logo in PNG format. Note this logo will be resized to fit into 340px x 124px. A template for the URL to be used in a magic link button, e.g. `https://dapp.xyz/%s`. The auth bundle will be interpolated into the `%s`. JSON object containing key/value pairs to be used with custom templates. Unique identifier for a given Email Template. If not specified, the default is the most recent Email Template.

smsCustomization field

Template containing references to .OtpCode i.e Your OTP is \{\{.OtpCode}} Optional client-generated user identifier to enable per-user rate limiting for SMS auth. We recommend using a hash of the client-side IP address. Optional custom email address from which to send the OTP email Optional flag to specify if the OTP code should be alphanumeric (Crockford’s Base32). If set to false, OTP code will only be numeric. Default = true Optional custom sender name for use with sendFromEmailAddress; if left empty, will default to 'Notifications' Expiration window (in seconds) indicating how long the OTP is valid for. If not provided, a default of 5 minutes will be used. Maximum value is 600 seconds (10 minutes) Optional custom email address to use as reply-to Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The initOtpIntentV3 object Whether to send OTP via SMS or email. Possible values: OTP\_TYPE\_SMS, OTP\_TYPE\_EMAIL Email or phone number to send the OTP code to The name of the application. Optional length of the OTP code. Default = 9 emailCustomization field A URL pointing to a logo in PNG format. Note this logo will be resized to fit into 340px x 124px. A template for the URL to be used in a magic link button, e.g. `https://dapp.xyz/%s`. The auth bundle will be interpolated into the `%s`. JSON object containing key/value pairs to be used with custom templates. Unique identifier for a given Email Template. If not specified, the default is the most recent Email Template. smsCustomization field Template containing references to .OtpCode i.e Your OTP is \{\{.OtpCode}} Optional client-generated user identifier to enable per-user rate limiting for SMS auth. We recommend using a hash of the client-side IP address. Optional custom email address from which to send the OTP email Optional flag to specify if the OTP code should be alphanumeric (Crockford’s Base32). If set to false, OTP code will only be numeric. Default = true Optional custom sender name for use with sendFromEmailAddress; if left empty, will default to 'Notifications' Expiration window (in seconds) indicating how long the OTP is valid for. If not provided, a default of 5 minutes will be used. Maximum value is 600 seconds (10 minutes) Optional custom email address to use as reply-to The result of the activity The initOtpResultV2 object Unique identifier for an OTP flow Signed bundle containing a target encryption key to use when submitting OTP codes. A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/init_otp \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_INIT_OTP_V3", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "otpType": "", "contact": "", "appName": "", "otpLength": "", "emailCustomization": { "logoUrl": "", "magicLinkTemplate": "", "templateVariables": "", "templateId": "" }, "smsCustomization": { "template": "" }, "userIdentifier": "", "sendFromEmailAddress": "", "alphanumeric": "", "sendFromEmailSenderName": "", "expirationSeconds": "", "replyToEmailAddress": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().initOtp({ otpType: " (Whether to send OTP via SMS or email. Possible values: OTP_TYPE_SMS, OTP_TYPE_EMAIL)", contact: " (Email or phone number to send the OTP code to)", appName: " (The name of the application.)", otpLength: 0 // Optional length of the OTP code. Default = 9, emailCustomization: { // emailCustomization field, logoUrl: " (A URL pointing to a logo in PNG format. Note this logo will be resized to fit into 340px x 124px.)", magicLinkTemplate: " (A template for the URL to be used in a magic link button, e.g. `https://dapp.xyz/%s`. The auth bundle will be interpolated into the `%s`.)", templateVariables: " (JSON object containing key/value pairs to be used with custom templates.)", templateId: " (Unique identifier for a given Email Template. If not specified, the default is the most recent Email Template.)", }, smsCustomization: { // smsCustomization field, template: " (Template containing references to .OtpCode i.e Your OTP is {{.OtpCode}})", }, userIdentifier: " (Optional client-generated user identifier to enable per-user rate limiting for SMS auth. We recommend using a hash of the client-side IP address.)", sendFromEmailAddress: " (Optional custom email address from which to send the OTP email)", alphanumeric: true // Optional flag to specify if the OTP code should be alphanumeric (Crockford’s Base32). If set to false, OTP code will only be numeric. Default = true, sendFromEmailSenderName: " (Optional custom sender name for use with sendFromEmailAddress; if left empty, will default to 'Notifications')", expirationSeconds: " (Expiration window (in seconds) indicating how long the OTP is valid for. If not provided, a default of 5 minutes will be used. Maximum value is 600 seconds (10 minutes))", replyToEmailAddress: " (Optional custom email address to use as reply-to)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_INIT_OTP_V3", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "initOtpIntentV3": { "otpType": "", "contact": "", "appName": "", "otpLength": "", "emailCustomization": { "logoUrl": "", "magicLinkTemplate": "", "templateVariables": "", "templateId": "" }, "smsCustomization": { "template": "" }, "userIdentifier": "", "sendFromEmailAddress": "", "alphanumeric": "", "sendFromEmailSenderName": "", "expirationSeconds": "", "replyToEmailAddress": "" } }, "result": { "initOtpResultV2": { "otpId": "", "otpEncryptionTargetBundle": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Init import private key Source: https://docs.turnkey.com/api-reference/activities/init-import-private-key Initialize a new private key import. Enum options: `ACTIVITY_TYPE_INIT_IMPORT_PRIVATE_KEY` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

The ID of the User importing a Private Key. Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The initImportPrivateKeyIntent object The ID of the User importing a Private Key. The result of the activity The initImportPrivateKeyResult object Import bundle containing a public key and signature to use for importing client data. A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/init_import_private_key \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_INIT_IMPORT_PRIVATE_KEY", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "userId": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().initImportPrivateKey({ userId: " (The ID of the User importing a Private Key.)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_INIT_IMPORT_PRIVATE_KEY", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "initImportPrivateKeyIntent": { "userId": "" } }, "result": { "initImportPrivateKeyResult": { "importBundle": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Init import wallet Source: https://docs.turnkey.com/api-reference/activities/init-import-wallet Initialize a new wallet import. Enum options: `ACTIVITY_TYPE_INIT_IMPORT_WALLET` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

The ID of the User importing a Wallet. Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The initImportWalletIntent object The ID of the User importing a Wallet. The result of the activity The initImportWalletResult object Import bundle containing a public key and signature to use for importing client data. A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/init_import_wallet \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_INIT_IMPORT_WALLET", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "userId": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().initImportWallet({ userId: " (The ID of the User importing a Wallet.)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_INIT_IMPORT_WALLET", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "initImportWalletIntent": { "userId": "" } }, "result": { "initImportWalletResult": { "importBundle": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Init OTP auth Source: https://docs.turnkey.com/api-reference/activities/init-otp-auth Initiate an OTP auth activity. Enum options: `ACTIVITY_TYPE_INIT_OTP_AUTH_V3` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

Whether to send OTP via SMS or email. Possible values: OTP\_TYPE\_SMS, OTP\_TYPE\_EMAIL Email or phone number to send the OTP code to Optional length of the OTP code. Default = 9 The name of the application. This field is required and will be used in email notifications if an email template is not provided.

emailCustomization field

A URL pointing to a logo in PNG format. Note this logo will be resized to fit into 340px x 124px. A template for the URL to be used in a magic link button, e.g. `https://dapp.xyz/%s`. The auth bundle will be interpolated into the `%s`. JSON object containing key/value pairs to be used with custom templates. Unique identifier for a given Email Template. If not specified, the default is the most recent Email Template.

smsCustomization field

Template containing references to .OtpCode i.e Your OTP is \{\{.OtpCode}} Optional client-generated user identifier to enable per-user rate limiting for SMS auth. We recommend using a hash of the client-side IP address. Optional custom email address from which to send the OTP email Optional flag to specify if the OTP code should be alphanumeric (Crockford’s Base32). Default = true Optional custom sender name for use with sendFromEmailAddress; if left empty, will default to 'Notifications' Expiration window (in seconds) indicating how long the OTP is valid for. If not provided, a default of 5 minutes will be used. Maximum value is 600 seconds (10 minutes) Optional custom email address to use as reply-to Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The initOtpAuthIntentV3 object Whether to send OTP via SMS or email. Possible values: OTP\_TYPE\_SMS, OTP\_TYPE\_EMAIL Email or phone number to send the OTP code to Optional length of the OTP code. Default = 9 The name of the application. This field is required and will be used in email notifications if an email template is not provided. emailCustomization field A URL pointing to a logo in PNG format. Note this logo will be resized to fit into 340px x 124px. A template for the URL to be used in a magic link button, e.g. `https://dapp.xyz/%s`. The auth bundle will be interpolated into the `%s`. JSON object containing key/value pairs to be used with custom templates. Unique identifier for a given Email Template. If not specified, the default is the most recent Email Template. smsCustomization field Template containing references to .OtpCode i.e Your OTP is \{\{.OtpCode}} Optional client-generated user identifier to enable per-user rate limiting for SMS auth. We recommend using a hash of the client-side IP address. Optional custom email address from which to send the OTP email Optional flag to specify if the OTP code should be alphanumeric (Crockford’s Base32). Default = true Optional custom sender name for use with sendFromEmailAddress; if left empty, will default to 'Notifications' Expiration window (in seconds) indicating how long the OTP is valid for. If not provided, a default of 5 minutes will be used. Maximum value is 600 seconds (10 minutes) Optional custom email address to use as reply-to The result of the activity The initOtpAuthResultV2 object Unique identifier for an OTP authentication A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/init_otp_auth \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_INIT_OTP_AUTH_V3", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "otpType": "", "contact": "", "otpLength": "", "appName": "", "emailCustomization": { "logoUrl": "", "magicLinkTemplate": "", "templateVariables": "", "templateId": "" }, "smsCustomization": { "template": "" }, "userIdentifier": "", "sendFromEmailAddress": "", "alphanumeric": "", "sendFromEmailSenderName": "", "expirationSeconds": "", "replyToEmailAddress": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().initOtpAuth({ otpType: " (Whether to send OTP via SMS or email. Possible values: OTP_TYPE_SMS, OTP_TYPE_EMAIL)", contact: " (Email or phone number to send the OTP code to)", otpLength: 0 // Optional length of the OTP code. Default = 9, appName: " (The name of the application. This field is required and will be used in email notifications if an email template is not provided.)", emailCustomization: { // emailCustomization field, logoUrl: " (A URL pointing to a logo in PNG format. Note this logo will be resized to fit into 340px x 124px.)", magicLinkTemplate: " (A template for the URL to be used in a magic link button, e.g. `https://dapp.xyz/%s`. The auth bundle will be interpolated into the `%s`.)", templateVariables: " (JSON object containing key/value pairs to be used with custom templates.)", templateId: " (Unique identifier for a given Email Template. If not specified, the default is the most recent Email Template.)", }, smsCustomization: { // smsCustomization field, template: " (Template containing references to .OtpCode i.e Your OTP is {{.OtpCode}})", }, userIdentifier: " (Optional client-generated user identifier to enable per-user rate limiting for SMS auth. We recommend using a hash of the client-side IP address.)", sendFromEmailAddress: " (Optional custom email address from which to send the OTP email)", alphanumeric: true // Optional flag to specify if the OTP code should be alphanumeric (Crockford’s Base32). Default = true, sendFromEmailSenderName: " (Optional custom sender name for use with sendFromEmailAddress; if left empty, will default to 'Notifications')", expirationSeconds: " (Expiration window (in seconds) indicating how long the OTP is valid for. If not provided, a default of 5 minutes will be used. Maximum value is 600 seconds (10 minutes))", replyToEmailAddress: " (Optional custom email address to use as reply-to)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_INIT_OTP_AUTH_V3", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "initOtpAuthIntentV3": { "otpType": "", "contact": "", "otpLength": "", "appName": "", "emailCustomization": { "logoUrl": "", "magicLinkTemplate": "", "templateVariables": "", "templateId": "" }, "smsCustomization": { "template": "" }, "userIdentifier": "", "sendFromEmailAddress": "", "alphanumeric": "", "sendFromEmailSenderName": "", "expirationSeconds": "", "replyToEmailAddress": "" } }, "result": { "initOtpAuthResultV2": { "otpId": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Login with a stamp Source: https://docs.turnkey.com/api-reference/activities/login-with-a-stamp Create a session for a user through stamping client side (API key, wallet client, or passkey client). Enum options: `ACTIVITY_TYPE_STAMP_LOGIN` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

Client-side public key generated by the user, which will be conditionally added to org data based on the passkey stamp associated with this request Expiration window (in seconds) indicating how long the Session is valid for. If not provided, a default of 15 minutes will be used. Invalidate all other previously generated Login API keys Optional session profile ID to specify which Session Profile to use for this login. If not provided, the default read/write session will be used. Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The stampLoginIntent object Client-side public key generated by the user, which will be conditionally added to org data based on the passkey stamp associated with this request Expiration window (in seconds) indicating how long the Session is valid for. If not provided, a default of 15 minutes will be used. Invalidate all other previously generated Login API keys Optional session profile ID to specify which Session Profile to use for this login. If not provided, the default read/write session will be used. The result of the activity The stampLoginResult object Signed JWT containing an expiry, public key, session type, user id, and organization id A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/stamp_login \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_STAMP_LOGIN", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "publicKey": "", "expirationSeconds": "", "invalidateExisting": "", "sessionProfileId": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().stampLogin({ publicKey: " (Client-side public key generated by the user, which will be conditionally added to org data based on the passkey stamp associated with this request)", expirationSeconds: " (Expiration window (in seconds) indicating how long the Session is valid for. If not provided, a default of 15 minutes will be used.)", invalidateExisting: true // Invalidate all other previously generated Login API keys, sessionProfileId: " (Optional session profile ID to specify which Session Profile to use for this login. If not provided, the default read/write session will be used.)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_STAMP_LOGIN", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "stampLoginIntent": { "publicKey": "", "expirationSeconds": "", "invalidateExisting": "", "sessionProfileId": "" } }, "result": { "stampLoginResult": { "session": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Login with Oauth Source: https://docs.turnkey.com/api-reference/activities/login-with-oauth Create an Oauth session for a user. Enum options: `ACTIVITY_TYPE_OAUTH_LOGIN` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

Base64 encoded OIDC token Client-side public key generated by the user, which will be conditionally added to org data based on the validity of the oidc token associated with this request Expiration window (in seconds) indicating how long the Session is valid for. If not provided, a default of 15 minutes will be used. Invalidate all other previously generated Login API keys Optional session profile ID to specify which Session Profile to use for this login. If not provided, the default read/write session will be used. Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The oauthLoginIntent object Base64 encoded OIDC token Client-side public key generated by the user, which will be conditionally added to org data based on the validity of the oidc token associated with this request Expiration window (in seconds) indicating how long the Session is valid for. If not provided, a default of 15 minutes will be used. Invalidate all other previously generated Login API keys Optional session profile ID to specify which Session Profile to use for this login. If not provided, the default read/write session will be used. The result of the activity The oauthLoginResult object Signed JWT containing an expiry, public key, session type, user id, and organization id A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/oauth_login \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_OAUTH_LOGIN", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "oidcToken": "", "publicKey": "", "expirationSeconds": "", "invalidateExisting": "", "sessionProfileId": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().oauthLogin({ oidcToken: " (Base64 encoded OIDC token)", publicKey: " (Client-side public key generated by the user, which will be conditionally added to org data based on the validity of the oidc token associated with this request)", expirationSeconds: " (Expiration window (in seconds) indicating how long the Session is valid for. If not provided, a default of 15 minutes will be used.)", invalidateExisting: true // Invalidate all other previously generated Login API keys, sessionProfileId: " (Optional session profile ID to specify which Session Profile to use for this login. If not provided, the default read/write session will be used.)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_OAUTH_LOGIN", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "oauthLoginIntent": { "oidcToken": "", "publicKey": "", "expirationSeconds": "", "invalidateExisting": "", "sessionProfileId": "" } }, "result": { "oauthLoginResult": { "session": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Login with OTP Source: https://docs.turnkey.com/api-reference/activities/login-with-otp Create an OTP session for a user. Enum options: `ACTIVITY_TYPE_OTP_LOGIN_V2` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

Signed Verification Token containing a unique id, expiry, verification type, contact Client-side public key generated by the user, used as the session public key upon successful login

clientSignature field

The public component of a cryptographic key pair used to create the signature. Enum options: `CLIENT_SIGNATURE_SCHEME_API_P256` The message that was signed. The cryptographic signature over the message. Expiration window (in seconds) indicating how long the Session is valid for. If not provided, a default of 15 minutes will be used. Invalidate all other previously generated Login sessions Optional session profile ID to specify which Session Profile to use for this login. If not provided, the default read/write session will be used. Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The otpLoginIntentV2 object Signed Verification Token containing a unique id, expiry, verification type, contact Client-side public key generated by the user, used as the session public key upon successful login clientSignature field The public component of a cryptographic key pair used to create the signature. scheme field Enum options: `CLIENT_SIGNATURE_SCHEME_API_P256` The message that was signed. The cryptographic signature over the message. Expiration window (in seconds) indicating how long the Session is valid for. If not provided, a default of 15 minutes will be used. Invalidate all other previously generated Login sessions Optional session profile ID to specify which Session Profile to use for this login. If not provided, the default read/write session will be used. The result of the activity The otpLoginResult object Signed JWT containing an expiry, public key, session type, user id, and organization id A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/otp_login \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_OTP_LOGIN_V2", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "verificationToken": "", "publicKey": "", "clientSignature": { "publicKey": "", "scheme": "", "message": "", "signature": "" }, "expirationSeconds": "", "invalidateExisting": "", "sessionProfileId": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().otpLogin({ verificationToken: " (Signed Verification Token containing a unique id, expiry, verification type, contact)", publicKey: " (Client-side public key generated by the user, used as the session public key upon successful login)", clientSignature: { // clientSignature field, publicKey: " (The public component of a cryptographic key pair used to create the signature.)", scheme: "" // scheme field, message: " (The message that was signed.)", signature: " (The cryptographic signature over the message.)", }, expirationSeconds: " (Expiration window (in seconds) indicating how long the Session is valid for. If not provided, a default of 15 minutes will be used.)", invalidateExisting: true // Invalidate all other previously generated Login sessions, sessionProfileId: " (Optional session profile ID to specify which Session Profile to use for this login. If not provided, the default read/write session will be used.)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_OTP_LOGIN_V2", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "otpLoginIntentV2": { "verificationToken": "", "publicKey": "", "clientSignature": { "publicKey": "", "scheme": "", "message": "", "signature": "" }, "expirationSeconds": "", "invalidateExisting": "", "sessionProfileId": "" } }, "result": { "otpLoginResult": { "session": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Oauth Source: https://docs.turnkey.com/api-reference/activities/oauth Authenticate a user with an OIDC token (Oauth). Enum options: `ACTIVITY_TYPE_OAUTH` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

Base64 encoded OIDC token Client-side public key generated by the user, to which the oauth bundle (credentials) will be encrypted. Optional human-readable name for an API Key. If none provided, default to Oauth - \ Expiration window (in seconds) indicating how long the API key is valid for. If not provided, a default of 15 minutes will be used. Invalidate all other previously generated Oauth API keys Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The oauthIntent object Base64 encoded OIDC token Client-side public key generated by the user, to which the oauth bundle (credentials) will be encrypted. Optional human-readable name for an API Key. If none provided, default to Oauth - \ Expiration window (in seconds) indicating how long the API key is valid for. If not provided, a default of 15 minutes will be used. Invalidate all other previously generated Oauth API keys The result of the activity The oauthResult object Unique identifier for the authenticating User. Unique identifier for the created API key. HPKE encrypted credential bundle A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/oauth \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_OAUTH", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "oidcToken": "", "targetPublicKey": "", "apiKeyName": "", "expirationSeconds": "", "invalidateExisting": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().oauth({ oidcToken: " (Base64 encoded OIDC token)", targetPublicKey: " (Client-side public key generated by the user, to which the oauth bundle (credentials) will be encrypted.)", apiKeyName: " (Optional human-readable name for an API Key. If none provided, default to Oauth - )", expirationSeconds: " (Expiration window (in seconds) indicating how long the API key is valid for. If not provided, a default of 15 minutes will be used.)", invalidateExisting: true // Invalidate all other previously generated Oauth API keys }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_OAUTH", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "oauthIntent": { "oidcToken": "", "targetPublicKey": "", "apiKeyName": "", "expirationSeconds": "", "invalidateExisting": "" } }, "result": { "oauthResult": { "userId": "", "apiKeyId": "", "credentialBundle": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # OAuth 2.0 authentication Source: https://docs.turnkey.com/api-reference/activities/oauth-20-authentication Authenticate a user with an OAuth 2.0 provider and receive an OIDC token to use with the LoginWithOAuth or CreateSubOrganization activities Enum options: `ACTIVITY_TYPE_OAUTH2_AUTHENTICATE` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

The OAuth 2.0 credential id whose client\_id and client\_secret will be used in the OAuth 2.0 flow The auth\_code provided by the OAuth 2.0 provider to the end user to be exchanged for a Bearer token in the OAuth 2.0 flow The URI the user is redirected to after they have authenticated with the OAuth 2.0 provider The code verifier used by OAuth 2.0 PKCE providers A nonce value set to sha256(publicKey), used to bind the OIDC token to a specific public key An optional P256 public key to which, if provided, the bearer token will be encrypted and returned via the `encrypted_bearer_token` claim of the OIDC Token Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The oauth2AuthenticateIntent object The OAuth 2.0 credential id whose client\_id and client\_secret will be used in the OAuth 2.0 flow The auth\_code provided by the OAuth 2.0 provider to the end user to be exchanged for a Bearer token in the OAuth 2.0 flow The URI the user is redirected to after they have authenticated with the OAuth 2.0 provider The code verifier used by OAuth 2.0 PKCE providers A nonce value set to sha256(publicKey), used to bind the OIDC token to a specific public key An optional P256 public key to which, if provided, the bearer token will be encrypted and returned via the `encrypted_bearer_token` claim of the OIDC Token The result of the activity The oauth2AuthenticateResult object Base64 encoded OIDC token issued by Turnkey to be used with the LoginWithOAuth activity A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/oauth2_authenticate \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_OAUTH2_AUTHENTICATE", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "oauth2CredentialId": "", "authCode": "", "redirectUri": "", "codeVerifier": "", "nonce": "", "bearerTokenTargetPublicKey": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().oauth2Authenticate({ oauth2CredentialId: " (The OAuth 2.0 credential id whose client_id and client_secret will be used in the OAuth 2.0 flow)", authCode: " (The auth_code provided by the OAuth 2.0 provider to the end user to be exchanged for a Bearer token in the OAuth 2.0 flow)", redirectUri: " (The URI the user is redirected to after they have authenticated with the OAuth 2.0 provider)", codeVerifier: " (The code verifier used by OAuth 2.0 PKCE providers)", nonce: " (A nonce value set to sha256(publicKey), used to bind the OIDC token to a specific public key)", bearerTokenTargetPublicKey: " (An optional P256 public key to which, if provided, the bearer token will be encrypted and returned via the `encrypted_bearer_token` claim of the OIDC Token)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_OAUTH2_AUTHENTICATE", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "oauth2AuthenticateIntent": { "oauth2CredentialId": "", "authCode": "", "redirectUri": "", "codeVerifier": "", "nonce": "", "bearerTokenTargetPublicKey": "" } }, "result": { "oauth2AuthenticateResult": { "oidcToken": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # OTP auth Source: https://docs.turnkey.com/api-reference/activities/otp-auth Authenticate a user with an OTP code sent via email or SMS. Enum options: `ACTIVITY_TYPE_OTP_AUTH` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

ID representing the result of an init OTP activity. OTP sent out to a user's contact (email or SMS) Client-side public key generated by the user, to which the OTP bundle (credentials) will be encrypted. Optional human-readable name for an API Key. If none provided, default to OTP Auth - \ Expiration window (in seconds) indicating how long the API key is valid for. If not provided, a default of 15 minutes will be used. Invalidate all other previously generated OTP Auth API keys Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The otpAuthIntent object ID representing the result of an init OTP activity. OTP sent out to a user's contact (email or SMS) Client-side public key generated by the user, to which the OTP bundle (credentials) will be encrypted. Optional human-readable name for an API Key. If none provided, default to OTP Auth - \ Expiration window (in seconds) indicating how long the API key is valid for. If not provided, a default of 15 minutes will be used. Invalidate all other previously generated OTP Auth API keys The result of the activity The otpAuthResult object Unique identifier for the authenticating User. Unique identifier for the created API key. HPKE encrypted credential bundle A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/otp_auth \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_OTP_AUTH", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "otpId": "", "otpCode": "", "targetPublicKey": "", "apiKeyName": "", "expirationSeconds": "", "invalidateExisting": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().otpAuth({ otpId: " (ID representing the result of an init OTP activity.)", otpCode: " (OTP sent out to a user's contact (email or SMS))", targetPublicKey: " (Client-side public key generated by the user, to which the OTP bundle (credentials) will be encrypted.)", apiKeyName: " (Optional human-readable name for an API Key. If none provided, default to OTP Auth - )", expirationSeconds: " (Expiration window (in seconds) indicating how long the API key is valid for. If not provided, a default of 15 minutes will be used.)", invalidateExisting: true // Invalidate all other previously generated OTP Auth API keys }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_OTP_AUTH", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "otpAuthIntent": { "otpId": "", "otpCode": "", "targetPublicKey": "", "apiKeyName": "", "expirationSeconds": "", "invalidateExisting": "" } }, "result": { "otpAuthResult": { "userId": "", "apiKeyId": "", "credentialBundle": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Activities Source: https://docs.turnkey.com/api-reference/activities/overview Activities are requests to securely execute a workload in Turnkey. Submission endpoints are always prefixed with `/public/v1/submit`. # What are activities? Activities are requests to create, modify, or use resources within Turnkey. Submission endpoints are always prefixed with `/public/v1/submit`. * **Policy enforcement:** Activities are subject to consensus or condition enforcement via the policy engine. * **Optimistic execution:** Activities execute optimistically synchronous — if possible, the request completes synchronously; otherwise it falls back to asynchronous processing. Your services should account for this by checking the activity status in the response: * `ACTIVITY_STATUS_COMPLETED`: The activity succeeded and the `result` field is populated. * `ACTIVITY_STATUS_FAILED`: The activity failed and the `failure` field contains the reason. * `ACTIVITY_STATUS_CONSENSUS_NEEDED`: More signatures (votes) are required to process the request. * `ACTIVITY_STATUS_PENDING`: The request is processing asynchronously. * **Approval expiration:** Activities do not expire. However, when an activity is submitted, the requester's submission counts as the first approval and starts a 24-hour window. If consensus is not reached within that window, existing approvals expire and must be re-submitted while the activity remains in `ACTIVITY_STATUS_CONSENSUS_NEEDED`. * **Status updates:** Poll `get_activity` with the `activity.id`, or re-submit the original request (see idempotency below). * **Idempotency:** The submission API is idempotent. Each request's POST body is hashed into a fingerprint — any two requests with the same fingerprint return the same activity. To generate a new activity, change the `timestampMs` value in your request. # Perform email auth Source: https://docs.turnkey.com/api-reference/activities/perform-email-auth Authenticate a user via email. Enum options: `ACTIVITY_TYPE_EMAIL_AUTH_V3` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

Email of the authenticating user. Client-side public key generated by the user, to which the email auth bundle (credentials) will be encrypted. Optional human-readable name for an API Key. If none provided, default to Email Auth - \ Expiration window (in seconds) indicating how long the API key is valid for. If not provided, a default of 15 minutes will be used.

emailCustomization field

The name of the application. This field is required and will be used in email notifications if an email template is not provided. A URL pointing to a logo in PNG format. Note this logo will be resized to fit into 340px x 124px. A template for the URL to be used in a magic link button, e.g. `https://dapp.xyz/%s`. The auth bundle will be interpolated into the `%s`. JSON object containing key/value pairs to be used with custom templates. Unique identifier for a given Email Template. If not specified, the default is the most recent Email Template. Invalidate all other previously generated Email Auth API keys Optional custom email address from which to send the email Optional custom sender name for use with sendFromEmailAddress; if left empty, will default to 'Notifications' Optional custom email address to use as reply-to Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The emailAuthIntentV3 object Email of the authenticating user. Client-side public key generated by the user, to which the email auth bundle (credentials) will be encrypted. Optional human-readable name for an API Key. If none provided, default to Email Auth - \ Expiration window (in seconds) indicating how long the API key is valid for. If not provided, a default of 15 minutes will be used. emailCustomization field The name of the application. This field is required and will be used in email notifications if an email template is not provided. A URL pointing to a logo in PNG format. Note this logo will be resized to fit into 340px x 124px. A template for the URL to be used in a magic link button, e.g. `https://dapp.xyz/%s`. The auth bundle will be interpolated into the `%s`. JSON object containing key/value pairs to be used with custom templates. Unique identifier for a given Email Template. If not specified, the default is the most recent Email Template. Invalidate all other previously generated Email Auth API keys Optional custom email address from which to send the email Optional custom sender name for use with sendFromEmailAddress; if left empty, will default to 'Notifications' Optional custom email address to use as reply-to The result of the activity The emailAuthResult object Unique identifier for the authenticating User. Unique identifier for the created API key. A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/email_auth \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_EMAIL_AUTH_V3", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "email": "", "targetPublicKey": "", "apiKeyName": "", "expirationSeconds": "", "emailCustomization": { "appName": "", "logoUrl": "", "magicLinkTemplate": "", "templateVariables": "", "templateId": "" }, "invalidateExisting": "", "sendFromEmailAddress": "", "sendFromEmailSenderName": "", "replyToEmailAddress": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().emailAuth({ email: " (Email of the authenticating user.)", targetPublicKey: " (Client-side public key generated by the user, to which the email auth bundle (credentials) will be encrypted.)", apiKeyName: " (Optional human-readable name for an API Key. If none provided, default to Email Auth - )", expirationSeconds: " (Expiration window (in seconds) indicating how long the API key is valid for. If not provided, a default of 15 minutes will be used.)", emailCustomization: { // emailCustomization field, appName: " (The name of the application. This field is required and will be used in email notifications if an email template is not provided.)", logoUrl: " (A URL pointing to a logo in PNG format. Note this logo will be resized to fit into 340px x 124px.)", magicLinkTemplate: " (A template for the URL to be used in a magic link button, e.g. `https://dapp.xyz/%s`. The auth bundle will be interpolated into the `%s`.)", templateVariables: " (JSON object containing key/value pairs to be used with custom templates.)", templateId: " (Unique identifier for a given Email Template. If not specified, the default is the most recent Email Template.)", }, invalidateExisting: true // Invalidate all other previously generated Email Auth API keys, sendFromEmailAddress: " (Optional custom email address from which to send the email)", sendFromEmailSenderName: " (Optional custom sender name for use with sendFromEmailAddress; if left empty, will default to 'Notifications')", replyToEmailAddress: " (Optional custom email address to use as reply-to)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_EMAIL_AUTH_V3", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "emailAuthIntentV3": { "email": "", "targetPublicKey": "", "apiKeyName": "", "expirationSeconds": "", "emailCustomization": { "appName": "", "logoUrl": "", "magicLinkTemplate": "", "templateVariables": "", "templateId": "" }, "invalidateExisting": "", "sendFromEmailAddress": "", "sendFromEmailSenderName": "", "replyToEmailAddress": "" } }, "result": { "emailAuthResult": { "userId": "", "apiKeyId": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Prepare Spark transfer Source: https://docs.turnkey.com/api-reference/activities/prepare-spark-transfer Construct sender-side encrypted operator packages for a Spark BTC transfer. Does not perform FROST signing. Enum options: `ACTIVITY_TYPE_SPARK_PREPARE_TRANSFER` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

A Spark wallet account address identifying the wallet.

transfer field

Spark transfer identifier (UUID).

Leaves being transferred.

Leaf identifier (UUID).

oldLeafDerivation field

identity field

signingLeaf field

Unique identifier for the Spark signing leaf. deposit field

staticDeposit field

Index used to derive the static deposit key. htlcPreimage field

newLeafDerivation field

identity field

signingLeaf field

Unique identifier for the Spark signing leaf. deposit field

staticDeposit field

Index used to derive the static deposit key. htlcPreimage field Client-produced CPFP refund signature (hex-encoded), passed through verbatim into the per-operator SendLeafKeyTweak. Empty omits the field from the operator package. Client-produced direct refund signature (hex-encoded). Passed through verbatim. Client-produced direct-from-CPFP refund signature (hex-encoded). Passed through verbatim. Feldman VSS threshold for reconstructing the per-leaf tweak scalar.

Operators that will receive Feldman shares of the per-leaf tweak. Order must match the operators' numeric IDs in the Spark operator config - share index is the 1-based position in this list.

Spark operator identifier (UUID). Operator's ECIES encryption pubkey (hex-encoded compressed secp256k1 point). Recipient's identity pubkey (hex-encoded compressed secp256k1 point). Each leaf's new\_priv is ECIES-encrypted to this key and embedded in the per-operator package for claim-time delivery. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The sparkPrepareTransferIntent object A Spark wallet account address identifying the wallet. transfer field Spark transfer identifier (UUID). Leaves being transferred. Leaf identifier (UUID). oldLeafDerivation field identity field signingLeaf field Unique identifier for the Spark signing leaf. deposit field staticDeposit field Index used to derive the static deposit key. htlcPreimage field newLeafDerivation field identity field signingLeaf field Unique identifier for the Spark signing leaf. deposit field staticDeposit field Index used to derive the static deposit key. htlcPreimage field Client-produced CPFP refund signature (hex-encoded), passed through verbatim into the per-operator SendLeafKeyTweak. Empty omits the field from the operator package. Client-produced direct refund signature (hex-encoded). Passed through verbatim. Client-produced direct-from-CPFP refund signature (hex-encoded). Passed through verbatim. Feldman VSS threshold for reconstructing the per-leaf tweak scalar. Operators that will receive Feldman shares of the per-leaf tweak. Order must match the operators' numeric IDs in the Spark operator config - share index is the 1-based position in this list. Spark operator identifier (UUID). Operator's ECIES encryption pubkey (hex-encoded compressed secp256k1 point). Recipient's identity pubkey (hex-encoded compressed secp256k1 point). Each leaf's new\_priv is ECIES-encrypted to this key and embedded in the per-operator package for claim-time delivery. The result of the activity The sparkPrepareTransferResult object Per-operator ECIES-encrypted packages. Spark operator identifier (UUID). ECIES ciphertext (hex-encoded) opaque to Turnkey after emission. Hex-encoded ECDSA-DER signature of the TransferPackage signing payload, signed with the wallet's IDENTITY key. Newly-derived SigningLeaf public keys, one per leaf, in input order. The Spark leaf\_id this public key was derived for. Hex-encoded compressed secp256k1 point (33 bytes) for the SigningLeaf derivation at leaf\_id. A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/spark_prepare_transfer \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_SPARK_PREPARE_TRANSFER", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "signWith": "", "transfer": { "transferId": "", "leaves": [ { "leafId": "", "oldLeafDerivation": { "identity": "", "signingLeaf": { "leafId": "" }, "deposit": "", "staticDeposit": { "index": "" }, "htlcPreimage": "" }, "newLeafDerivation": { "identity": "", "signingLeaf": { "leafId": "" }, "deposit": "", "staticDeposit": { "index": "" }, "htlcPreimage": "" }, "refundSignature": "", "directRefundSignature": "", "directFromCpfpRefundSignature": "" } ], "threshold": "", "operatorRecipients": [ { "operatorId": "", "encryptionPublicKey": "" } ], "receiverPublicKey": "" } } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().sparkPrepareTransfer({ signWith: " (A Spark wallet account address identifying the wallet.)", transfer: { // transfer field, transferId: " (Spark transfer identifier (UUID).)", leaves: [{ // Leaves being transferred., leafId: " (Leaf identifier (UUID).)", oldLeafDerivation: { // oldLeafDerivation field, identity: { /* object */ } // identity field, signingLeaf: { // signingLeaf field, leafId: " (Unique identifier for the Spark signing leaf.)", }, deposit: { /* object */ } // deposit field, staticDeposit: { // staticDeposit field, index: 0 // Index used to derive the static deposit key., }, htlcPreimage: { /* object */ } // htlcPreimage field, }, newLeafDerivation: { // newLeafDerivation field, identity: { /* object */ } // identity field, signingLeaf: { // signingLeaf field, leafId: " (Unique identifier for the Spark signing leaf.)", }, deposit: { /* object */ } // deposit field, staticDeposit: { // staticDeposit field, index: 0 // Index used to derive the static deposit key., }, htlcPreimage: { /* object */ } // htlcPreimage field, }, refundSignature: " (Client-produced CPFP refund signature (hex-encoded), passed through verbatim into the per-operator SendLeafKeyTweak. Empty omits the field from the operator package.)", directRefundSignature: " (Client-produced direct refund signature (hex-encoded). Passed through verbatim.)", directFromCpfpRefundSignature: " (Client-produced direct-from-CPFP refund signature (hex-encoded). Passed through verbatim.)", }], threshold: 0 // Feldman VSS threshold for reconstructing the per-leaf tweak scalar., operatorRecipients: [{ // Operators that will receive Feldman shares of the per-leaf tweak. Order must match the operators' numeric IDs in the Spark operator config - share index is the 1-based position in this list., operatorId: " (Spark operator identifier (UUID).)", encryptionPublicKey: " (Operator's ECIES encryption pubkey (hex-encoded compressed secp256k1 point).)", }], receiverPublicKey: " (Recipient's identity pubkey (hex-encoded compressed secp256k1 point). Each leaf's new_priv is ECIES-encrypted to this key and embedded in the per-operator package for claim-time delivery.)", } }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_SPARK_PREPARE_TRANSFER", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "sparkPrepareTransferIntent": { "signWith": "", "transfer": { "transferId": "", "leaves": [ { "leafId": "", "oldLeafDerivation": { "identity": "", "signingLeaf": { "leafId": "" }, "deposit": "", "staticDeposit": { "index": "" }, "htlcPreimage": "" }, "newLeafDerivation": { "identity": "", "signingLeaf": { "leafId": "" }, "deposit": "", "staticDeposit": { "index": "" }, "htlcPreimage": "" }, "refundSignature": "", "directRefundSignature": "", "directFromCpfpRefundSignature": "" } ], "threshold": "", "operatorRecipients": [ { "operatorId": "", "encryptionPublicKey": "" } ], "receiverPublicKey": "" } } }, "result": { "sparkPrepareTransferResult": { "operatorPackages": [ { "operatorId": "", "encryptedPackage": "" } ], "transferUserSignature": "", "newLeafPublicKeys": [ { "leafId": "", "publicKey": "" } ] } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Recover a user Source: https://docs.turnkey.com/api-reference/activities/recover-a-user Complete the process of recovering a user by adding an authenticator. Enum options: `ACTIVITY_TYPE_RECOVER_USER` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

authenticator field

Human-readable name for an Authenticator. Challenge presented for authentication purposes.

attestation field

The cbor encoded then base64 url encoded id of the credential. A base64 url encoded payload containing metadata about the signing context and the challenge. A base64 url encoded payload containing authenticator data and any attestation the webauthn provider chooses. Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` Unique identifier for the user performing recovery. Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The recoverUserIntent object authenticator field Human-readable name for an Authenticator. Challenge presented for authentication purposes. attestation field The cbor encoded then base64 url encoded id of the credential. A base64 url encoded payload containing metadata about the signing context and the challenge. A base64 url encoded payload containing authenticator data and any attestation the webauthn provider chooses. The type of authenticator transports. item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` Unique identifier for the user performing recovery. The result of the activity The recoverUserResult object ID of the authenticator created. item field A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/recover_user \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_RECOVER_USER", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "authenticator": { "authenticatorName": "", "challenge": "", "attestation": { "credentialId": "", "clientDataJson": "", "attestationObject": "", "transports": [ "" ] } }, "userId": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().recoverUser({ authenticator: { // authenticator field, authenticatorName: " (Human-readable name for an Authenticator.)", challenge: " (Challenge presented for authentication purposes.)", attestation: { // attestation field, credentialId: " (The cbor encoded then base64 url encoded id of the credential.)", clientDataJson: " (A base64 url encoded payload containing metadata about the signing context and the challenge.)", attestationObject: " (A base64 url encoded payload containing authenticator data and any attestation the webauthn provider chooses.)", transports: "" // The type of authenticator transports., }, }, userId: " (Unique identifier for the user performing recovery.)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_RECOVER_USER", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "recoverUserIntent": { "authenticator": { "authenticatorName": "", "challenge": "", "attestation": { "credentialId": "", "clientDataJson": "", "attestationObject": "", "transports": [ "" ] } }, "userId": "" } }, "result": { "recoverUserResult": { "authenticatorId": [ "" ] } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Reject activity Source: https://docs.turnkey.com/api-reference/activities/reject-activity Reject an activity. Enum options: `ACTIVITY_TYPE_REJECT_ACTIVITY` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

An artifact verifying a User's action. Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. ACTIVITY\_STATUS\_REJECTED The activity type The intent of the activity The rejectActivityIntent object An artifact verifying a User's action. The result of the activity A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/reject_activity \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_REJECT_ACTIVITY", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "fingerprint": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().rejectActivity({ fingerprint: " (An artifact verifying a User's action.)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_REJECT_ACTIVITY", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "rejectActivityIntent": { "fingerprint": "" } }, "result": {}, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Remove IP Allowlist Source: https://docs.turnkey.com/api-reference/activities/remove-ip-allowlist Delete IP allowlist and all associated rules for organization or API key. After removal, access will be determined by organization-level allowlist (for API keys) or allowed from all IPs (for organizations). Enum options: `ACTIVITY_TYPE_REMOVE_IP_ALLOWLIST` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

The public component of an API key. If null, removes the organization-level IP allowlist. If set, removes the IP allowlist for this specific API key. Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The removeIpAllowlistIntent object The public component of an API key. If null, removes the organization-level IP allowlist. If set, removes the IP allowlist for this specific API key. The result of the activity The removeIpAllowlistResult object A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/remove_ip_allowlist \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_REMOVE_IP_ALLOWLIST", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "publicKey": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().removeIpAllowlist({ publicKey: " (The public component of an API key. If null, removes the organization-level IP allowlist. If set, removes the IP allowlist for this specific API key.)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_REMOVE_IP_ALLOWLIST", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "removeIpAllowlistIntent": { "publicKey": "" } }, "result": { "removeIpAllowlistResult": {} }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Remove organization feature Source: https://docs.turnkey.com/api-reference/activities/remove-organization-feature Remove an organization feature. This activity must be approved by the current root quorum. Enum options: `ACTIVITY_TYPE_REMOVE_ORGANIZATION_FEATURE` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

Enum options: `FEATURE_NAME_ROOT_USER_EMAIL_RECOVERY`, `FEATURE_NAME_WEBAUTHN_ORIGINS`, `FEATURE_NAME_EMAIL_AUTH`, `FEATURE_NAME_EMAIL_RECOVERY`, `FEATURE_NAME_WEBHOOK`, `FEATURE_NAME_SMS_AUTH`, `FEATURE_NAME_OTP_EMAIL_AUTH`, `FEATURE_NAME_AUTH_PROXY`, `FEATURE_NAME_SOLANA_RENT_PREFUND_ENABLED` Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The removeOrganizationFeatureIntent object name field Enum options: `FEATURE_NAME_ROOT_USER_EMAIL_RECOVERY`, `FEATURE_NAME_WEBAUTHN_ORIGINS`, `FEATURE_NAME_EMAIL_AUTH`, `FEATURE_NAME_EMAIL_RECOVERY`, `FEATURE_NAME_WEBHOOK`, `FEATURE_NAME_SMS_AUTH`, `FEATURE_NAME_OTP_EMAIL_AUTH`, `FEATURE_NAME_AUTH_PROXY`, `FEATURE_NAME_SOLANA_RENT_PREFUND_ENABLED` The result of the activity The removeOrganizationFeatureResult object Resulting list of organization features. name field Enum options: `FEATURE_NAME_ROOT_USER_EMAIL_RECOVERY`, `FEATURE_NAME_WEBAUTHN_ORIGINS`, `FEATURE_NAME_EMAIL_AUTH`, `FEATURE_NAME_EMAIL_RECOVERY`, `FEATURE_NAME_WEBHOOK`, `FEATURE_NAME_SMS_AUTH`, `FEATURE_NAME_OTP_EMAIL_AUTH`, `FEATURE_NAME_AUTH_PROXY`, `FEATURE_NAME_SOLANA_RENT_PREFUND_ENABLED` value field A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/remove_organization_feature \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_REMOVE_ORGANIZATION_FEATURE", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "name": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().removeOrganizationFeature({ name: "" // name field }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_REMOVE_ORGANIZATION_FEATURE", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "removeOrganizationFeatureIntent": { "name": "" } }, "result": { "removeOrganizationFeatureResult": { "features": [ { "name": "", "value": "" } ] } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Restore a TVC Deployment Source: https://docs.turnkey.com/api-reference/activities/restore-a-tvc-deployment Restore a deleted TVC Deployment Enum options: `ACTIVITY_TYPE_RESTORE_TVC_DEPLOYMENT` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

The unique identifier of the TVC deployment to restore. Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The restoreTvcDeploymentIntent object The unique identifier of the TVC deployment to restore. The result of the activity The restoreTvcDeploymentResult object The unique identifier of the restored TVC deployment. A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/restore_tvc_deployment \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_RESTORE_TVC_DEPLOYMENT", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "deploymentId": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().restoreTvcDeployment({ deploymentId: " (The unique identifier of the TVC deployment to restore.)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_RESTORE_TVC_DEPLOYMENT", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "restoreTvcDeploymentIntent": { "deploymentId": "" } }, "result": { "restoreTvcDeploymentResult": { "deploymentId": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Set IP Allowlist Source: https://docs.turnkey.com/api-reference/activities/set-ip-allowlist Create or update IP allowlist and rules for organization or API key. The IP allowlist restricts API access to specific CIDR blocks. Organization-level allowlists apply to all API keys unless overridden by a key-specific allowlist. Enum options: `ACTIVITY_TYPE_SET_IP_ALLOWLIST` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

The public component of an API key. If null, the IP allowlist applies at the organization level. If set, it applies only to this specific API key. Whether the IP allowlist is enabled. Only meaningful for organization-level allowlists. Omit for API key-level allowlists.

List of IP allowlist rules with CIDR blocks and optional labels.

CIDR block (e.g., '192.168.1.0/24', '2001:db8::/32'). Optional human-readable label for this rule (e.g., 'Office VPN'). Behavior when an error occurs during IP allowlist evaluation. Valid values: ALLOW, DENY. Defaults to DENY. Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The setIpAllowlistIntent object The public component of an API key. If null, the IP allowlist applies at the organization level. If set, it applies only to this specific API key. Whether the IP allowlist is enabled. Only meaningful for organization-level allowlists. Omit for API key-level allowlists. List of IP allowlist rules with CIDR blocks and optional labels. CIDR block (e.g., '192.168.1.0/24', '2001:db8::/32'). Optional human-readable label for this rule (e.g., 'Office VPN'). Behavior when an error occurs during IP allowlist evaluation. Valid values: ALLOW, DENY. Defaults to DENY. The result of the activity The setIpAllowlistResult object A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/set_ip_allowlist \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_SET_IP_ALLOWLIST", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "publicKey": "", "enabled": "", "rules": [ { "cidr": "", "label": "" } ], "onEvaluationError": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().setIpAllowlist({ publicKey: " (The public component of an API key. If null, the IP allowlist applies at the organization level. If set, it applies only to this specific API key.)", enabled: true // Whether the IP allowlist is enabled. Only meaningful for organization-level allowlists. Omit for API key-level allowlists., rules: [{ // List of IP allowlist rules with CIDR blocks and optional labels., cidr: " (CIDR block (e.g., '192.168.1.0/24', '2001:db8::/32').)", label: " (Optional human-readable label for this rule (e.g., 'Office VPN').)", }], onEvaluationError: " (Behavior when an error occurs during IP allowlist evaluation. Valid values: ALLOW, DENY. Defaults to DENY.)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_SET_IP_ALLOWLIST", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "setIpAllowlistIntent": { "publicKey": "", "enabled": "", "rules": [ { "cidr": "", "label": "" } ], "onEvaluationError": "" } }, "result": { "setIpAllowlistResult": {} }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Set organization feature Source: https://docs.turnkey.com/api-reference/activities/set-organization-feature Set an organization feature. This activity must be approved by the current root quorum. Enum options: `ACTIVITY_TYPE_SET_ORGANIZATION_FEATURE` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

Enum options: `FEATURE_NAME_ROOT_USER_EMAIL_RECOVERY`, `FEATURE_NAME_WEBAUTHN_ORIGINS`, `FEATURE_NAME_EMAIL_AUTH`, `FEATURE_NAME_EMAIL_RECOVERY`, `FEATURE_NAME_WEBHOOK`, `FEATURE_NAME_SMS_AUTH`, `FEATURE_NAME_OTP_EMAIL_AUTH`, `FEATURE_NAME_AUTH_PROXY`, `FEATURE_NAME_SOLANA_RENT_PREFUND_ENABLED` Optional value for the feature. Will override existing values if feature is already set. Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The setOrganizationFeatureIntent object name field Enum options: `FEATURE_NAME_ROOT_USER_EMAIL_RECOVERY`, `FEATURE_NAME_WEBAUTHN_ORIGINS`, `FEATURE_NAME_EMAIL_AUTH`, `FEATURE_NAME_EMAIL_RECOVERY`, `FEATURE_NAME_WEBHOOK`, `FEATURE_NAME_SMS_AUTH`, `FEATURE_NAME_OTP_EMAIL_AUTH`, `FEATURE_NAME_AUTH_PROXY`, `FEATURE_NAME_SOLANA_RENT_PREFUND_ENABLED` Optional value for the feature. Will override existing values if feature is already set. The result of the activity The setOrganizationFeatureResult object Resulting list of organization features. name field Enum options: `FEATURE_NAME_ROOT_USER_EMAIL_RECOVERY`, `FEATURE_NAME_WEBAUTHN_ORIGINS`, `FEATURE_NAME_EMAIL_AUTH`, `FEATURE_NAME_EMAIL_RECOVERY`, `FEATURE_NAME_WEBHOOK`, `FEATURE_NAME_SMS_AUTH`, `FEATURE_NAME_OTP_EMAIL_AUTH`, `FEATURE_NAME_AUTH_PROXY`, `FEATURE_NAME_SOLANA_RENT_PREFUND_ENABLED` value field A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/set_organization_feature \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_SET_ORGANIZATION_FEATURE", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "name": "", "value": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().setOrganizationFeature({ name: "" // name field, value: " (Optional value for the feature. Will override existing values if feature is already set.)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_SET_ORGANIZATION_FEATURE", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "setOrganizationFeatureIntent": { "name": "", "value": "" } }, "result": { "setOrganizationFeatureResult": { "features": [ { "name": "", "value": "" } ] } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Sign Frost Spark Source: https://docs.turnkey.com/api-reference/activities/sign-frost-spark Perform pure FROST partial signing for a Spark wallet. Produces partial signatures without constructing operator packages. Enum options: `ACTIVITY_TYPE_SPARK_SIGN_FROST` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

A Spark wallet account address identifying the wallet to sign with.

Batched sign requests. Each produces a partial signature plus Turnkey's public commitments.

derivation field

identity field

signingLeaf field

Unique identifier for the Spark signing leaf. deposit field

staticDeposit field

Index used to derive the static deposit key. htlcPreimage field Hex-encoded 32-byte sighash to sign. Aggregate group verifying key (hex-encoded compressed secp256k1 point), computed as P\_ops + P\_user. Bound into the nonce HMAC.

Commitments for every non-Turnkey participant. MUST NOT include an entry under Turnkey's identifier. Bound into the nonce HMAC.

FROST participant identifier, hex-encoded (32-byte scalar). Hiding commitment D, hex-encoded compressed secp256k1 point. Binding commitment E, hex-encoded compressed secp256k1 point. Optional adaptor point T (hex-encoded 33-byte compressed secp256k1 pubkey). When set, Turnkey produces a Schnorr adaptor pre-signature with the FROST challenge bound to `R+T` (where `R` is the aggregate group nonce commitment from FROST). The party holding the discrete log `t` completes the pre-sig to a valid BIP-340 signature by adding `t` (or `-t`, for parity) to the signature scalar `s`. This is primarily used by Spark leaves-swap and other adaptor-bound flows; absent or empty leads to plain FROST signing (the typical case). A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The sparkSignFrostIntent object A Spark wallet account address identifying the wallet to sign with. Batched sign requests. Each produces a partial signature plus Turnkey's public commitments. derivation field identity field signingLeaf field Unique identifier for the Spark signing leaf. deposit field staticDeposit field Index used to derive the static deposit key. htlcPreimage field Hex-encoded 32-byte sighash to sign. Aggregate group verifying key (hex-encoded compressed secp256k1 point), computed as P\_ops + P\_user. Bound into the nonce HMAC. Commitments for every non-Turnkey participant. MUST NOT include an entry under Turnkey's identifier. Bound into the nonce HMAC. FROST participant identifier, hex-encoded (32-byte scalar). Hiding commitment D, hex-encoded compressed secp256k1 point. Binding commitment E, hex-encoded compressed secp256k1 point. Optional adaptor point T (hex-encoded 33-byte compressed secp256k1 pubkey). When set, Turnkey produces a Schnorr adaptor pre-signature with the FROST challenge bound to `R+T` (where `R` is the aggregate group nonce commitment from FROST). The party holding the discrete log `t` completes the pre-sig to a valid BIP-340 signature by adding `t` (or `-t`, for parity) to the signature scalar `s`. This is primarily used by Spark leaves-swap and other adaptor-bound flows; absent or empty leads to plain FROST signing (the typical case). The result of the activity The sparkSignFrostResult object Partial signatures plus Turnkey commitments, one per request, in order. Hex-encoded FROST partial signature. Turnkey's hiding commitment D (hex-encoded compressed secp256k1 point). Forward to the Spark Operator. Turnkey's binding commitment E (hex-encoded compressed secp256k1 point). Forward to the Spark Operator. A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/spark_sign_frost \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_SPARK_SIGN_FROST", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "signWith": "", "signatures": [ { "derivation": { "identity": "", "signingLeaf": { "leafId": "" }, "deposit": "", "staticDeposit": { "index": "" }, "htlcPreimage": "" }, "message": "", "verifyingKey": "", "operatorCommitments": [ { "id": "", "hiding": "", "binding": "" } ], "adaptorPublicKey": "" } ] } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().sparkSignFrost({ signWith: " (A Spark wallet account address identifying the wallet to sign with.)", signatures: [{ // Batched sign requests. Each produces a partial signature plus Turnkey's public commitments., derivation: { // derivation field, identity: { /* object */ } // identity field, signingLeaf: { // signingLeaf field, leafId: " (Unique identifier for the Spark signing leaf.)", }, deposit: { /* object */ } // deposit field, staticDeposit: { // staticDeposit field, index: 0 // Index used to derive the static deposit key., }, htlcPreimage: { /* object */ } // htlcPreimage field, }, message: " (Hex-encoded 32-byte sighash to sign.)", verifyingKey: " (Aggregate group verifying key (hex-encoded compressed secp256k1 point), computed as P_ops + P_user. Bound into the nonce HMAC.)", operatorCommitments: [{ // Commitments for every non-Turnkey participant. MUST NOT include an entry under Turnkey's identifier. Bound into the nonce HMAC., id: " (FROST participant identifier, hex-encoded (32-byte scalar).)", hiding: " (Hiding commitment D, hex-encoded compressed secp256k1 point.)", binding: " (Binding commitment E, hex-encoded compressed secp256k1 point.)", }], adaptorPublicKey: " (Optional adaptor point T (hex-encoded 33-byte compressed secp256k1 pubkey). When set, Turnkey produces a Schnorr adaptor pre-signature with the FROST challenge bound to `R+T` (where `R` is the aggregate group nonce commitment from FROST). The party holding the discrete log `t` completes the pre-sig to a valid BIP-340 signature by adding `t` (or `-t`, for parity) to the signature scalar `s`. This is primarily used by Spark leaves-swap and other adaptor-bound flows; absent or empty leads to plain FROST signing (the typical case).)", }] }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_SPARK_SIGN_FROST", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "sparkSignFrostIntent": { "signWith": "", "signatures": [ { "derivation": { "identity": "", "signingLeaf": { "leafId": "" }, "deposit": "", "staticDeposit": { "index": "" }, "htlcPreimage": "" }, "message": "", "verifyingKey": "", "operatorCommitments": [ { "id": "", "hiding": "", "binding": "" } ], "adaptorPublicKey": "" } ] } }, "result": { "sparkSignFrostResult": { "signatures": [ { "signatureShare": "", "hiding": "", "binding": "" } ] } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Sign raw payload Source: https://docs.turnkey.com/api-reference/activities/sign-raw-payload Sign a raw payload. Enum options: `ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

A Wallet account address, Private Key address, or Private Key identifier. Raw unsigned payload to be signed. Enum options: `PAYLOAD_ENCODING_HEXADECIMAL`, `PAYLOAD_ENCODING_TEXT_UTF8`, `PAYLOAD_ENCODING_EIP712`, `PAYLOAD_ENCODING_EIP7702_AUTHORIZATION` Enum options: `HASH_FUNCTION_NO_OP`, `HASH_FUNCTION_SHA256`, `HASH_FUNCTION_KECCAK256`, `HASH_FUNCTION_NOT_APPLICABLE` Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The signRawPayloadIntentV2 object A Wallet account address, Private Key address, or Private Key identifier. Raw unsigned payload to be signed. encoding field Enum options: `PAYLOAD_ENCODING_HEXADECIMAL`, `PAYLOAD_ENCODING_TEXT_UTF8`, `PAYLOAD_ENCODING_EIP712`, `PAYLOAD_ENCODING_EIP7702_AUTHORIZATION` hashFunction field Enum options: `HASH_FUNCTION_NO_OP`, `HASH_FUNCTION_SHA256`, `HASH_FUNCTION_KECCAK256`, `HASH_FUNCTION_NOT_APPLICABLE` The result of the activity The signRawPayloadResult object Component of an ECSDA signature. Component of an ECSDA signature. Component of an ECSDA signature. A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/sign_raw_payload \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "signWith": "", "payload": "", "encoding": "", "hashFunction": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().signRawPayload({ signWith: " (A Wallet account address, Private Key address, or Private Key identifier.)", payload: " (Raw unsigned payload to be signed.)", encoding: "" // encoding field, hashFunction: "" // hashFunction field }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "signRawPayloadIntentV2": { "signWith": "", "payload": "", "encoding": "", "hashFunction": "" } }, "result": { "signRawPayloadResult": { "r": "", "s": "", "v": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Sign raw payloads Source: https://docs.turnkey.com/api-reference/activities/sign-raw-payloads Sign multiple raw payloads with the same signing parameters. Enum options: `ACTIVITY_TYPE_SIGN_RAW_PAYLOADS` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

A Wallet account address, Private Key address, or Private Key identifier.

An array of raw unsigned payloads to be signed.

Array item type: string

item field

 Enum options: `PAYLOAD_ENCODING_HEXADECIMAL`, `PAYLOAD_ENCODING_TEXT_UTF8`, `PAYLOAD_ENCODING_EIP712`, `PAYLOAD_ENCODING_EIP7702_AUTHORIZATION` Enum options: `HASH_FUNCTION_NO_OP`, `HASH_FUNCTION_SHA256`, `HASH_FUNCTION_KECCAK256`, `HASH_FUNCTION_NOT_APPLICABLE` Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The signRawPayloadsIntent object A Wallet account address, Private Key address, or Private Key identifier. An array of raw unsigned payloads to be signed. item field encoding field Enum options: `PAYLOAD_ENCODING_HEXADECIMAL`, `PAYLOAD_ENCODING_TEXT_UTF8`, `PAYLOAD_ENCODING_EIP712`, `PAYLOAD_ENCODING_EIP7702_AUTHORIZATION` hashFunction field Enum options: `HASH_FUNCTION_NO_OP`, `HASH_FUNCTION_SHA256`, `HASH_FUNCTION_KECCAK256`, `HASH_FUNCTION_NOT_APPLICABLE` The result of the activity The signRawPayloadsResult object signatures field Component of an ECSDA signature. Component of an ECSDA signature. Component of an ECSDA signature. A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/sign_raw_payloads \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_SIGN_RAW_PAYLOADS", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "signWith": "", "payloads": [ "" ], "encoding": "", "hashFunction": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().signRawPayloads({ signWith: " (A Wallet account address, Private Key address, or Private Key identifier.)", payloads: [""] // An array of raw unsigned payloads to be signed., encoding: "" // encoding field, hashFunction: "" // hashFunction field }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_SIGN_RAW_PAYLOADS", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "signRawPayloadsIntent": { "signWith": "", "payloads": [ "" ], "encoding": "", "hashFunction": "" } }, "result": { "signRawPayloadsResult": { "signatures": [ { "r": "", "s": "", "v": "" } ] } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Sign transaction Source: https://docs.turnkey.com/api-reference/activities/sign-transaction Sign a transaction. Enum options: `ACTIVITY_TYPE_SIGN_TRANSACTION_V2` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

A Wallet account address, Private Key address, or Private Key identifier. Raw unsigned transaction to be signed Enum options: `TRANSACTION_TYPE_ETHEREUM`, `TRANSACTION_TYPE_SOLANA`, `TRANSACTION_TYPE_TRON`, `TRANSACTION_TYPE_BITCOIN`, `TRANSACTION_TYPE_TEMPO` Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The signTransactionIntentV2 object A Wallet account address, Private Key address, or Private Key identifier. Raw unsigned transaction to be signed type field Enum options: `TRANSACTION_TYPE_ETHEREUM`, `TRANSACTION_TYPE_SOLANA`, `TRANSACTION_TYPE_TRON`, `TRANSACTION_TYPE_BITCOIN`, `TRANSACTION_TYPE_TEMPO` The result of the activity The signTransactionResult object signedTransaction field A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/sign_transaction \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_SIGN_TRANSACTION_V2", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "signWith": "", "unsignedTransaction": "", "type": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().signTransaction({ signWith: " (A Wallet account address, Private Key address, or Private Key identifier.)", unsignedTransaction: " (Raw unsigned transaction to be signed)", type: "" // type field }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_SIGN_TRANSACTION_V2", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "signTransactionIntentV2": { "signWith": "", "unsignedTransaction": "", "type": "" } }, "result": { "signTransactionResult": { "signedTransaction": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Spark prepare Lightning receive Source: https://docs.turnkey.com/api-reference/activities/spark-prepare-lightning-receive Generate a Lightning preimage and distribute Feldman shares to operators for a Spark Lightning receive. Does not perform FROST signing. Enum options: `ACTIVITY_TYPE_SPARK_PREPARE_LIGHTNING_RECEIVE` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

A Spark wallet account address identifying the wallet.

lightningReceive field

Feldman VSS threshold for reconstructing the preimage.

Operators that will receive Feldman shares of the preimage. Order must match the operators' numeric IDs in the Spark operator config - share index is the 1-based position in this list.

Spark operator identifier (UUID). Operator's ECIES encryption pubkey (hex-encoded compressed secp256k1 point). A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The sparkPrepareLightningReceiveIntent object A Spark wallet account address identifying the wallet. lightningReceive field Feldman VSS threshold for reconstructing the preimage. Operators that will receive Feldman shares of the preimage. Order must match the operators' numeric IDs in the Spark operator config - share index is the 1-based position in this list. Spark operator identifier (UUID). Operator's ECIES encryption pubkey (hex-encoded compressed secp256k1 point). The result of the activity The sparkPrepareLightningReceiveResult object Per-operator ECIES-encrypted Feldman share packages. Spark operator identifier (UUID). ECIES ciphertext (hex-encoded) opaque to Turnkey after emission. Hex-encoded SHA256(preimage). Forward to the Lightning node. A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/spark_prepare_lightning_receive \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_SPARK_PREPARE_LIGHTNING_RECEIVE", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "signWith": "", "lightningReceive": { "threshold": "", "operatorRecipients": [ { "operatorId": "", "encryptionPublicKey": "" } ] } } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().sparkPrepareLightningReceive({ signWith: " (A Spark wallet account address identifying the wallet.)", lightningReceive: { // lightningReceive field, threshold: 0 // Feldman VSS threshold for reconstructing the preimage., operatorRecipients: [{ // Operators that will receive Feldman shares of the preimage. Order must match the operators' numeric IDs in the Spark operator config - share index is the 1-based position in this list., operatorId: " (Spark operator identifier (UUID).)", encryptionPublicKey: " (Operator's ECIES encryption pubkey (hex-encoded compressed secp256k1 point).)", }], } }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_SPARK_PREPARE_LIGHTNING_RECEIVE", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "sparkPrepareLightningReceiveIntent": { "signWith": "", "lightningReceive": { "threshold": "", "operatorRecipients": [ { "operatorId": "", "encryptionPublicKey": "" } ] } } }, "result": { "sparkPrepareLightningReceiveResult": { "operatorPackages": [ { "operatorId": "", "encryptedPackage": "" } ], "paymentHash": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Update a Fiat On Ramp Credential Source: https://docs.turnkey.com/api-reference/activities/update-a-fiat-on-ramp-credential Update a fiat on ramp provider credential Enum options: `ACTIVITY_TYPE_UPDATE_FIAT_ON_RAMP_CREDENTIAL` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

The ID of the fiat on-ramp credential to update Enum options: `FIAT_ON_RAMP_PROVIDER_COINBASE`, `FIAT_ON_RAMP_PROVIDER_MOONPAY` Project ID for the on-ramp provider. Some providers, like Coinbase, require this additional identifier. Publishable API key for the on-ramp provider Secret API key for the on-ramp provider encrypted to our on-ramp encryption public key Private API key for the on-ramp provider encrypted to our on-ramp encryption public key. Some providers, like Coinbase, require this additional key. Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The updateFiatOnRampCredentialIntent object The ID of the fiat on-ramp credential to update onrampProvider field Enum options: `FIAT_ON_RAMP_PROVIDER_COINBASE`, `FIAT_ON_RAMP_PROVIDER_MOONPAY` Project ID for the on-ramp provider. Some providers, like Coinbase, require this additional identifier. Publishable API key for the on-ramp provider Secret API key for the on-ramp provider encrypted to our on-ramp encryption public key Private API key for the on-ramp provider encrypted to our on-ramp encryption public key. Some providers, like Coinbase, require this additional key. The result of the activity The updateFiatOnRampCredentialResult object Unique identifier of the Fiat On-Ramp credential that was updated A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/update_fiat_on_ramp_credential \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_UPDATE_FIAT_ON_RAMP_CREDENTIAL", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "fiatOnrampCredentialId": "", "onrampProvider": "", "projectId": "", "publishableApiKey": "", "encryptedSecretApiKey": "", "encryptedPrivateApiKey": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().updateFiatOnRampCredential({ fiatOnrampCredentialId: " (The ID of the fiat on-ramp credential to update)", onrampProvider: "" // onrampProvider field, projectId: " (Project ID for the on-ramp provider. Some providers, like Coinbase, require this additional identifier.)", publishableApiKey: " (Publishable API key for the on-ramp provider)", encryptedSecretApiKey: " (Secret API key for the on-ramp provider encrypted to our on-ramp encryption public key)", encryptedPrivateApiKey: " (Private API key for the on-ramp provider encrypted to our on-ramp encryption public key. Some providers, like Coinbase, require this additional key.)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_UPDATE_FIAT_ON_RAMP_CREDENTIAL", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "updateFiatOnRampCredentialIntent": { "fiatOnrampCredentialId": "", "onrampProvider": "", "projectId": "", "publishableApiKey": "", "encryptedSecretApiKey": "", "encryptedPrivateApiKey": "" } }, "result": { "updateFiatOnRampCredentialResult": { "fiatOnRampCredentialId": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Update an OAuth 2.0 Credential Source: https://docs.turnkey.com/api-reference/activities/update-an-oauth-20-credential Update an OAuth 2.0 provider credential Enum options: `ACTIVITY_TYPE_UPDATE_OAUTH2_CREDENTIAL` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

The ID of the OAuth 2.0 credential to update Enum options: `OAUTH2_PROVIDER_X`, `OAUTH2_PROVIDER_DISCORD` The Client ID issued by the OAuth 2.0 provider The client secret issued by the OAuth 2.0 provider encrypted to the TLS Fetcher quorum key Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The updateOauth2CredentialIntent object The ID of the OAuth 2.0 credential to update provider field Enum options: `OAUTH2_PROVIDER_X`, `OAUTH2_PROVIDER_DISCORD` The Client ID issued by the OAuth 2.0 provider The client secret issued by the OAuth 2.0 provider encrypted to the TLS Fetcher quorum key The result of the activity The updateOauth2CredentialResult object Unique identifier of the OAuth 2.0 credential that was updated A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/update_oauth2_credential \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_UPDATE_OAUTH2_CREDENTIAL", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "oauth2CredentialId": "", "provider": "", "clientId": "", "encryptedClientSecret": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().updateOauth2Credential({ oauth2CredentialId: " (The ID of the OAuth 2.0 credential to update)", provider: "" // provider field, clientId: " (The Client ID issued by the OAuth 2.0 provider)", encryptedClientSecret: " (The client secret issued by the OAuth 2.0 provider encrypted to the TLS Fetcher quorum key)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_UPDATE_OAUTH2_CREDENTIAL", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "updateOauth2CredentialIntent": { "oauth2CredentialId": "", "provider": "", "clientId": "", "encryptedClientSecret": "" } }, "result": { "updateOauth2CredentialResult": { "oauth2CredentialId": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Update MFA policy Source: https://docs.turnkey.com/api-reference/activities/update-mfa-policy Update an MFA policy for a user. Enum options: `ACTIVITY_TYPE_UPDATE_MFA_POLICY` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

The ID of the User to update the MFA Policy for. Unique identifier for a given MFA Policy. Human-readable name for a Policy. A condition expression that evaluates to true or false, determining when this MFA policy applies.

An ordered list of authentication requirements. Each requirement must be satisfied sequentially to complete MFA.

A list of authentication methods for this MFA step. If only one method is provided, it is required. If multiple are provided, the user must satisfy ANY one of them.

Enum options: `AUTHENTICATION_TYPE_EMAIL_OTP`, `AUTHENTICATION_TYPE_SMS_OTP`, `AUTHENTICATION_TYPE_PASSKEY`, `AUTHENTICATION_TYPE_API_KEY`, `AUTHENTICATION_TYPE_OAUTH`, `AUTHENTICATION_TYPE_SESSION` Optional specific authenticator ID required (e.g., UUID of a passkey authenticator). If not provided, any authenticator of the specified type can be used. The order in which this MFA policy is evaluated, starting from 0, relative to other MFA policies. Lower order values are evaluated first. Notes for an MFA Policy. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The updateMfaPolicyIntent object The ID of the User to update the MFA Policy for. Unique identifier for a given MFA Policy. Human-readable name for a Policy. A condition expression that evaluates to true or false, determining when this MFA policy applies. An ordered list of authentication requirements. Each requirement must be satisfied sequentially to complete MFA. A list of authentication methods for this MFA step. If only one method is provided, it is required. If multiple are provided, the user must satisfy ANY one of them. type field Enum options: `AUTHENTICATION_TYPE_EMAIL_OTP`, `AUTHENTICATION_TYPE_SMS_OTP`, `AUTHENTICATION_TYPE_PASSKEY`, `AUTHENTICATION_TYPE_API_KEY`, `AUTHENTICATION_TYPE_OAUTH`, `AUTHENTICATION_TYPE_SESSION` Optional specific authenticator ID required (e.g., UUID of a passkey authenticator). If not provided, any authenticator of the specified type can be used. The order in which this MFA policy is evaluated, starting from 0, relative to other MFA policies. Lower order values are evaluated first. Notes for an MFA Policy. The result of the activity The updateMfaPolicyResult object Unique identifier for a given MFA Policy. A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/update_mfa_policy \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_UPDATE_MFA_POLICY", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "userId": "", "mfaPolicyId": "", "mfaPolicyName": "", "condition": "", "requiredAuthenticationMethods": [ { "any": [ { "type": "", "id": "" } ] } ], "order": "", "notes": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().updateMfaPolicy({ userId: " (The ID of the User to update the MFA Policy for.)", mfaPolicyId: " (Unique identifier for a given MFA Policy.)", mfaPolicyName: " (Human-readable name for a Policy.)", condition: " (A condition expression that evaluates to true or false, determining when this MFA policy applies.)", requiredAuthenticationMethods: [""] // An ordered list of authentication requirements. Each requirement must be satisfied sequentially to complete MFA., order: 0 // The order in which this MFA policy is evaluated, starting from 0, relative to other MFA policies. Lower order values are evaluated first., notes: " (Notes for an MFA Policy.)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_UPDATE_MFA_POLICY", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "updateMfaPolicyIntent": { "userId": "", "mfaPolicyId": "", "mfaPolicyName": "", "condition": "", "requiredAuthenticationMethods": [ { "any": [ { "type": "", "id": "" } ] } ], "order": "", "notes": "" } }, "result": { "updateMfaPolicyResult": { "mfaPolicyId": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Update organization name Source: https://docs.turnkey.com/api-reference/activities/update-organization-name Update the name of an organization. Enum options: `ACTIVITY_TYPE_UPDATE_ORGANIZATION_NAME` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

New name for the Organization. Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The updateOrganizationNameIntent object New name for the Organization. The result of the activity The updateOrganizationNameResult object Unique identifier for the Organization. The updated organization name. A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/update_organization_name \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_UPDATE_ORGANIZATION_NAME", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "organizationName": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().updateOrganizationName({ organizationName: " (New name for the Organization.)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_UPDATE_ORGANIZATION_NAME", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "updateOrganizationNameIntent": { "organizationName": "" } }, "result": { "updateOrganizationNameResult": { "organizationId": "", "organizationName": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Update policy Source: https://docs.turnkey.com/api-reference/activities/update-policy Update an existing policy. Enum options: `ACTIVITY_TYPE_UPDATE_POLICY_V2` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

Unique identifier for a given Policy. Human-readable name for a Policy. Enum options: `EFFECT_ALLOW`, `EFFECT_DENY` The condition expression that triggers the Effect (optional). The consensus expression that triggers the Effect (optional). Accompanying notes for a Policy (optional). Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The updatePolicyIntentV2 object Unique identifier for a given Policy. Human-readable name for a Policy. policyEffect field Enum options: `EFFECT_ALLOW`, `EFFECT_DENY` The condition expression that triggers the Effect (optional). The consensus expression that triggers the Effect (optional). Accompanying notes for a Policy (optional). The result of the activity The updatePolicyResultV2 object Unique identifier for a given Policy. A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/update_policy \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_UPDATE_POLICY_V2", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "policyId": "", "policyName": "", "policyEffect": "", "policyCondition": "", "policyConsensus": "", "policyNotes": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().updatePolicy({ policyId: " (Unique identifier for a given Policy.)", policyName: " (Human-readable name for a Policy.)", policyEffect: "" // policyEffect field, policyCondition: " (The condition expression that triggers the Effect (optional).)", policyConsensus: " (The consensus expression that triggers the Effect (optional).)", policyNotes: " (Accompanying notes for a Policy (optional).)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_UPDATE_POLICY_V2", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "updatePolicyIntentV2": { "policyId": "", "policyName": "", "policyEffect": "", "policyCondition": "", "policyConsensus": "", "policyNotes": "" } }, "result": { "updatePolicyResultV2": { "policyId": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Update private key tag Source: https://docs.turnkey.com/api-reference/activities/update-private-key-tag Update human-readable name or associated private keys. Note that this activity is atomic: all of the updates will succeed at once, or all of them will fail. Enum options: `ACTIVITY_TYPE_UPDATE_PRIVATE_KEY_TAG` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

Unique identifier for a given Private Key Tag. The new, human-readable name for the tag with the given ID.

A list of Private Keys IDs to add this tag to.

Array item type: string

item field

A list of Private Key IDs to remove this tag from.

Array item type: string

item field

 Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The updatePrivateKeyTagIntent object Unique identifier for a given Private Key Tag. The new, human-readable name for the tag with the given ID. A list of Private Keys IDs to add this tag to. item field A list of Private Key IDs to remove this tag from. item field The result of the activity The updatePrivateKeyTagResult object Unique identifier for a given Private Key Tag. A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/update_private_key_tag \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_UPDATE_PRIVATE_KEY_TAG", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "privateKeyTagId": "", "newPrivateKeyTagName": "", "addPrivateKeyIds": [ "" ], "removePrivateKeyIds": [ "" ] } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().updatePrivateKeyTag({ privateKeyTagId: " (Unique identifier for a given Private Key Tag.)", newPrivateKeyTagName: " (The new, human-readable name for the tag with the given ID.)", addPrivateKeyIds: [""] // A list of Private Keys IDs to add this tag to., removePrivateKeyIds: [""] // A list of Private Key IDs to remove this tag from. }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_UPDATE_PRIVATE_KEY_TAG", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "updatePrivateKeyTagIntent": { "privateKeyTagId": "", "newPrivateKeyTagName": "", "addPrivateKeyIds": [ "" ], "removePrivateKeyIds": [ "" ] } }, "result": { "updatePrivateKeyTagResult": { "privateKeyTagId": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Update root quorum Source: https://docs.turnkey.com/api-reference/activities/update-root-quorum Set the threshold and members of the root quorum. This activity must be approved by the current root quorum. Enum options: `ACTIVITY_TYPE_UPDATE_ROOT_QUORUM` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

The threshold of unique approvals to reach quorum.

The unique identifiers of users who comprise the quorum set.

Array item type: string

item field

 Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The updateRootQuorumIntent object The threshold of unique approvals to reach quorum. The unique identifiers of users who comprise the quorum set. item field The result of the activity The updateRootQuorumResult object A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/update_root_quorum \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_UPDATE_ROOT_QUORUM", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "threshold": "", "userIds": [ "" ] } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().updateRootQuorum({ threshold: 0 // The threshold of unique approvals to reach quorum., userIds: [""] // The unique identifiers of users who comprise the quorum set. }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_UPDATE_ROOT_QUORUM", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "updateRootQuorumIntent": { "threshold": "", "userIds": [ "" ] } }, "result": { "updateRootQuorumResult": {} }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Update user Source: https://docs.turnkey.com/api-reference/activities/update-user Update a user in an existing organization. Enum options: `ACTIVITY_TYPE_UPDATE_USER` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

Unique identifier for a given User. Human-readable name for a User. The user's email address.

An updated list of User Tags to apply to this User. This field, if not needed, should be an empty array in your request body.

Array item type: string

item field

 The user's phone number in E.164 format e.g. +13214567890 Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The updateUserIntent object Unique identifier for a given User. Human-readable name for a User. The user's email address. An updated list of User Tags to apply to this User. This field, if not needed, should be an empty array in your request body. item field The user's phone number in E.164 format e.g. +13214567890 The result of the activity The updateUserResult object A User ID. A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/update_user \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_UPDATE_USER", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "userId": "", "userName": "", "userEmail": "", "userTagIds": [ "" ], "userPhoneNumber": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().updateUser({ userId: " (Unique identifier for a given User.)", userName: " (Human-readable name for a User.)", userEmail: " (The user's email address.)", userTagIds: [""] // An updated list of User Tags to apply to this User. This field, if not needed, should be an empty array in your request body., userPhoneNumber: " (The user's phone number in E.164 format e.g. +13214567890)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_UPDATE_USER", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "updateUserIntent": { "userId": "", "userName": "", "userEmail": "", "userTagIds": [ "" ], "userPhoneNumber": "" } }, "result": { "updateUserResult": { "userId": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Update user tag Source: https://docs.turnkey.com/api-reference/activities/update-user-tag Update human-readable name or associated users. Note that this activity is atomic: all of the updates will succeed at once, or all of them will fail. Enum options: `ACTIVITY_TYPE_UPDATE_USER_TAG` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

Unique identifier for a given User Tag. The new, human-readable name for the tag with the given ID.

A list of User IDs to add this tag to.

Array item type: string

item field

A list of User IDs to remove this tag from.

Array item type: string

item field

 Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The updateUserTagIntent object Unique identifier for a given User Tag. The new, human-readable name for the tag with the given ID. A list of User IDs to add this tag to. item field A list of User IDs to remove this tag from. item field The result of the activity The updateUserTagResult object Unique identifier for a given User Tag. A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/update_user_tag \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_UPDATE_USER_TAG", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "userTagId": "", "newUserTagName": "", "addUserIds": [ "" ], "removeUserIds": [ "" ] } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().updateUserTag({ userTagId: " (Unique identifier for a given User Tag.)", newUserTagName: " (The new, human-readable name for the tag with the given ID.)", addUserIds: [""] // A list of User IDs to add this tag to., removeUserIds: [""] // A list of User IDs to remove this tag from. }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_UPDATE_USER_TAG", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "updateUserTagIntent": { "userTagId": "", "newUserTagName": "", "addUserIds": [ "" ], "removeUserIds": [ "" ] } }, "result": { "updateUserTagResult": { "userTagId": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Update user's email Source: https://docs.turnkey.com/api-reference/activities/update-users-email Update a user's email in an existing organization. Enum options: `ACTIVITY_TYPE_UPDATE_USER_EMAIL` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

Unique identifier for a given User. The user's email address. Setting this to an empty string will remove the user's email. Signed JWT containing a unique id, expiry, verification type, contact Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The updateUserEmailIntent object Unique identifier for a given User. The user's email address. Setting this to an empty string will remove the user's email. Signed JWT containing a unique id, expiry, verification type, contact The result of the activity The updateUserEmailResult object Unique identifier of the User whose email was updated. A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/update_user_email \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_UPDATE_USER_EMAIL", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "userId": "", "userEmail": "", "verificationToken": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().updateUserEmail({ userId: " (Unique identifier for a given User.)", userEmail: " (The user's email address. Setting this to an empty string will remove the user's email.)", verificationToken: " (Signed JWT containing a unique id, expiry, verification type, contact)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_UPDATE_USER_EMAIL", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "updateUserEmailIntent": { "userId": "", "userEmail": "", "verificationToken": "" } }, "result": { "updateUserEmailResult": { "userId": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Update user's name Source: https://docs.turnkey.com/api-reference/activities/update-users-name Update a user's name in an existing organization. Enum options: `ACTIVITY_TYPE_UPDATE_USER_NAME` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

Unique identifier for a given User. Human-readable name for a User. Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The updateUserNameIntent object Unique identifier for a given User. Human-readable name for a User. The result of the activity The updateUserNameResult object Unique identifier of the User whose name was updated. A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/update_user_name \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_UPDATE_USER_NAME", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "userId": "", "userName": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().updateUserName({ userId: " (Unique identifier for a given User.)", userName: " (Human-readable name for a User.)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_UPDATE_USER_NAME", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "updateUserNameIntent": { "userId": "", "userName": "" } }, "result": { "updateUserNameResult": { "userId": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Update user's phone number Source: https://docs.turnkey.com/api-reference/activities/update-users-phone-number Update a user's phone number in an existing organization. Enum options: `ACTIVITY_TYPE_UPDATE_USER_PHONE_NUMBER` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

Unique identifier for a given User. The user's phone number in E.164 format e.g. +13214567890. Setting this to an empty string will remove the user's phone number. Signed JWT containing a unique id, expiry, verification type, contact Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The updateUserPhoneNumberIntent object Unique identifier for a given User. The user's phone number in E.164 format e.g. +13214567890. Setting this to an empty string will remove the user's phone number. Signed JWT containing a unique id, expiry, verification type, contact The result of the activity The updateUserPhoneNumberResult object Unique identifier of the User whose phone number was updated. A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/update_user_phone_number \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_UPDATE_USER_PHONE_NUMBER", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "userId": "", "userPhoneNumber": "", "verificationToken": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().updateUserPhoneNumber({ userId: " (Unique identifier for a given User.)", userPhoneNumber: " (The user's phone number in E.164 format e.g. +13214567890. Setting this to an empty string will remove the user's phone number.)", verificationToken: " (Signed JWT containing a unique id, expiry, verification type, contact)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_UPDATE_USER_PHONE_NUMBER", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "updateUserPhoneNumberIntent": { "userId": "", "userPhoneNumber": "", "verificationToken": "" } }, "result": { "updateUserPhoneNumberResult": { "userId": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Update wallet Source: https://docs.turnkey.com/api-reference/activities/update-wallet Update a wallet for an organization. Enum options: `ACTIVITY_TYPE_UPDATE_WALLET` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

Unique identifier for a given Wallet. Human-readable name for a Wallet. Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The updateWalletIntent object Unique identifier for a given Wallet. Human-readable name for a Wallet. The result of the activity The updateWalletResult object A Wallet ID. A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/update_wallet \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_UPDATE_WALLET", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "walletId": "", "walletName": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().updateWallet({ walletId: " (Unique identifier for a given Wallet.)", walletName: " (Human-readable name for a Wallet.)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_UPDATE_WALLET", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "updateWalletIntent": { "walletId": "", "walletName": "" } }, "result": { "updateWalletResult": { "walletId": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Update webhook endpoint Source: https://docs.turnkey.com/api-reference/activities/update-webhook-endpoint Update a webhook endpoint for an organization. Enum options: `ACTIVITY_TYPE_UPDATE_WEBHOOK_ENDPOINT` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

Unique identifier of the webhook endpoint to update. Updated destination URL for webhook delivery. Updated human-readable name for this webhook endpoint. Whether this webhook endpoint is active. Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The updateWebhookEndpointIntent object Unique identifier of the webhook endpoint to update. Updated destination URL for webhook delivery. Updated human-readable name for this webhook endpoint. Whether this webhook endpoint is active. The result of the activity The updateWebhookEndpointResult object Unique identifier of the updated webhook endpoint. webhookEndpoint field Unique identifier of the webhook endpoint. Unique identifier for a given Organization. The destination URL for webhook delivery. Human-readable name for this webhook endpoint. Whether this webhook endpoint is active. Current subscriptions attached to this endpoint. The event type to subscribe to (for example, ACTIVITY\_UPDATES, BALANCE\_CONFIRMED\_UPDATES, or BALANCE\_FINALIZED\_UPDATES). JSON-encoded filter criteria for this subscription. Whether this subscription is active. A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/update_webhook_endpoint \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_UPDATE_WEBHOOK_ENDPOINT", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "endpointId": "", "url": "", "name": "", "isActive": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().updateWebhookEndpoint({ endpointId: " (Unique identifier of the webhook endpoint to update.)", url: " (Updated destination URL for webhook delivery.)", name: " (Updated human-readable name for this webhook endpoint.)", isActive: true // Whether this webhook endpoint is active. }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_UPDATE_WEBHOOK_ENDPOINT", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "updateWebhookEndpointIntent": { "endpointId": "", "url": "", "name": "", "isActive": "" } }, "result": { "updateWebhookEndpointResult": { "endpointId": "", "webhookEndpoint": { "endpointId": "", "organizationId": "", "url": "", "name": "", "isActive": "", "subscriptions": [ { "eventType": "", "filtersJson": "", "isActive": "" } ] } } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Verify generic OTP Source: https://docs.turnkey.com/api-reference/activities/verify-generic-otp Verify a generic OTP. Enum options: `ACTIVITY_TYPE_VERIFY_OTP_V2` Timestamp (in milliseconds) of the request, used to verify liveness of user requests. Unique identifier for a given Organization.

The parameters object containing the specific intent data for this activity.

UUID representing an OTP flow. A new UUID is created for each init OTP activity. Encrypted bundle containing the OTP code and a client-generated public key. Turnkey's secure enclaves will decrypt this bundle, verify the OTP code, and issue a new Verification Token. Encrypted using the target encryption key provided in the INIT\_OTP activity result. Expiration window (in seconds) indicating how long the verification token is valid for. If not provided, a default of 1 hour will be used. Maximum value is 86400 seconds (24 hours) Enable to have your activity generate and return App Proofs, enabling verifiability. A successful response returns the following fields: The activity object containing type, intent, and result Unique identifier for a given Activity object. Unique identifier for a given Organization. The activity status The activity type The intent of the activity The verifyOtpIntentV2 object UUID representing an OTP flow. A new UUID is created for each init OTP activity. Encrypted bundle containing the OTP code and a client-generated public key. Turnkey's secure enclaves will decrypt this bundle, verify the OTP code, and issue a new Verification Token. Encrypted using the target encryption key provided in the INIT\_OTP activity result. Expiration window (in seconds) indicating how long the verification token is valid for. If not provided, a default of 1 hour will be used. Maximum value is 86400 seconds (24 hours) The result of the activity The verifyOtpResult object Signed JWT containing a unique id, expiry, verification type, contact. Verification status of a user is updated when the token is consumed (in OTP\_LOGIN requests) A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. An artifact verifying a User's action. Whether the activity can be approved. Whether the activity can be rejected. The creation timestamp. The last update timestamp. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/submit/verify_otp \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "type": "ACTIVITY_TYPE_VERIFY_OTP_V2", "timestampMs": " (e.g. 1746736509954)", "organizationId": " (Your Organization ID)", "parameters": { "otpId": "", "encryptedOtpBundle": "", "expirationSeconds": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().verifyOtp({ otpId: " (UUID representing an OTP flow. A new UUID is created for each init OTP activity.)", encryptedOtpBundle: " (Encrypted bundle containing the OTP code and a client-generated public key. Turnkey's secure enclaves will decrypt this bundle, verify the OTP code, and issue a new Verification Token. Encrypted using the target encryption key provided in the INIT_OTP activity result.)", expirationSeconds: " (Expiration window (in seconds) indicating how long the verification token is valid for. If not provided, a default of 1 hour will be used. Maximum value is 86400 seconds (24 hours))" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_VERIFY_OTP_V2", "organizationId": "", "timestampMs": " (e.g. 1746736509954)", "result": { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "verifyOtpIntentV2": { "otpId": "", "encryptedOtpBundle": "", "expirationSeconds": "" } }, "result": { "verifyOtpResult": { "verificationToken": "" } }, "votes": "", "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": "", "updatedAt": "" } } } } ``` # Get Account Source: https://docs.turnkey.com/api-reference/auth-proxy/account Return organization id associated with a given phone number, email, public key, credential ID or OIDC token.
POST
[https://authproxy.turnkey.com/v1/account](https://authproxy.turnkey.com/v1/account)
Your Auth Proxy config ID, found in **Dashboard → AUTH**. See [Auth Proxy reference](/reference/auth-proxy) for setup. Specifies the type of filter to apply, i.e 'CREDENTIAL\_ID', 'NAME', 'USERNAME', 'EMAIL', 'PHONE\_NUMBER', 'OIDC\_TOKEN' or 'PUBLIC\_KEY' The value of the filter to apply for the specified type. For example, a specific email or name string. Signed JWT containing a unique id, expiry, verification type, contact. Used to verify access to PII (email/phone number) when filter\_type is 'EMAIL' or 'PHONE\_NUMBER'. OIDC token to verify access to PII (email/phone number) when filter\_type is 'EMAIL' or 'PHONE\_NUMBER'. Needed for social linking when verification\_token is not available. A successful response returns the following fields: organizationId field ```bash title="cURL" theme={"system"} curl --request POST \ --url https://authproxy.turnkey.com/v1/account \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Auth-Proxy-Config-Id: (see Authorizations)" \ --data '{ "filterType": "", "filterValue": "", "verificationToken": "", "oidcToken": "" }' ``` ```json 200 theme={"system"} { "organizationId": "" } ``` # OAuth Login Source: https://docs.turnkey.com/api-reference/auth-proxy/oauth-login Login using an OIDC token and public key.
POST
[https://authproxy.turnkey.com/v1/oauth\_login](https://authproxy.turnkey.com/v1/oauth_login)
Your Auth Proxy config ID, found in **Dashboard → AUTH**. See [Auth Proxy reference](/reference/auth-proxy) for setup. Base64 encoded OIDC token Client-side public key generated by the user, which will be conditionally added to org data based on the validity of the oidc token associated with this request Invalidate all other previously generated Login API keys Unique identifier for a given Organization. If provided, this organization id will be used directly. If omitted, uses the OIDC token to look up the associated organization id. A successful response returns the following fields: Signed JWT containing an expiry, public key, session type, user id, and organization id ```bash title="cURL" theme={"system"} curl --request POST \ --url https://authproxy.turnkey.com/v1/oauth_login \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Auth-Proxy-Config-Id: (see Authorizations)" \ --data '{ "oidcToken": "", "publicKey": "", "invalidateExisting": "", "organizationId": "" }' ``` ```json 200 theme={"system"} { "session": "" } ``` # OAuth 2.0 Authenticate Source: https://docs.turnkey.com/api-reference/auth-proxy/oauth2-authenticate Authenticate with an OAuth 2.0 provider and receive an OIDC token issued by Turnkey in response.
POST
[https://authproxy.turnkey.com/v1/oauth2\_authenticate](https://authproxy.turnkey.com/v1/oauth2_authenticate)
Your Auth Proxy config ID, found in **Dashboard → AUTH**. See [Auth Proxy reference](/reference/auth-proxy) for setup. Enum options: `OAUTH2_PROVIDER_X`, `OAUTH2_PROVIDER_DISCORD` The auth\_code provided by the OAuth 2.0 to the end user to be exchanged for a Bearer token in the OAuth 2.0 flow The URI the user is redirected to after they have authenticated with the OAuth 2.0 provider The code verifier used by OAuth 2.0 PKCE providers A nonce value set to sha256(publicKey), used to bind the OIDC token to a specific public key The client ID registered with the OAuth 2.0 provider A successful response returns the following fields: A Turnkey issued OIDC token to be used with the LoginWithOAuth activity ```bash title="cURL" theme={"system"} curl --request POST \ --url https://authproxy.turnkey.com/v1/oauth2_authenticate \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Auth-Proxy-Config-Id: (see Authorizations)" \ --data '{ "provider": "", "authCode": "", "redirectUri": "", "codeVerifier": "", "nonce": "", "clientId": "" }' ``` ```json 200 theme={"system"} { "oidcToken": "" } ``` # Init OTP Source: https://docs.turnkey.com/api-reference/auth-proxy/otp-init Start a new OTP flow and return a new OTP flow ID.
POST
[https://authproxy.turnkey.com/v1/otp\_init\_v2](https://authproxy.turnkey.com/v1/otp_init_v2)
Your Auth Proxy config ID, found in **Dashboard → AUTH**. See [Auth Proxy reference](/reference/auth-proxy) for setup. Enum to specify whether to send OTP code via SMS or email Email or phone number to send the OTP code to

emailCustomization field

Unique identifier for a given Email Template. If not specified, the default is the most recent Email Template. A successful response returns the following fields: Unique identifier for an OTP flow. Signed bundle containing a target encryption key to use when submitting OTP codes. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://authproxy.turnkey.com/v1/otp_init_v2 \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Auth-Proxy-Config-Id: (see Authorizations)" \ --data '{ "otpType": "", "contact": "", "emailCustomization": { "templateId": "" } }' ``` ```json 200 theme={"system"} { "otpId": "", "otpEncryptionTargetBundle": "" } ``` # OTP Login Source: https://docs.turnkey.com/api-reference/auth-proxy/otp-login Login using an existing OTP Verification Token and a client-side signature. The signature's public key must match the public key contained within the OTP Verification Token.
POST
[https://authproxy.turnkey.com/v1/otp\_login\_v2](https://authproxy.turnkey.com/v1/otp_login_v2)
Your Auth Proxy config ID, found in **Dashboard → AUTH**. See [Auth Proxy reference](/reference/auth-proxy) for setup. Session containing a unique id, expiry, verification type, contact. Verification status of a user is updated when the token is consumed (in OTP\_LOGIN requests) Client-side public key generated by the user, used as the session public key upon successful login.

clientSignature field

The public component of a cryptographic key pair used to create the signature. Enum options: `CLIENT_SIGNATURE_SCHEME_API_P256` The message that was signed. The cryptographic signature over the message. Invalidate all other previously generated Login sessions Unique identifier for a given Organization. If provided, this organization id will be used directly. If omitted, uses the verification token to look up the verified sub-organization based on the contact and verification type. A successful response returns the following fields: Session containing an expiry, public key, session type, user id, and organization id ```bash title="cURL" theme={"system"} curl --request POST \ --url https://authproxy.turnkey.com/v1/otp_login_v2 \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Auth-Proxy-Config-Id: (see Authorizations)" \ --data '{ "verificationToken": "", "publicKey": "", "clientSignature": { "publicKey": "", "scheme": "", "message": "", "signature": "" }, "invalidateExisting": "", "organizationId": "" }' ``` ```json 200 theme={"system"} { "session": "" } ``` # Verify OTP Source: https://docs.turnkey.com/api-reference/auth-proxy/otp-verify Verify the OTP code previously sent to the user's contact and return a verification token.
POST
[https://authproxy.turnkey.com/v1/otp\_verify\_v2](https://authproxy.turnkey.com/v1/otp_verify_v2)
Your Auth Proxy config ID, found in **Dashboard → AUTH**. See [Auth Proxy reference](/reference/auth-proxy) for setup. ID representing the result of an init OTP activity. Encrypted bundle containing the OTP code and a client-generated public key. Turnkey's secure enclaves will decrypt this bundle, verify the OTP code, and issue a new Verification Token. Encrypted using the target encryption key provided in the INIT\_OTP activity result. A successful response returns the following fields: Verification Token containing a unique id, expiry, verification type, contact signed by Turnkey's enclaves. Verification status of a user is updated when the token is consumed (in OTP\_LOGIN requests) ```bash title="cURL" theme={"system"} curl --request POST \ --url https://authproxy.turnkey.com/v1/otp_verify_v2 \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Auth-Proxy-Config-Id: (see Authorizations)" \ --data '{ "otpId": "", "encryptedOtpBundle": "" }' ``` ```json 200 theme={"system"} { "verificationToken": "" } ``` # Signup Source: https://docs.turnkey.com/api-reference/auth-proxy/signup Onboard a new user.
POST
[https://authproxy.turnkey.com/v1/signup\_v2](https://authproxy.turnkey.com/v1/signup_v2)
Your Auth Proxy config ID, found in **Dashboard → AUTH**. See [Auth Proxy reference](/reference/auth-proxy) for setup. userEmail field userPhoneNumber field userTag field userName field organizationName field verificationToken field

A list of API Key parameters. This field, if not needed, should be an empty array in your request body.

Human-readable name for an API Key. The public component of a cryptographic key pair used to sign messages and transactions. Enum options: `API_KEY_CURVE_P256`, `API_KEY_CURVE_SECP256K1`, `API_KEY_CURVE_ED25519` Optional window (in seconds) indicating how long the API Key should last.

A list of Authenticator parameters. This field, if not needed, should be an empty array in your request body.

Human-readable name for an Authenticator. Challenge presented for authentication purposes.

attestation field

The cbor encoded then base64 url encoded id of the credential. A base64 url encoded payload containing metadata about the signing context and the challenge. A base64 url encoded payload containing authenticator data and any attestation the webauthn provider chooses. Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID`

A list of Oauth providers. This field, if not needed, should be an empty array in your request body.

Human-readable name to identify a Provider. Base64 encoded OIDC token

oidcClaims field

The issuer identifier from the OIDC token (iss claim) The subject identifier from the OIDC token (sub claim) The audience from the OIDC token (aud claim)

wallet field

Human-readable name for a Wallet.

A list of wallet Accounts. This field, if not needed, should be an empty array in your request body.

Enum options: `CURVE_SECP256K1`, `CURVE_ED25519`, `CURVE_P256` Enum options: `PATH_FORMAT_BIP32` Path used to generate a wallet Account. Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` Optional human-readable name for the account. Length of mnemonic to generate the Wallet seed. Defaults to 12. Accepted values: 12, 15, 18, 21, 24.

clientSignature field

The public component of a cryptographic key pair used to create the signature. Enum options: `CLIENT_SIGNATURE_SCHEME_API_P256` The message that was signed. The cryptographic signature over the message. A successful response returns the following fields: organizationId field wallet field walletId field A list of account addresses. item field Root user ID created for this sub-organization A list of App Proofs generated by enclaves during activity execution, providing verifiable attestations of performed operations. scheme field Enum options: `SIGNATURE_SCHEME_EPHEMERAL_KEY_P256` Ephemeral public key. JSON serialized AppProofPayload. Signature over hashed proof\_payload. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://authproxy.turnkey.com/v1/signup_v2 \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Auth-Proxy-Config-Id: (see Authorizations)" \ --data '{ "userEmail": "", "userPhoneNumber": "", "userTag": "", "userName": "", "organizationName": "", "verificationToken": "", "apiKeys": [ { "apiKeyName": "", "publicKey": "", "curveType": "", "expirationSeconds": "" } ], "authenticators": [ { "authenticatorName": "", "challenge": "", "attestation": { "credentialId": "", "clientDataJson": "", "attestationObject": "", "transports": [ "" ] } } ], "oauthProviders": [ { "providerName": "", "oidcToken": "", "oidcClaims": { "iss": "", "sub": "", "aud": "" } } ], "wallet": { "walletName": "", "accounts": [ { "curve": "", "pathFormat": "", "path": "", "addressFormat": "", "name": "" } ], "mnemonicLength": "" }, "clientSignature": { "publicKey": "", "scheme": "", "message": "", "signature": "" } }' ``` ```json 200 theme={"system"} { "organizationId": "", "wallet": { "walletId": "", "addresses": [ "" ] }, "userId": "", "appProofs": [ { "scheme": "", "publicKey": "", "proofPayload": "", "signature": "" } ] } ``` # Get WalletKit Config Source: https://docs.turnkey.com/api-reference/auth-proxy/wallet-kit-config Get wallet kit settings and feature toggles for the calling organization.
POST
[https://authproxy.turnkey.com/v1/wallet\_kit\_config](https://authproxy.turnkey.com/v1/wallet_kit_config)
Your Auth Proxy config ID, found in **Dashboard → AUTH**. See [Auth Proxy reference](/reference/auth-proxy) for setup. A successful response returns the following fields: List of enabled authentication providers (e.g., 'facebook', 'google', 'apple', 'email', 'sms', 'passkey', 'wallet') item field Session expiration duration in seconds The organization ID this configuration applies to Mapping of social login providers to their OAuth client IDs. OAuth redirect URL to be used for social login flows. otpAlphanumeric field otpLength field ```bash title="cURL" theme={"system"} curl --request POST \ --url https://authproxy.turnkey.com/v1/wallet_kit_config \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Auth-Proxy-Config-Id: (see Authorizations)" \ --data '{}' ``` ```json 200 theme={"system"} { "enabledProviders": [ "" ], "sessionExpirationSeconds": "", "organizationId": "", "oauthClientIds": "", "oauthRedirectUrl": "", "otpAlphanumeric": "", "otpLength": "" } ``` # Errors Source: https://docs.turnkey.com/api-reference/overview/errors Error codes, messages, and troubleshooting guide for the Turnkey API. An error returned by the Turnkey API might look something like this: ```bash theme={"system"} Turnkey error 3: organization mismatch: request is targeting organization ("USER SUB ORG"), but voters are in organization ("OUR MAIN ORG") (Details: [{"@type":"type.googleapis.com/errors.v1.TurnkeyErrorDetail","turnkeyErrorCode":"ORGANIZATION_MISMATCH"}]) ``` Within this error message there are a few different parts that are worth breaking down. First the GRPC Error code: ```bash theme={"system"} Turnkey error 3: ``` This GRPC error wraps what we call a Turnkey Error which looks something like: ```bash theme={"system"} organization mismatch: request is targeting organization ("USER SUB ORG"), but voters are in organization ("OUR MAIN ORG") ``` And when available, a `turnkeyErrorCode` in the Details section: ```bash theme={"system"} (Details: [{"@type":"type.googleapis.com/errors.v1.TurnkeyErrorDetail","turnkeyErrorCode":"ORGANIZATION_MISMATCH"}]) ``` ## Error handling best practices What matters most for error handling is the **Turnkey Error**: the human-readable message and `turnkeyErrorCode` (when available). You should **not** perform error handling based on the GRPC code - these are used internally and will eventually be removed. More on that [here](#grpc-error-codes). **Understanding TurnkeyErrorCodes:** These codes represent **categories** of errors, not specific messages. For example, `SIGNATURE_INVALID` may appear with messages like "could not verify WebAuthn signature" or "could not verify api key signature". Use the `turnkeyErrorCode` to identify the error category programmatically, and use the human-readable message for specific details. ### Available TurnkeyErrorCodes The following error codes may be returned in error details: | Code | Description | | :------------------------------- | :---------------------------------------------------------------------------------------------------------------- | | `UNSPECIFIED` | Error code not specified | | `INTERNAL` | Internal server error | | `ORGANIZATION_NOT_FOUND` | The specified organization could not be found | | `API_OPERATIONS_DISABLED` | Global API access is temporarily disabled | | `SIGNING_QUOTA_EXCEEDED` | Organization has exceeded its signing quota and cannot execute activities | | `REQUEST_NOT_AUTHORIZED` | Request is not authorized - may occur when accessing resources outside permissions or beyond session restrictions | | `PUBLIC_KEY_NOT_FOUND` | Public key could not be found in the organization or its parent | | `RATE_LIMIT_EXCEEDED` | Organization has been rate limited and cannot execute activities | | `SIGNATURE_MISSING` | Required authentication signature is missing from the request | | `SIGNATURE_INVALID` | Could not verify API key or WebAuthn signature | | `CREDENTIAL_NOT_FOUND` | Credential or WebAuthn authenticator not found in organization or its parent | | `CREDENTIAL_CONFLICT` | Multiple sub-organizations are associated with this credential, creating ambiguous authentication | | `API_KEY_EXPIRED` | The API key has expired and can no longer be used | | `REQUEST_INVALID` | Request contains invalid or missing required parameters | | `FORBIDDEN` | User does not have permission to view or access this organization | | `UNAUTHENTICATED` | Authentication failed - request lacks valid authentication credentials | | `UNSUPPORTED_TRANSACTION_TYPE` | Transaction type is not supported (supported: Ethereum, Solana, Tron, Bitcoin, Tempo) | | `INVALID_TRANSACTION` | Transaction structure is invalid (e.g., too many addresses in Solana transaction) | | `INVALID_OIDC_TOKEN` | OIDC token is invalid or missing required claims (aud, sub, iss) | | `INVALID_ORGANIZATION_ID` | Organization ID is invalid or malformed (must be a valid UUID) | | `OAUTH2_CREDENTIAL_NOT_FOUND` | The specified OAuth 2.0 credential could not be found | | `OAUTH2_PROVIDER_NOT_FOUND` | The specified OAuth 2.0 provider could not be found | | `INVALID_OAUTH2_PROVIDER` | OAuth 2.0 provider configuration is invalid or misconfigured | | `OAUTH2_PROVIDER_NOT_CONFIGURED` | OAuth 2.0 provider has not been configured for this organization | | `INVALID_ACTIVITY_CALLER` | This activity cannot be called by sub-organizations | | `WALLET_ACCOUNT_NOT_EXPORTED` | Wallet account has not been exported and cannot be deleted without export | | `INVALID_TIME` | Time range is invalid or results in excessive intervals | | `RPC_CALL_ERROR` | RPC provider communication error | | `INVALID_EMAIL` | Email address is invalid - check format, domain, and TLD (Top-Level Domain) | | `INVALID_FQDN` | Email domain could not be reached or verified | | `OAUTH_PROVIDER_ALREADY_EXISTS` | OAuth provider with same audience, subject, and issuer already exists | | `EMAIL_SENDING_DISABLED` | Email sending functionality is currently disabled | Not all errors currently include a `turnkeyErrorCode`, though we aim to include one in all customer-facing errors. If you encounter an error where you would expect a `turnkeyErrorCode` but don't see one, please contact Turnkey support. ## Detailed error messages The below table enumerates common errors across different actions that can be taken using the API. It contains GRPC codes, HTTP codes, and error messages. More on GRPC error codes [below](#grpc-error-codes). Click on the message to view detailed explanation of possible causes and troubleshooting tips for that specific error. | GRPC Code | HTTP Code | Message | | :---------------- | :-------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | InvalidArgument | 400 | [malformed organization ID provided](#malformed-organization-id-provided) | | InvalidArgument | 400 | [bad request body](#bad-request-body) | | InvalidArgument | 400 | [failed to load organizations](#failed-to-load-organizations) | | InvalidArgument | 400 | [policy label must be unique](#policy-label-must-be-unique) | | InvalidArgument | 400 | [invalid policy consensus](#invalid-policy-consensus) | | InvalidArgument | 400 | [invalid policy condition](#invalid-policy-condition) | | InvalidArgument | 400 | [quorum threshold must be non-zero integer](#quorum-threshold-must-be-non-zero-integer) | | InvalidArgument | 400 | [quorum users missing](#quorum-users-missing) | | InvalidArgument | 400 | [invalid api key expiration](#invalid-api-key-expiration) | | InvalidArgument | 400 | [missing parameter: user authenticator attestation](#missing-parameter-user-authenticator-attestation) | | InvalidArgument | 400 | [invalid authenticator attestation](#invalid-authenticator-attestation) | | InvalidArgument | 400 | [missing parameter: user authenticator attestation auth data](#missing-parameter-user-authenticator-attestation-auth-data) | | InvalidArgument | 400 | [missing wallet params](#missing-wallet-params) | | InvalidArgument | 400 | [invalid path format](#invalid-path-format) | | InvalidArgument | 400 | [invalid path](#invalid-path) | | InvalidArgument | 400 | [invalid address format](#invalid-address-format) | | InvalidArgument | 400 | [invalid curve](#invalid-curve) | | InvalidArgument | 400 | [curve required](#curve-required) | | InvalidArgument | 400 | [invalid payload encoding](#invalid-payload-encoding) | | InvalidArgument | 400 | [invalid hash function](#invalid-hash-function) | | InvalidArgument | 400 | [invalid magic link template](#invalid-magic-link-template) | | InvalidArgument | 400 | [failed to get email template contents](#failed-to-get-email-template-contents) | | InvalidArgument | 400 | [failed to unmarshal template variables](#failed-to-unmarshal-template-variables) | | InvalidArgument | 400 | [organization mismatch](#organization-mismatch) | | InvalidArgument | 400 | [invalid wallet account UUID](#invalid-wallet-account-uuid) | | InvalidArgument | 400 | [wallet account not part of your organization](#wallet-account-not-part-of-your-organization) | | InvalidArgument | 400 | [wallet account has not been exported](#wallet-account-has-not-been-exported) | | InvalidArgument | 400 | [invalid OIDC token](#invalid-oidc-token) | | InvalidArgument | 400 | [invalid email address](#invalid-email-address) | | InvalidArgument | 400 | [could not reach email](#could-not-reach-email) | | InvalidArgument | 400 | [auth\_code must be set](#oauth2-parameter-errors) | | InvalidArgument | 400 | [code\_verifier must be set](#oauth2-parameter-errors) | | InvalidArgument | 400 | [oauth2\_credential\_id must be set](#oauth2-parameter-errors) | | InvalidArgument | 400 | [redirect\_uri must be set](#oauth2-parameter-errors) | | InvalidArgument | 400 | [client\_id must be set](#oauth2-parameter-errors) | | Unauthenticated | 401 | [no valid authentication signature found for request](#no-valid-authentication-signature-found-for-request) | | Unauthenticated | 401 | [could not find public key in organization](#could-not-find-public-key-in-organization) | | Unauthenticated | 401 | [failed while looking up public key in parent organization](#failed-while-looking-up-public-key-in-parent-organization) | | Unauthenticated | 401 | [could not find public key in organization or its parent organization](#could-not-find-public-key-in-organization-or-its-parent-organization) | | Unauthenticated | 401 | [could not verify WebAuthN signature](#could-not-verify-webauthn-signature) | | Unauthenticated | 401 | [credential ID could not be found in organization or its parent organization](#credential-id-could-not-be-found-in-organization-or-its-parent-organization) | | Unauthenticated | 401 | [public key could not be found in organization or its parent organization](#public-key-could-not-be-found-in-organization-or-its-parent-organization) | | Unauthenticated | 401 | [more than one suborg associated with a credential ID](#more-than-one-suborg-associated-with-a-credential-id) | | Unauthenticated | 401 | [more than one suborg associated with a public key](#more-than-one-suborg-associated-with-a-public-key) | | Unauthenticated | 401 | [could not verify api key signature](#could-not-verify-api-key-signature) | | Unauthenticated | 401 | [expired api key](#expired-api-key) | | Unauthenticated | 401 | [malformed activity stamp](#malformed-activity-stamp) | | Unauthenticated | 401 | [could not extract webauthn stamp](#could-not-extract-webauthn-stamp) | | Unauthenticated | 401 | [could not extract api key stamp](#could-not-extract-api-key-stamp) | | Unauthenticated | 401 | [cannot authenticate public API activity request without a stamp (X-Stamp/X-Stamp-Webauthn header)](#cannot-authenticate-public-api-activity-request-without-a-stamp-x-stampx-stamp-webauthn-header) | | PermissionDenied | 403 | [request not authorized](#request-not-authorized) | | PermissionDenied | 403 | [api operations disabled](#api-operations-disabled) | | PermissionDenied | 403 | [authentication failed](#authentication-failed) | | NotFound | 404 | [webauthn authenticator not found in organization](#webauthn-authenticator-not-found-in-organization) | | NotFound | 404 | [webauthn authenticator not found in organization or parent organization](#webauthn-authenticator-not-found-in-organization-or-parent-organization) | | NotFound | 404 | [no organization found with the given ID](#no-organization-found-with-the-given-id) | | NotFound | 404 | [No activity found with fingerprint. Consensus activities must target an existing activity by fingerprint](#no-activity-found-with-fingerprint-consensus-activities-must-target-an-existing-activity-by-fingerprint) | | ResourceExhausted | 429 | [user has exceeded maximum authenticators](#user-has-exceeded-maximum-authenticators) | | ResourceExhausted | 429 | [user has exceeded maximum long-lived api keys](#user-has-exceeded-maximum-long-lived-api-keys) | | ResourceExhausted | 429 | [user has exceeded maximum short-lived api keys](#user-has-exceeded-maximum-short-lived-api-keys) | | ResourceExhausted | 429 | [this organization cannot execute activities because it is over its allotted quota. Please reach out to the Turnkey team (help@turnkey.com) for more information.](#this-organization-cannot-execute-activities-because-it-is-over-its-allotted-quota-please-reach-out-to-the-turnkey-team-helpturnkeycom-for-more-information) | | ResourceExhausted | 429 | [this sub-organization cannot execute activities because its parent is over its allotted quota. Please reach out to the Turnkey team (help@turnkey.com) for more information.](#this-sub-organization-cannot-execute-activities-because-its-parent-is-over-its-allotted-quota-please-reach-out-to-the-turnkey-team-helpturnkeycom-for-more-information) | | ResourceExhausted | 429 | [this organization cannot execute activities because it has been rate limited. Please reach out to the Turnkey team (help@turnkey.com) for more information.](#this-organization-cannot-execute-activities-because-it-has-been-rate-limited-please-reach-out-to-the-turnkey-team-helpturnkeycom-for-more-information) | | ResourceExhausted | 429 | [this sub-organization cannot execute activities because its parent has been rate limited. Please reach out to the Turnkey team (help@turnkey.com) for more information.](#this-sub-organization-cannot-execute-activities-because-its-parent-has-been-rate-limited-please-reach-out-to-the-turnkey-team-helpturnkeycom-for-more-information) | | Internal | 500 | [internal server error](#internal-server-error) | ## GRPC error codes Turnkey uses GRPC internally to communicate with our internal services whenever an API request is made. Due to this some errors will be wrapped with GRPC error messages. These error codes are listed below for your convenience, however these will not remain in Turnkey error messages forever and you should **not** do error handling based on these codes as these could be removed at any time. In the following example `Turnkey error 3:` represents a grpc error (error code 3, INVALID\_ARGUMENT) wrapping a Turnkey error. Example ```bash theme={"system"} Turnkey error 3: organization mismatch: request is targeting organization ("USER SUB ORG"), but voters are in organization ("OUR MAIN ORG") ``` ### GRPC status codes reference | Code | Number | Description | | -------------------- | ------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | OK | 0 | Not an error; returned on success. | | CANCELLED | 1 | The operation was cancelled, typically by the caller. | | UNKNOWN | 2 | Unknown error. For example, this error may be returned when a `Status` value received from another address space belongs to an error space that is not known in this address space. Also errors raised by APIs that do not return enough error information may be converted to this error. | | INVALID\_ARGUMENT | 3 | The client specified an invalid argument. Note that this differs from `FAILED_PRECONDITION`. `INVALID_ARGUMENT` indicates arguments that are problematic regardless of the state of the system (e.g., a malformed file name). | | DEADLINE\_EXCEEDED | 4 | The deadline expired before the operation could complete. For operations that change the state of the system, this error may be returned even if the operation has completed successfully. For example, a successful response from a server could have been delayed long | | NOT\_FOUND | 5 | Some requested entity (e.g., file or directory) was not found. Note to server developers: if a request is denied for an entire class of users, such as gradual feature rollout or undocumented allowlist, `NOT_FOUND` may be used. If a request is denied for some users within a class of users, such as user-based access control, `PERMISSION_DENIED` must be used. | | ALREADY\_EXISTS | 6 | The entity that a client attempted to create (e.g., file or directory) already exists. | | PERMISSION\_DENIED | 7 | The caller does not have permission to execute the specified operation. `PERMISSION_DENIED` must not be used for rejections caused by exhausting some resource (use `RESOURCE_EXHAUSTED` instead for those errors). `PERMISSION_DENIED` must not be used if the caller can not be identified (use `UNAUTHENTICATED` instead for those errors). This error code does not imply the request is valid or the requested entity exists or satisfies other pre-conditions. | | RESOURCE\_EXHAUSTED | 8 | Some resource has been exhausted, perhaps a per-user quota, or perhaps the entire file system is out of space. | | FAILED\_PRECONDITION | 9 | The operation was rejected because the system is not in a state required for the operation's execution. For example, the directory to be deleted is non-empty, an rmdir operation is applied to a non-directory, etc. Service implementors can use the following guidelines to decide between `FAILED_PRECONDITION`, `ABORTED`, and `UNAVAILABLE`: (a) Use `UNAVAILABLE` if the client can retry just the failing call. (b) Use `ABORTED` if the client should retry at a higher level (e.g., when a client-specified test-and-set fails, indicating the client should restart a read-modify-write sequence). (c) Use `FAILED_PRECONDITION` if the client should not retry until the system state has been explicitly fixed. E.g., if an "rmdir" fails because the directory is non-empty, `FAILED_PRECONDITION` should be returned since the client should not retry unless the files are deleted from the directory. | | ABORTED | 10 | The operation was aborted, typically due to a concurrency issue such as a sequencer check failure or transaction abort. See the guidelines above for deciding between `FAILED_PRECONDITION`, `ABORTED`, and `UNAVAILABLE`. | | OUT\_OF\_RANGE | 11 | The operation was attempted past the valid range. E.g., seeking or reading past end-of-file. Unlike `INVALID_ARGUMENT`, this error indicates a problem that may be fixed if the system state changes. For example, a 32-bit file system will generate `INVALID_ARGUMENT` if asked to read at an offset that is not in the range \[0,2^32-1], but it will generate `OUT_OF_RANGE` if asked to read from an offset past the current file size. There is a fair bit of overlap between `FAILED_PRECONDITION` and `OUT_OF_RANGE`. We recommend using `OUT_OF_RANGE` (the more specific error) when it applies so that callers who are iterating through a space can easily look for an `OUT_OF_RANGE` error to detect when they are done. | | UNIMPLEMENTED | 12 | The operation is not implemented or is not supported/enabled in this service. | | INTERNAL | 13 | Internal errors. This means that some invariants expected by the underlying system have been broken. This error code is reserved for serious errors. | | UNAVAILABLE | 14 | The service is currently unavailable. This is most likely a transient condition, which can be corrected by retrying with a backoff. Note that it is not always safe to retry non-idempotent operations. | | DATA\_LOSS | 15 | Unrecoverable data loss or corruption. | | UNAUTHENTICATED | 16 | The request does not have valid authentication credentials for the operation. | Source: [https://grpc.io/docs/guides/status-codes/](https://grpc.io/docs/guides/status-codes/) ## Troubleshooting ### no organization found with the given ID Common causes: * An unknown organization ID was passed in a request made to the Turnkey API Troubleshooting tips: * Confirm that you are using the proper Organization ID. All Turnkey resources are identified with a UUID, so confirm you are not passing a different resource's UUID as the organization ID in your request. ### malformed organization ID provided Common causes: * An improperly formatted organization ID UUID was passed in a request made to the Turnkey API Troubleshooting tips: * Confirm the the UUID conforms to the UUID standard `XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX` ### bad request body Common causes: * A malformed request body was passed in a request made to the Turnky API Troubleshooting tips: * A typical activity request has the `type`, `timestampMS`, and `organizationId` parameters at the top level and then a `parameters` parameter with more specific parameters based on the request type. For example a CREATE\_WALLET activity request body might look something like this: ```json theme={"system"} { "type": "ACTIVITY_TYPE_CREATE_WALLET", "timestampMs": "", "organizationId": "string", "parameters": { "walletName": "string", "accounts": [ { "curve": "CURVE_SECP256K1", "pathFormat": "PATH_FORMAT_BIP32", "path": "string", "addressFormat": "ADDRESS_FORMAT_UNCOMPRESSED" } ], "mnemonicLength": 0 } } ``` * A get resource request body might look slightly different with less fields. An example of a GET\_WALLET request body looks something like this: ```json theme={"system"} { "organizationId": "string", "walletId": "string" } ``` ### api operations disabled Common causes: * Turnkey has disabled API operations globally. Troubleshooting tips: * This situation will only happen in the most extreme case and should not be something you need to worry about. ### this organization cannot execute activities because it is over its allotted quota. Please reach out to the Turnkey team ([help@turnkey.com](mailto:help@turnkey.com)) for more information. Common causes: * You have exceeded your monthly signing quota. The first 25 signatures a month are free for "free" users. * You have reached a resource limit on a particular resource. You can find out about our resource limits [here](/reference/resource-limits). Troubleshooting tips: * If you need to increase your signature limit take a look at our [pricing page](https://www.turnkey.com/pricing) and contact us at [help@turnkey.com](mailto:help@turnkey.com)! * Resource limits are imposed globally and cannot be increased, speak with our team at [help@turnkey.com](mailto:help@turnkey.com) to understand how to better integrate Turnkey with your system to utilize Turnkey to its highest potential. ### this sub-organization cannot execute activities because its parent is over its allotted quota. Please reach out to the Turnkey team ([help@turnkey.com](mailto:help@turnkey.com)) for more information. Common causes: * You have exceeded your monthly signing quota. The first 25 signatures a month are free for "free" users. * You have reached a resource limit on a particular resource. You can find out about our resource limits [here](/reference/resource-limits). Troubleshooting tips: * If you need to increase your signature limit take a look at our [pricing page](https://www.turnkey.com/pricing) and contact us at [help@turnkey.com](mailto:help@turnkey.com)! * Resource limits are imposed globally and cannot be increased, speak with our team at [help@turnkey.com](mailto:help@turnkey.com) to understand how to better integrate Turnkey with your system to utilize Turnkey to its highest potential. ### this organization cannot execute activities because it has been rate limited. Please reach out to the Turnkey team ([help@turnkey.com](mailto:help@turnkey.com)) for more information. Common causes: * You have exceeded your rate limit. We need to maintain a per-customer rate limit to ensure that the service we provide to all of our customers service can be exceptional. Troubleshooting tips: * If you are interested in increasing your rate limit reach out to us at [help@turnkey.com](mailto:help@turnkey.com)! ### this sub-organization cannot execute activities because its parent has been rate limited. Please reach out to the Turnkey team ([help@turnkey.com](mailto:help@turnkey.com)) for more information. Common causes: * You have exceeded your rate limit. We need to maintain a per-customer rate limit to ensure that the service we provide to all of our customers service can be exceptional. Troubleshooting tips: * If you are interested in increasing your rate limit reach out to us at [help@turnkey.com](mailto:help@turnkey.com)! ### request not authorized Common causes: * A user that created a request is not allowed to complete the action that was requested. * For example a parent-organization trying to create a wallet within a sub-organization that does not have a delegated access API key. Troubleshooting tips: * Confirm that you are using the correct credentials for the request you are making. * Confirm that all necessary [policies](/features/policies/overview) are in place so that the action that is requested can be performed. ### no valid authentication signature found for request Common causes: * No signature, or [stamp](/api-reference/overview/stamps), is attached to a request. All requests made to Turnkey's api must be stamped so that Turnkey can authenticate and authorize the user who performed the request. Troubleshooting tips: * Take a look at the page on [stamps](/api-reference/overview/stamps) to get some information about stamps, what they are, and how they are created. * At a base level our SDK's abstract away the complicated stamping process for you. [Here](https://github.com/tkhq/sdk/tree/main/examples) are some example projects with our JS/TS SDK to get you started! ### could not find public key in organization Common causes: * The public key corresponding to the signature in a stamp is not found in the organization the request is targeting. This means that a request was formatted properly, but the authenticator used to create the request is not associated with the organization that the request was made for. Troubleshooting tips: * Ensure that you have added the proper authenticators to the organization you are targeting. * Ensure that you are targeting the proper organization. ### failed while looking up public key in parent organization Common causes: * The public key corresponding to the signature in a stamp is not found in the organization the request is targeting. This means that a request was formatted properly, but the authenticator used to create the request is not associated with the organization that the request was made for. Troubleshooting tips: * Ensure that you have added the proper authenticators to the organization you are targeting. * Ensure that you are targeting the proper organization. ### could not find public key in organization or its parent organization Common causes: * The public key corresponding to the signature in a stamp is not found in the organization the request is targeting. This means that a request was formatted properly, but the authenticator used to create the request is not associated with the organization that the request was made for. Troubleshooting tips: * Ensure that you have added the proper authenticators to the organization you are targeting. * Ensure that you are targeting the proper organization. ### could not verify WebAuthN signature Common causes: * The signature used to create a stamp for a request cannot be verified for the organization the request is targeting. Again this means the request is formatted properly, but the authenticator used to create the request is not associated with the organization that the request was made for. Troubleshooting tips: * Ensure that you have added the proper authenticators to the organization you are targeting. * Ensure that you are targeting the proper organization. ### credential ID could not be found in organization or its parent organization Common causes: * Turnkey cannot translate a public key obtained from a stamp that was created with a WebAuthn authenticator to a parent organization or one of its corresponding sub-organizations that the request was made for. Troubleshooting tips: * Ensure that you have added the proper authenticators to the organization you are targeting. * Ensure that you are targeting the proper organization. ### public key could not be found in organization or its parent organization Common causes: * Turnkey cannot translate a public key obtained from a stamp to a parent organization or one of its corresponding sub-organizations that the request was made for. Troubleshooting tips: * Ensure that you have added the proper authenticators to the organization you are targeting. * Ensure that you are targeting the proper organization. ### more than one suborg associated with a credential ID Common causes: * This error occurs for requests like [whoami](/api-reference/queries/who-am-i). In particular this request tries to go backwards from the stamp to the public key then to a corresponding sub-orgnaization under a parent organization. If there are multiple sub-organizations with the same public key corresponding to an authenticator it is unknown who is initiating that particular request without more context. Troubleshooting tips: * Inlcude the sub-organization ID in the whoami request body. * Avoid including the same authenticator in multiple sub-organizations ### more than one suborg associated with a public key Common causes: * This error occurs for requests like [whoami](/api-reference/queries/who-am-i). In particular this request tries to go backwards from the stamp to the public key then to a corresponding sub-orgnaization under a parent organization. If there are multiple sub-organizations with the same public key it is unknown who is initiating that particular request without more context. Troubleshooting tips: * Inlcude the sub-organization ID in the whoami request body. * Avoid including the same authenticator in multiple sub-organizations ### could not verify api key signature Common causes: * The signature used to create a stamp for a request cannot be verified for the organization the request is targeting. This means the request is formatted properly, but the api-key used to create the request is not associated with the organization that the request was made for. Troubleshooting tips: * Ensure that you have added the proper api-keys to the organization you are targeting. * Ensure that you are targeting the proper organization. ### expired api key Common causes: * The API key used for the request has expired Troubleshooting tips: * Create a new API key to use for the request * Create an API key that doesn't expire ### malformed activity stamp Common causes: * The stamp attached to a request is not formatted properly. Troubleshooting tips: * Take a look at the page on [stamps](/api-reference/overview/stamps) to get some information about stamps, what they are, and how they are created. * At a base level our SDK's abstract away the complicated stamping process for you. [Here](https://github.com/tkhq/sdk/tree/main/examples) are some example projects with our JS/TS SDK to get you started! ### could not extract webauthn stamp Common causes: * A stamp is not attached to a request. Troubleshooting tips: * Take a look at the page on [stamps](/api-reference/overview/stamps) to get some information about stamps, what they are, and how they are created. * At a base level our SDK's abstract away the complicated stamping process for you. [Here](https://github.com/tkhq/sdk/tree/main/examples) are some example projects with our JS/TS SDK to get you started! ### could not extract api key stamp Common causes: * A stamp is not attached to a request. Troubleshooting tips: * Take a look at the page on [stamps](/api-reference/overview/stamps) to get some information about stamps, what they are, and how they are created. * At a base level our SDK's abstract away the complicated stamping process for you. [Here](https://github.com/tkhq/sdk/tree/main/examples) are some example projects with our JS/TS SDK to get you started! ### cannot authenticate public API activity request without a stamp (X-Stamp/X-Stamp-Webauthn header) Common causes: * A stamp is not attached to a request. Troubleshooting tips: * Take a look at the page on [stamps](/api-reference/overview/stamps) to get some information about stamps, what they are, and how they are created. * At a base level our SDK's abstract away the complicated stamping process for you. [Here](https://github.com/tkhq/sdk/tree/main/examples) are some example projects with our JS/TS SDK to get you started! ### webauthn authenticator not found in organization Common causes: * The signature used to create a stamp for a request cannot be verified for the organization the request is targeting. This means the request is formatted properly, but the webauthn authenticator used to create the request is not associated with the organization that the request was made for. Troubleshooting tips: * Ensure that you have added the proper authenticator to the organization you are targeting. * Ensure that you are targeting the proper organization. ### webauthn authenticator not found in organization or parent organization Common causes: * The signature used to create a stamp for a request cannot be verified for the organization the request is targeting. This means the request is formatted properly, but the webauthn authenticator used to create the request is not associated with the organization that the request was made for. Troubleshooting tips: * Ensure that you have added the proper authenticator to the organization you are targeting. * Ensure that you are targeting the proper organization. ### invalid payload encoding Common causes: * This error is specific to the [sign\_raw\_payload](/api-reference/signing/sign-raw-payload) endpoint. A valid encoding needs to be passed so that Turnkey can properly sign the requested message. Troubleshooting tips: * Use a valid encoding scheme from the following: `PAYLOAD_ENCODING_HEXADECIMAL`, `PAYLOAD_ENCODING_TEXT_UTF8` ### invalid hash function Common causes: * This error is specific to the [sign\_raw\_payload](/api-reference/signing/sign-raw-payload) endpoint. A valid hash function needs to be passed so that Turnkey can properly hash and sign the requested message. Troubleshooting tips: * Use a valid hash function scheme from the following: `HASH_FUNCTION_NO_OP`, `HASH_FUNCTION_SHA256`, `HASH_FUNCTION_KECCAK256`, `HASH_FUNCTION_NOT_APPLICABLE` * More information about `HASH_FUNCTION_NO_OP` [here](/reference/faq#what-does-hash_function_no_op-mean) * More information about `HASH_FUNCTION_NOT_APPLICABLE` [here](/reference/faq#what-is-hash_function_not_applicable-and-how-does-it-differ-from-hash_function_no_op) ### invalid magic link template Common causes: * The email template provided for specific activities is invalid. Troubleshooting tips: * Read more about [bespoke email templates](/features/authentication/email#bespoke-email-templates) * Reach out to Turnkey at [help@turnkey.com](mailto:help@turnkey.com)! ### failed to get email template contents Common causes: * There was an error getting the email template for an associated activity Troubleshooting tips: * Reach out to Turnkey at [help@turnkey.com](mailto:help@turnkey.com)! ### failed to unmarshal template variables Common causes: * There are invalid template variables used in your email template. Troubleshooting tips: * Read more about [bespoke email templates](/features/authentication/email#bespoke-email-templates) * Reach out to Turnkey at [help@turnkey.com](mailto:help@turnkey.com)! ### authentication failed Common causes: * Turnkey was unable to authenticate the user based on the stamp provided. Troubleshooting tips: * Ensure that all proper authenticators and api-keys have been added to the organization. * Read more about how to create a stamp for a request [here](/api-reference/overview/stamps) ### failed to load organizations Common causes: * A request is targeting an unknown organization ID. Troubleshooting tips: * Ensure that the passed organization ID in the request is valid. ### policy label must be unique Common causes: * A new policy that is to be created shares the same name as a different policy. Policy names must be unique, and names in general must be unique per resource, so that they can be properly identified. Troubleshooting tips: * Change the label/name that will be used for the new policy. * Delete the old policy. * Update the old policy to have a new name. ### invalid policy consensus Common causes: * An invalid consensus expression is passed. Troubleshooting tips: * Read more about policy structure [here](/features/policies/overview#policy-structure) ### invalid policy condition Common causes: * An invalid condition expression is passed. Troubleshooting tips: * Read more about policy structure [here](/features/policies/overview#policy-structure) ### quorum threshold must be non-zero integer Common causes: * Quorum is the required amount of approvals by [root quorum members](/features/users/root-quorum) needed for an action to take place within an organization. Troubleshooting tips: * When creating a sub-organization or updating the root quroum amount, use a non-zero positive integer. ### quorum users missing Common causes: * A user marked as part of the root quorum is missing from the set of users within an organization. This is a validation error that can occur when trying to delete a user that is part of the root quorum. Troubleshooting tips: * Before deleting the user, remove them from the root quroum using [Update Root Quorum](/api-reference/organizations/update-root-quorum) ### invalid api key expiration Common causes: * An invalid expiration time was passed in for an api key's expiration time parameter when using [Create API Key](/api-reference/api-keys/create-api-keys) Troubleshooting tips: * The `expirationSeconds` parameter is passed as string of seconds of how long the key should last. Any non-positive non-integer string will be considered invalid. ### missing parameter: user authenticator attestation Common causes: * An attestation parameter is not passed when performing a request regarding an authenticator. For example [Create Authenticators](/api-reference/authenticators/create-authenticators) Troubleshooting tips: * The attestation generated by the authenticator includes a new key pair, the challenge, and device metadata that is signed, read more about attestations [here](https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API/Attestation_and_Assertion). * An example of getting the correct parameters needed to use the Create Authenticators endpoint can be found within our [react-components](https://github.com/tkhq/sdk/blob/main/examples/demos/react-components/src/app/dashboard/page.tsx#L246-L276) SDK example ### invalid authenticator attestation Common causes: * An attestation parameter is not valid when performing a request regarding an authenticator. For example [Create Authenticators](/api-reference/authenticators/create-authenticators) Troubleshooting tips: * The attestation generated by the authenticator includes a new key pair, the challenge, and device metadata that is signed, read more about attestations [here](https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API/Attestation_and_Assertion). * An example of getting the correct parameters needed to use the Create Authenticators endpoint can be found within our [react-components](https://github.com/tkhq/sdk/blob/main/examples/demos/react-components/src/app/dashboard/page.tsx#L246-L276) SDK example ### missing parameter: user authenticator attestation auth data Common causes: * The attestation auth data parameter is not valid when performing a request regarding an authenticator. For example [Create Authenticators](/api-reference/authenticators/create-authenticators). This parameter is obtained as part of the attestation object. Troubleshooting tips: * An example of getting the correct parameters needed to use the Create Authenticators endpoint can be found within our [react-components](https://github.com/tkhq/sdk/blob/main/examples/demos/react-components/src/app/dashboard/page.tsx#L246-L276) SDK example ### user has exceeded maximum authenticators Common causes: * Turnkey allows up to 10 authenticators per user. This is a hard resource limit. More information on resource limits [here](/reference/resource-limits). Troubleshooting Tips: * Delete any unnecessary authenticators attached to a user. * Create a new user within the same organization and attach the authenicator to that user. ### user has exceeded maximum long-lived api keys Common causes: * Turnkey allows up to 10 long-lived api keys per user. This is a hard resource limit. More information on resource limits [here](/reference/resource-limits). Troubleshooting Tips: * Delete any unnecessary long-lived API keys attached to a user. * Create a new user within the same organization and attach the API key to that user. ### user has exceeded maximum short-lived api keys Common causes: * Turnkey allows up to 10 short-lived api keys per user. This is a hard resource limit. More information on resource limits [here](/reference/resource-limits). Short-lived API keys will automatically be deleted from an organization when they are expired. Troubleshooting Tips: * Delete any unnecessary short-lived API keys attached to a user. * Create a new user within the same organization and attach the API key to that user. ### missing wallet params Common causes: * Some wallet/wallet account parameters have been omitted when creating a sub-organization Troubleshooting tips: * Include all of the required parameters when creating a wallet during sub-organization creation. More info on the parameters [here](/api-reference/organizations/create-sub-organization). ### invalid path format Common causes: * This error occurs when an invalid path format parameter is passed to a request like [Create Wallet Accounts](/api-reference/wallets/create-wallet-accounts). Troubleshooting tips: * For now the path format must be: `PATH_FORMAT_BIP32`. ### invalid path Common causes: * An invalid path parameter is passed to a request like [Create Wallet Accounts](/api-reference/wallets/create-wallet-accounts). Paths cannot be reused within the same HD wallet. Troubleshooting tips: * The path is a string that is used to derive a new account within an HD wallet. A list of default paths per address format can be found [here](/features/wallets#hd-wallet-default-paths) * Paths cannot be reused within the same HD wallet. ### invalid address format Common causes: * An invalid address format parameter is passed to a request like [Create Wallet Accounts](/api-reference/wallets/create-wallet-accounts). Troubleshooting tips: * Turnkey offers a wide range of support for many ecosystems. A list of valid address formats can be found in the table [here](/features/wallets#address-formats-and-curves). * More about Turnkey and general ecosystem support can be found [here](/features/networks/overview). ### invalid curve Common causes: * An invalid curve parameter is passed to a request like [Create Wallet Accounts](/api-reference/wallets/create-wallet-accounts). Troubleshooting tips: * Before ecosystem level integrations Turnkey offers support on a curve level. This makes us extendable to any ecosystem that is based on a curve we support. A list of valid curve parameters can be found in the table [here](/features/wallets#address-formats-and-curves). * More about Turnkey and general ecosystem support can be found [here](/features/networks/overview). ### curve required Common causes: * The curve parameter is not passed to a request like [Create Wallet Accounts](/api-reference/wallets/create-wallet-accounts). Troubleshooting tips: * Before ecosystem level integrations Turnkey offers support on a curve level. This makes us extendable to any ecosystem that is based on a curve we support. A list of valid curve parameters can be found in the table [here](/features/wallets#address-formats-and-curves). * More about Turnkey and general ecosystem support can be found [here](/features/networks/overview). ### failed to parse transaction Common causes: * The unsignedTransaction payload cannot be decoded by the policy engine, it might have not been serlialized properly. Troubleshooting tips: * Try to decode the payload independently and see if it returns the expected result. * We've noticed that for EIP1559 transaction types, the go-ethereum [MarshalBinary()](https://pkg.go.dev/github.com/ethereum/go-ethereum/core/types#Transaction.MarshalBinary) function will include the R, S, V values which should not be present within the serialized payload. Try to reconstruct the RLP payload manually without the R, S, V values, see the example below: ```go theme={"system"} package main import ( "encoding/hex" "fmt" "log" "math/big" "github.com/ethereum/go-ethereum/common" "github.com/ethereum/go-ethereum/core/types" "github.com/ethereum/go-ethereum/rlp" ) func main() { to := common.HexToAddress("0x...") txData := &types.DynamicFeeTx{ ChainID: big.NewInt(1), Nonce: 0, GasTipCap: big.NewInt(12344), GasFeeCap: big.NewInt(10010000000), Gas: 100000, To: &to, Value: big.NewInt(1), Data: hexDecode(""), AccessList: types.AccessList{}, // Optional } // RLP-encode only the fields included in the unsigned tx unsignedRLP := encodeUnsignedDynamicFeeTx(txData) // Prepend EIP-1559 type byte (0x02) serializedUnsigned := append([]byte{types.DynamicFeeTxType}, unsignedRLP...) fmt.Printf("Unsigned serialized tx: 0x%x\n", serializedUnsigned) } func encodeUnsignedDynamicFeeTx(tx *types.DynamicFeeTx) []byte { rlpInput := []interface{}{ tx.ChainID, tx.Nonce, tx.GasTipCap, tx.GasFeeCap, tx.Gas, tx.To, tx.Value, tx.Data, tx.AccessList, } out, err := rlp.EncodeToBytes(rlpInput) if err != nil { log.Fatalf("failed to encode RLP: %v", err) } return out } func hexDecode(input string) []byte { b, err := hex.DecodeString(input) if err != nil { log.Fatal(err) } return b } ``` ### No activity found with fingerprint. Consensus activities must target an existing activity by fingerprint Common causes: * This error occurs during the [Approve/Reject Activity](/api-reference/consensus/approve-activity) activity. The fingerprint parameter must be a fingerprint of a valid activity. Troubleshooting tips: * Confirm that a valid fingerprint of an activity that requires approval or rejection is passed as part of this activity. ### internal server error Common causes: * This error is thrown for a variety of internal server errors that are not due to user error. These activities will have an error id passed with them like: `internal server error (9fbfda54-7141-4192-ae72-8bac3512149a)` that can be used for troubleshooting. Troubleshooting tips: * Retry the activity. This could be a fluke case and the following activity could pass without failure. * If you think there is problem or if your service is degraded, please reach out to Turnkey [help@turnkey.com](mailto:help@turnkey.com) and provide the error id in the error message. ### organization mismatch Common causes: * The request is targeting one organization (e.g., a sub-organization), but the users signing/approving the request belong to a different organization (e.g., the parent organization) Troubleshooting tips: * Ensure the `organizationId` in your request matches the organization where your signing users are located ### invalid wallet account UUID Common causes: * A malformed or invalid UUID was provided for a wallet account ID Troubleshooting tips: * Verify the wallet account ID is a valid UUID in the format `XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX` ### wallet account not part of your organization Common causes: * Attempting to delete or modify a wallet account that belongs to a different organization * Using a wallet account ID from another organization Troubleshooting tips: * Verify the wallet account ID belongs to your organization * Check that you're using the correct organization ID in your request ### wallet account has not been exported Common causes: * Attempting to delete a wallet account that has not been exported * The `deleteWithoutExport` parameter is not set to `true` when trying to delete an unexported wallet account Troubleshooting tips: * Export the wallet account before deleting it using the export wallet account activity * Set `deleteWithoutExport` to `true` in your delete request if you want to delete without exporting (use with caution) ### invalid OIDC token Common causes: * The OIDC token format is invalid (not a valid JWT with 3 parts) * Required claims are missing from the OIDC token (`aud`, `sub`, or `iss`) * The token structure doesn't match the expected format Troubleshooting tips: * Verify the OIDC token is a valid JWT with three parts separated by periods (header.payload.signature) * Ensure the token includes all required claims: * `aud` (audience): The intended recipient of the token * `sub` (subject): The user identifier * `iss` (issuer): The identity provider that issued the token * Check that your OIDC provider is correctly configured to include these claims ### failed to parse user JSON: missing field `data` (X/Twitter OAuth) Common causes: * X (Twitter) legacy Free tier developer apps were not automatically migrated to the new Pay-Per-Use pricing model when X launched their new [developer console and pricing](https://devcommunity.x.com/t/announcing-the-launch-of-x-api-pay-per-use-pricing/256476) * The app is still on a legacy Free plan, which no longer has access to the `GET /2/users/me` endpoint required for Turnkey's X OAuth flow Troubleshooting tips: * Go to [console.x.com](https://console.x.com/) and manually update your app to the **Pay-Per-Use** plan * This is a one-time migration — once updated, X OAuth with Turnkey should work as expected ### invalid email address Common causes: * Email address format is invalid Troubleshooting tips: * Verify the email address follows the standard format: `user@domain.com` * Remove any extra spaces or invalid characters from the email address ### could not reach email Common causes: * The email domain cannot be reached or verified * Invalid MX (Mail Exchange) records for the email domain * The email provider's servers are unreachable or non-existent * The domain doesn't have proper DNS configuration Troubleshooting tips: * Verify the email domain is a valid, active domain * Check that the email provider's MX records are properly configured * Try using an email address from a well-known provider (Gmail, Outlook, etc.) to test * If you believe this is in error, please contact Turnkey # Introduction Source: https://docs.turnkey.com/api-reference/overview/intro Turnkey's API is a remote procedure call (RPC) API. ## RPC/HTTP We chose RPC-over-HTTP for convenience and ease-of-use. Most of our users should be able to integrate with our API without a major re-architecture of their existing systems. Many client libraries are available to make requests to a RPC/HTTP API, across many languages. Turnkey will provide SDKs for the most popular programming languages. For other languages, a RPC/HTTP API ensures there is an easy integration path available via raw http clients. ## POST-only If you look at the [API reference](/api-reference/overview/intro) you'll notice that all API calls to Turnkey are HTTP POST requests. Requests contain a POST body and a header with a digital signature over the POST body. We call this digital signature a [Stamp](/api-reference/overview/stamps). Requests must be stamped by registered user credentials and verified by Turnkey's secure enclaves before they are processed. This ensures cryptographic integrity end-to-end which eliminates the ability for any party to modify a user's request. ### Queries and submissions Turnkey's API is divided into 2 broad categories: queries and submissions. * Queries are read requests (e.g. `get_users`, `list_users`) * Submissions are requests to execute a workload (e.g. `create_policy`, `sign_transaction`, `delete_user`) ## Dive deeper * Creating your first [Stamp](/api-reference/overview/stamps) * Fetching data with [Queries](/api-reference/queries/overview) * Executing workloads with [Submissions](/api-reference/activities/overview) # Stamps Source: https://docs.turnkey.com/api-reference/overview/stamps Every request made to Turnkey must include a signature over the POST body attached as a HTTP header. Our secure enclave applications use this signature to verify the integrity and authenticity of the request. ### API keys To create a valid, API key stamped request follow these steps: Sign the JSON-encoded POST body with your API key to produce a `signature` (DER-encoded) Hex encode the `signature` Create a JSON-encoded stamp: * `publicKey`: the public key of the API key. Turnkey supports multiple API key curves: `API_KEY_CURVE_P256, API_KEY_CURVE_SECP256K1, API_KEY_CURVE_ED25519` * `signature`: the signature produced by the API key * `scheme`: the signature scheme used to sign the request, matching the curve of the `publicKey`. The supported schemes are: `SIGNATURE_SCHEME_TK_API_P256, SIGNATURE_SCHEME_TK_API_SECP256K1, SIGNATURE_SCHEME_TK_API_ED25519, SIGNATURE_SCHEME_TK_API_SECP256K1_EIP191` Base64URL encode the stamp Attach the encoded string to your request as a `X-Stamp` header Submit the stamped request to Turnkey's API ### WebAuthn To create a valid, WebAuthn authenticator stamped request follow these steps: Compute the WebAuthn challenge by hashing the POST body bytes (JSON encoded) with SHA256. For example, if the POST body is `{"organization_id": "1234", "type": "ACTIVITY_TYPE_CREATE_API_KEYS", "params": {"for": "example"}}`, the WebAuthn challenge is the string `7e8b4653fc7e51dc119cea031942f4693b4742ceca4dda269b925802b38b2147` Include the challenge amongst WebAuthn signing options. Refer to the existing stamper implementations in the [following section](#stampers) for examples * Note that if you need to pass the challenge as bytes, you'll need to utf8-encode the challenge string (in JS, the challenge bytes will be `TextEncoder().encode("7e8b4653fc7e51dc119cea031942f4693b4742ceca4dda269b925802b38b2147")`) * Additional note for React Native contexts: the resulting string should then additionally be base64-encoded. See [implementation](https://github.com/tkhq/sdk/blob/b52db566e79a65eec8d8e7066053d6a3ac5f3943/packages/react-native-passkey-stamper/src/util.ts#L5-L10) Create a JSON-encoded stamp: * `credentialId`: the id of the WebAuthn authenticator * `authenticatorData`: the authenticator data produced by the WebAuthn assertion * `clientDataJson`: the client data produced by the WebAuthn assertion * `signature`: the signature produced by the WebAuthn assertion Attach the JSON-encoded stamp to your request as a `X-Stamp-Webauthn` header * Header names are case-insensitive (so `X-Stamp-Webauthn` and `X-Stamp-WebAuthn` are considered equivalent) * Unlike API key stamps, the format is just JSON; no base64URL encoding necessary! For example: `X-Stamp-Webauthn: {"authenticatorData":"UaQZ...","clientDataJson":"eyJ0...","credentialId":"Grf...","signature":"MEQ..."}` Submit the stamped request to Turnkey's API. If you would like your client request to be proxied through a backend, refer to the patterns mentioned [here](/features/authentication/passkeys/integration#proxying-signed-requests). An example application that uses this pattern can be found at wallet.tx.xyz (code [here](https://github.com/tkhq/demo-embedded-wallet/)) ### Stampers Our [JS SDK](https://github.com/tkhq/sdk) and [CLI](https://github.com/tkhq/tkcli) abstract request stamping for you. If you choose to use an independent client, you will need to implement this yourself. For reference, check out our implementations: Our CLI has a `--no-post` option to generate stamps without sending anything over the network. This is a useful tool should you have trouble with debugging stamping-related logic. A sample command might look something like: ```json theme={"system"} turnkey request --no-post --host api.turnkey.com --path /api/v1/sign --body '{"payload": "hello from TKHQ"}' { "curlCommand": "curl -X POST -d'{\"payload\": \"hello from TKHQ\"}' -H'X-Stamp: eyJwdWJsaWNLZXkiOiIwMzI3YTUwMDMyZTZmMDYzMWQ1NjA1YjZhZGEzMmI3NzkwNzRmMzQ2ZTgxYjY4ZTEyODAxNjQwZjFjOWVlMDNkYWUiLCJzaWduYXR1cmUiOiIzMDQ0MDIyMDM2MjNkZWZkNjE4ZWIzZTIxOTk3MDQ5NjQwN2ViZTkyNDQ3MzE3ZGFkNzVlNDEyYmQ0YTYyNjdjM2I1ZTIyMjMwMjIwMjQ1Yjc0MDg0OGE3MmQwOGI2MGQ2Yzg0ZjMzOTczN2I2M2RiM2JjYmFkYjNiZDBkY2IxYmZiODY1NzE1ZDhiNSIsInNjaGVtZSI6IlNJR05BVFVSRV9TQ0hFTUVfVEtfQVBJX1AyNTYifQ' -v 'https://api.turnkey.com/api/v1/sign'", "message": "{\"payload\": \"hello from TKHQ\"}", "stamp": "eyJwdWJsaWNLZXkiOiIwMzI3YTUwMDMyZTZmMDYzMWQ1NjA1YjZhZGEzMmI3NzkwNzRmMzQ2ZTgxYjY4ZTEyODAxNjQwZjFjOWVlMDNkYWUiLCJzaWduYXR1cmUiOiIzMDQ0MDIyMDM2MjNkZWZkNjE4ZWIzZTIxOTk3MDQ5NjQwN2ViZTkyNDQ3MzE3ZGFkNzVlNDEyYmQ0YTYyNjdjM2I1ZTIyMjMwMjIwMjQ1Yjc0MDg0OGE3MmQwOGI2MGQ2Yzg0ZjMzOTczN2I2M2RiM2JjYmFkYjNiZDBkY2IxYmZiODY1NzE1ZDhiNSIsInNjaGVtZSI6IlNJR05BVFVSRV9TQ0hFTUVfVEtfQVBJX1AyNTYifQ" } ``` # Get a specific boot proof Source: https://docs.turnkey.com/api-reference/queries/get-a-specific-boot-proof Get the boot proof for a given ephemeral key. Unique identifier for a given Organization. Hex encoded ephemeral public key. A successful response returns the following fields: bootProof field The hex encoded Ephemeral Public Key. The DER encoded COSE Sign1 struct Attestation doc. The base64 encoded QOS manifest. Encoding depends on qos\_manifest\_version. The base64 encoded QOS manifest envelope. Encoding depends on qos\_manifest\_version. The label under which the enclave app was deployed. Name of the enclave app Owner of the app i.e. 'tkhq' createdAt field seconds field nanos field QOS manifest schema version. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/get_boot_proof \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "", "ephemeralKey": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getBootProof({ organizationId: " (Unique identifier for a given Organization.)", ephemeralKey: " (Hex encoded ephemeral public key.)" }); ``` ```json 200 theme={"system"} { "bootProof": { "ephemeralPublicKeyHex": "", "awsAttestationDocB64": "", "qosManifestB64": "", "qosManifestEnvelopeB64": "", "deploymentLabel": "", "enclaveApp": "", "owner": "", "createdAt": { "seconds": "", "nanos": "" }, "qosManifestVersion": "" } } ``` # Get activity Source: https://docs.turnkey.com/api-reference/queries/get-activity Get details about an activity. Unique identifier for a given organization. Unique identifier for a given activity object. A successful response returns the following fields: activity field Unique identifier for a given Activity object. Unique identifier for a given Organization. status field Enum options: `ACTIVITY_STATUS_CREATED`, `ACTIVITY_STATUS_PENDING`, `ACTIVITY_STATUS_COMPLETED`, `ACTIVITY_STATUS_FAILED`, `ACTIVITY_STATUS_CONSENSUS_NEEDED`, `ACTIVITY_STATUS_REJECTED`, `ACTIVITY_STATUS_AUTHENTICATORS_NEEDED` type field Enum options: `ACTIVITY_TYPE_CREATE_API_KEYS`, `ACTIVITY_TYPE_CREATE_USERS`, `ACTIVITY_TYPE_CREATE_PRIVATE_KEYS`, `ACTIVITY_TYPE_SIGN_RAW_PAYLOAD`, `ACTIVITY_TYPE_CREATE_INVITATIONS`, `ACTIVITY_TYPE_ACCEPT_INVITATION`, `ACTIVITY_TYPE_CREATE_POLICY`, `ACTIVITY_TYPE_DISABLE_PRIVATE_KEY`, `ACTIVITY_TYPE_DELETE_USERS`, `ACTIVITY_TYPE_DELETE_API_KEYS`, `ACTIVITY_TYPE_DELETE_INVITATION`, `ACTIVITY_TYPE_DELETE_ORGANIZATION`, `ACTIVITY_TYPE_DELETE_POLICY`, `ACTIVITY_TYPE_CREATE_USER_TAG`, `ACTIVITY_TYPE_DELETE_USER_TAGS`, `ACTIVITY_TYPE_CREATE_ORGANIZATION`, `ACTIVITY_TYPE_SIGN_TRANSACTION`, `ACTIVITY_TYPE_APPROVE_ACTIVITY`, `ACTIVITY_TYPE_REJECT_ACTIVITY`, `ACTIVITY_TYPE_DELETE_AUTHENTICATORS`, `ACTIVITY_TYPE_CREATE_AUTHENTICATORS`, `ACTIVITY_TYPE_CREATE_PRIVATE_KEY_TAG`, `ACTIVITY_TYPE_DELETE_PRIVATE_KEY_TAGS`, `ACTIVITY_TYPE_SET_PAYMENT_METHOD`, `ACTIVITY_TYPE_ACTIVATE_BILLING_TIER`, `ACTIVITY_TYPE_DELETE_PAYMENT_METHOD`, `ACTIVITY_TYPE_CREATE_POLICY_V2`, `ACTIVITY_TYPE_CREATE_POLICY_V3`, `ACTIVITY_TYPE_CREATE_API_ONLY_USERS`, `ACTIVITY_TYPE_UPDATE_ROOT_QUORUM`, `ACTIVITY_TYPE_UPDATE_USER_TAG`, `ACTIVITY_TYPE_UPDATE_PRIVATE_KEY_TAG`, `ACTIVITY_TYPE_CREATE_AUTHENTICATORS_V2`, `ACTIVITY_TYPE_CREATE_ORGANIZATION_V2`, `ACTIVITY_TYPE_CREATE_USERS_V2`, `ACTIVITY_TYPE_ACCEPT_INVITATION_V2`, `ACTIVITY_TYPE_CREATE_SUB_ORGANIZATION`, `ACTIVITY_TYPE_CREATE_SUB_ORGANIZATION_V2`, `ACTIVITY_TYPE_UPDATE_ALLOWED_ORIGINS`, `ACTIVITY_TYPE_CREATE_PRIVATE_KEYS_V2`, `ACTIVITY_TYPE_UPDATE_USER`, `ACTIVITY_TYPE_UPDATE_POLICY`, `ACTIVITY_TYPE_SET_PAYMENT_METHOD_V2`, `ACTIVITY_TYPE_CREATE_SUB_ORGANIZATION_V3`, `ACTIVITY_TYPE_CREATE_WALLET`, `ACTIVITY_TYPE_CREATE_WALLET_ACCOUNTS`, `ACTIVITY_TYPE_INIT_USER_EMAIL_RECOVERY`, `ACTIVITY_TYPE_RECOVER_USER`, `ACTIVITY_TYPE_SET_ORGANIZATION_FEATURE`, `ACTIVITY_TYPE_REMOVE_ORGANIZATION_FEATURE`, `ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2`, `ACTIVITY_TYPE_SIGN_TRANSACTION_V2`, `ACTIVITY_TYPE_EXPORT_PRIVATE_KEY`, `ACTIVITY_TYPE_EXPORT_WALLET`, `ACTIVITY_TYPE_CREATE_SUB_ORGANIZATION_V4`, `ACTIVITY_TYPE_EMAIL_AUTH`, `ACTIVITY_TYPE_EXPORT_WALLET_ACCOUNT`, `ACTIVITY_TYPE_INIT_IMPORT_WALLET`, `ACTIVITY_TYPE_IMPORT_WALLET`, `ACTIVITY_TYPE_INIT_IMPORT_PRIVATE_KEY`, `ACTIVITY_TYPE_IMPORT_PRIVATE_KEY`, `ACTIVITY_TYPE_CREATE_POLICIES`, `ACTIVITY_TYPE_SIGN_RAW_PAYLOADS`, `ACTIVITY_TYPE_CREATE_READ_ONLY_SESSION`, `ACTIVITY_TYPE_CREATE_OAUTH_PROVIDERS`, `ACTIVITY_TYPE_DELETE_OAUTH_PROVIDERS`, `ACTIVITY_TYPE_CREATE_SUB_ORGANIZATION_V5`, `ACTIVITY_TYPE_OAUTH`, `ACTIVITY_TYPE_CREATE_API_KEYS_V2`, `ACTIVITY_TYPE_CREATE_READ_WRITE_SESSION`, `ACTIVITY_TYPE_EMAIL_AUTH_V2`, `ACTIVITY_TYPE_CREATE_SUB_ORGANIZATION_V6`, `ACTIVITY_TYPE_DELETE_PRIVATE_KEYS`, `ACTIVITY_TYPE_DELETE_WALLETS`, `ACTIVITY_TYPE_CREATE_READ_WRITE_SESSION_V2`, `ACTIVITY_TYPE_DELETE_SUB_ORGANIZATION`, `ACTIVITY_TYPE_INIT_OTP_AUTH`, `ACTIVITY_TYPE_OTP_AUTH`, `ACTIVITY_TYPE_CREATE_SUB_ORGANIZATION_V7`, `ACTIVITY_TYPE_UPDATE_WALLET`, `ACTIVITY_TYPE_UPDATE_POLICY_V2`, `ACTIVITY_TYPE_CREATE_USERS_V3`, `ACTIVITY_TYPE_INIT_OTP_AUTH_V2`, `ACTIVITY_TYPE_INIT_OTP`, `ACTIVITY_TYPE_VERIFY_OTP`, `ACTIVITY_TYPE_OTP_LOGIN`, `ACTIVITY_TYPE_STAMP_LOGIN`, `ACTIVITY_TYPE_OAUTH_LOGIN`, `ACTIVITY_TYPE_UPDATE_USER_NAME`, `ACTIVITY_TYPE_UPDATE_USER_EMAIL`, `ACTIVITY_TYPE_UPDATE_USER_PHONE_NUMBER`, `ACTIVITY_TYPE_INIT_FIAT_ON_RAMP`, `ACTIVITY_TYPE_CREATE_SMART_CONTRACT_INTERFACE`, `ACTIVITY_TYPE_DELETE_SMART_CONTRACT_INTERFACE`, `ACTIVITY_TYPE_ENABLE_AUTH_PROXY`, `ACTIVITY_TYPE_DISABLE_AUTH_PROXY`, `ACTIVITY_TYPE_UPDATE_AUTH_PROXY_CONFIG`, `ACTIVITY_TYPE_CREATE_OAUTH2_CREDENTIAL`, `ACTIVITY_TYPE_UPDATE_OAUTH2_CREDENTIAL`, `ACTIVITY_TYPE_DELETE_OAUTH2_CREDENTIAL`, `ACTIVITY_TYPE_OAUTH2_AUTHENTICATE`, `ACTIVITY_TYPE_DELETE_WALLET_ACCOUNTS`, `ACTIVITY_TYPE_DELETE_POLICIES`, `ACTIVITY_TYPE_ETH_SEND_RAW_TRANSACTION`, `ACTIVITY_TYPE_ETH_SEND_TRANSACTION`, `ACTIVITY_TYPE_CREATE_FIAT_ON_RAMP_CREDENTIAL`, `ACTIVITY_TYPE_UPDATE_FIAT_ON_RAMP_CREDENTIAL`, `ACTIVITY_TYPE_DELETE_FIAT_ON_RAMP_CREDENTIAL`, `ACTIVITY_TYPE_EMAIL_AUTH_V3`, `ACTIVITY_TYPE_INIT_USER_EMAIL_RECOVERY_V2`, `ACTIVITY_TYPE_INIT_OTP_AUTH_V3`, `ACTIVITY_TYPE_INIT_OTP_V2`, `ACTIVITY_TYPE_UPSERT_GAS_USAGE_CONFIG`, `ACTIVITY_TYPE_CREATE_TVC_APP`, `ACTIVITY_TYPE_CREATE_TVC_DEPLOYMENT`, `ACTIVITY_TYPE_CREATE_TVC_MANIFEST_APPROVALS`, `ACTIVITY_TYPE_SOL_SEND_TRANSACTION`, `ACTIVITY_TYPE_INIT_OTP_V3`, `ACTIVITY_TYPE_VERIFY_OTP_V2`, `ACTIVITY_TYPE_OTP_LOGIN_V2`, `ACTIVITY_TYPE_UPDATE_ORGANIZATION_NAME`, `ACTIVITY_TYPE_CREATE_SUB_ORGANIZATION_V8`, `ACTIVITY_TYPE_CREATE_OAUTH_PROVIDERS_V2`, `ACTIVITY_TYPE_CREATE_USERS_V4`, `ACTIVITY_TYPE_CREATE_WEBHOOK_ENDPOINT`, `ACTIVITY_TYPE_UPDATE_WEBHOOK_ENDPOINT`, `ACTIVITY_TYPE_DELETE_WEBHOOK_ENDPOINT`, `ACTIVITY_TYPE_SET_IP_ALLOWLIST`, `ACTIVITY_TYPE_REMOVE_IP_ALLOWLIST`, `ACTIVITY_TYPE_UPDATE_TVC_APP_LIVE_DEPLOYMENT`, `ACTIVITY_TYPE_DELETE_TVC_DEPLOYMENT`, `ACTIVITY_TYPE_DELETE_TVC_APP_AND_DEPLOYMENTS`, `ACTIVITY_TYPE_RESTORE_TVC_DEPLOYMENT`, `ACTIVITY_TYPE_SPARK_SIGN_FROST`, `ACTIVITY_TYPE_SPARK_PREPARE_TRANSFER`, `ACTIVITY_TYPE_SPARK_CLAIM_TRANSFER`, `ACTIVITY_TYPE_SPARK_PREPARE_LIGHTNING_RECEIVE`, `ACTIVITY_TYPE_POST_TVC_QUORUM_KEY_SHARE`, `ACTIVITY_TYPE_ETH_SEND_TRANSACTION_V2`, `ACTIVITY_TYPE_CREATE_MFA_POLICY`, `ACTIVITY_TYPE_UPDATE_MFA_POLICY`, `ACTIVITY_TYPE_DELETE_MFA_POLICY`, `ACTIVITY_TYPE_CREATE_SESSION_PROFILE` intent field createOrganizationIntent field Human-readable name for an Organization. The root user's email address. rootAuthenticator field Human-readable name for an Authenticator. Unique identifier for a given User. attestation field id field type field Enum options: `public-key` rawId field authenticatorAttachment field Enum options: `cross-platform`, `platform` response field clientDataJson field attestationObject field transports field item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` authenticatorAttachment field Enum options: `cross-platform`, `platform` clientExtensionResults field appid field appidExclude field credProps field rk field Challenge presented for authentication purposes. Unique identifier for the root user object. createAuthenticatorsIntent field A list of Authenticators. Human-readable name for an Authenticator. Unique identifier for a given User. attestation field id field type field Enum options: `public-key` rawId field authenticatorAttachment field Enum options: `cross-platform`, `platform` response field clientDataJson field attestationObject field transports field item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` authenticatorAttachment field Enum options: `cross-platform`, `platform` clientExtensionResults field appid field appidExclude field credProps field rk field Challenge presented for authentication purposes. Unique identifier for a given User. createUsersIntent field A list of Users. Human-readable name for a User. The user's email address. accessType field Enum options: `ACCESS_TYPE_WEB`, `ACCESS_TYPE_API`, `ACCESS_TYPE_ALL` A list of API Key parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an API Key. The public component of a cryptographic key pair used to sign messages and transactions. Optional window (in seconds) indicating how long the API Key should last. A list of Authenticator parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an Authenticator. Unique identifier for a given User. attestation field id field type field Enum options: `public-key` rawId field authenticatorAttachment field Enum options: `cross-platform`, `platform` response field clientDataJson field attestationObject field transports field item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` authenticatorAttachment field Enum options: `cross-platform`, `platform` clientExtensionResults field appid field appidExclude field credProps field rk field Challenge presented for authentication purposes. A list of User Tag IDs. This field, if not needed, should be an empty array in your request body. item field createPrivateKeysIntent field A list of Private Keys. Human-readable name for a Private Key. curve field Enum options: `CURVE_SECP256K1`, `CURVE_ED25519`, `CURVE_P256` A list of Private Key Tag IDs. This field, if not needed, should be an empty array in your request body. item field Cryptocurrency-specific formats for a derived address (e.g., Ethereum). item field Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` signRawPayloadIntent field Unique identifier for a given Private Key. Raw unsigned payload to be signed. encoding field Enum options: `PAYLOAD_ENCODING_HEXADECIMAL`, `PAYLOAD_ENCODING_TEXT_UTF8`, `PAYLOAD_ENCODING_EIP712`, `PAYLOAD_ENCODING_EIP7702_AUTHORIZATION` hashFunction field Enum options: `HASH_FUNCTION_NO_OP`, `HASH_FUNCTION_SHA256`, `HASH_FUNCTION_KECCAK256`, `HASH_FUNCTION_NOT_APPLICABLE` createInvitationsIntent field A list of Invitations. The name of the intended Invitation recipient. The email address of the intended Invitation recipient. A list of tags assigned to the Invitation recipient. This field, if not needed, should be an empty array in your request body. item field accessType field Enum options: `ACCESS_TYPE_WEB`, `ACCESS_TYPE_API`, `ACCESS_TYPE_ALL` Unique identifier for the Sender of an Invitation. acceptInvitationIntent field Unique identifier for a given Invitation object. Unique identifier for a given User. authenticator field Human-readable name for an Authenticator. Unique identifier for a given User. attestation field id field type field Enum options: `public-key` rawId field authenticatorAttachment field Enum options: `cross-platform`, `platform` response field clientDataJson field attestationObject field transports field item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` authenticatorAttachment field Enum options: `cross-platform`, `platform` clientExtensionResults field appid field appidExclude field credProps field rk field Challenge presented for authentication purposes. createPolicyIntent field Human-readable name for a Policy. A list of simple functions each including a subject, target and boolean. See Policy Engine Language section for additional details. subject field operator field Enum options: `OPERATOR_EQUAL`, `OPERATOR_MORE_THAN`, `OPERATOR_MORE_THAN_OR_EQUAL`, `OPERATOR_LESS_THAN`, `OPERATOR_LESS_THAN_OR_EQUAL`, `OPERATOR_CONTAINS`, `OPERATOR_NOT_EQUAL`, `OPERATOR_IN`, `OPERATOR_NOT_IN`, `OPERATOR_CONTAINS_ONE`, `OPERATOR_CONTAINS_ALL` target field effect field Enum options: `EFFECT_ALLOW`, `EFFECT_DENY` notes field disablePrivateKeyIntent field Unique identifier for a given Private Key. deleteUsersIntent field A list of User IDs. item field deleteAuthenticatorsIntent field Unique identifier for a given User. A list of Authenticator IDs. item field deleteInvitationIntent field Unique identifier for a given Invitation object. deleteOrganizationIntent field Unique identifier for a given Organization. deletePolicyIntent field Unique identifier for a given Policy. createUserTagIntent field Human-readable name for a User Tag. A list of User IDs. item field deleteUserTagsIntent field A list of User Tag IDs. item field signTransactionIntent field Unique identifier for a given Private Key. Raw unsigned transaction to be signed by a particular Private Key. type field Enum options: `TRANSACTION_TYPE_ETHEREUM`, `TRANSACTION_TYPE_SOLANA`, `TRANSACTION_TYPE_TRON`, `TRANSACTION_TYPE_BITCOIN`, `TRANSACTION_TYPE_TEMPO` createApiKeysIntent field A list of API Keys. Human-readable name for an API Key. The public component of a cryptographic key pair used to sign messages and transactions. Optional window (in seconds) indicating how long the API Key should last. Unique identifier for a given User. deleteApiKeysIntent field Unique identifier for a given User. A list of API Key IDs. item field approveActivityIntent field An artifact verifying a User's action. rejectActivityIntent field An artifact verifying a User's action. createPrivateKeyTagIntent field Human-readable name for a Private Key Tag. A list of Private Key IDs. item field deletePrivateKeyTagsIntent field A list of Private Key Tag IDs. item field createPolicyIntentV2 field Human-readable name for a Policy. A list of simple functions each including a subject, target and boolean. See Policy Engine Language section for additional details. subject field operator field Enum options: `OPERATOR_EQUAL`, `OPERATOR_MORE_THAN`, `OPERATOR_MORE_THAN_OR_EQUAL`, `OPERATOR_LESS_THAN`, `OPERATOR_LESS_THAN_OR_EQUAL`, `OPERATOR_CONTAINS`, `OPERATOR_NOT_EQUAL`, `OPERATOR_IN`, `OPERATOR_NOT_IN`, `OPERATOR_CONTAINS_ONE`, `OPERATOR_CONTAINS_ALL` targets field item field effect field Enum options: `EFFECT_ALLOW`, `EFFECT_DENY` notes field setPaymentMethodIntent field The account number of the customer's credit card. The verification digits of the customer's credit card. The month that the credit card expires. The year that the credit card expires. The email that will receive invoices for the credit card. The name associated with the credit card. activateBillingTierIntent field The product that the customer wants to subscribe to. orbPlanId field deletePaymentMethodIntent field The payment method that the customer wants to remove. createPolicyIntentV3 field Human-readable name for a Policy. effect field Enum options: `EFFECT_ALLOW`, `EFFECT_DENY` The condition expression that triggers the Effect The consensus expression that triggers the Effect Notes for a Policy. createApiOnlyUsersIntent field A list of API-only Users to create. The name of the new API-only User. The email address for this API-only User (optional). A list of tags assigned to the new API-only User. This field, if not needed, should be an empty array in your request body. item field A list of API Key parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an API Key. The public component of a cryptographic key pair used to sign messages and transactions. Optional window (in seconds) indicating how long the API Key should last. updateRootQuorumIntent field The threshold of unique approvals to reach quorum. The unique identifiers of users who comprise the quorum set. item field updateUserTagIntent field Unique identifier for a given User Tag. The new, human-readable name for the tag with the given ID. A list of User IDs to add this tag to. item field A list of User IDs to remove this tag from. item field updatePrivateKeyTagIntent field Unique identifier for a given Private Key Tag. The new, human-readable name for the tag with the given ID. A list of Private Keys IDs to add this tag to. item field A list of Private Key IDs to remove this tag from. item field createAuthenticatorsIntentV2 field A list of Authenticators. Human-readable name for an Authenticator. Challenge presented for authentication purposes. attestation field The cbor encoded then base64 url encoded id of the credential. A base64 url encoded payload containing metadata about the signing context and the challenge. A base64 url encoded payload containing authenticator data and any attestation the webauthn provider chooses. The type of authenticator transports. item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` Unique identifier for a given User. acceptInvitationIntentV2 field Unique identifier for a given Invitation object. Unique identifier for a given User. authenticator field Human-readable name for an Authenticator. Challenge presented for authentication purposes. attestation field The cbor encoded then base64 url encoded id of the credential. A base64 url encoded payload containing metadata about the signing context and the challenge. A base64 url encoded payload containing authenticator data and any attestation the webauthn provider chooses. The type of authenticator transports. item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` createOrganizationIntentV2 field Human-readable name for an Organization. The root user's email address. rootAuthenticator field Human-readable name for an Authenticator. Challenge presented for authentication purposes. attestation field The cbor encoded then base64 url encoded id of the credential. A base64 url encoded payload containing metadata about the signing context and the challenge. A base64 url encoded payload containing authenticator data and any attestation the webauthn provider chooses. The type of authenticator transports. item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` Unique identifier for the root user object. createUsersIntentV2 field A list of Users. Human-readable name for a User. The user's email address. A list of API Key parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an API Key. The public component of a cryptographic key pair used to sign messages and transactions. Optional window (in seconds) indicating how long the API Key should last. A list of Authenticator parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an Authenticator. Challenge presented for authentication purposes. attestation field The cbor encoded then base64 url encoded id of the credential. A base64 url encoded payload containing metadata about the signing context and the challenge. A base64 url encoded payload containing authenticator data and any attestation the webauthn provider chooses. The type of authenticator transports. item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` A list of User Tag IDs. This field, if not needed, should be an empty array in your request body. item field createSubOrganizationIntent field Name for this sub-organization rootAuthenticator field Human-readable name for an Authenticator. Challenge presented for authentication purposes. attestation field The cbor encoded then base64 url encoded id of the credential. A base64 url encoded payload containing metadata about the signing context and the challenge. A base64 url encoded payload containing authenticator data and any attestation the webauthn provider chooses. The type of authenticator transports. item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` createSubOrganizationIntentV2 field Name for this sub-organization Root users to create within this sub-organization Human-readable name for a User. The user's email address. A list of API Key parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an API Key. The public component of a cryptographic key pair used to sign messages and transactions. Optional window (in seconds) indicating how long the API Key should last. A list of Authenticator parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an Authenticator. Challenge presented for authentication purposes. attestation field The cbor encoded then base64 url encoded id of the credential. A base64 url encoded payload containing metadata about the signing context and the challenge. A base64 url encoded payload containing authenticator data and any attestation the webauthn provider chooses. The type of authenticator transports. item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` The threshold of unique approvals to reach root quorum. This value must be less than or equal to the number of root users updateAllowedOriginsIntent field Additional origins requests are allowed from besides Turnkey origins item field createPrivateKeysIntentV2 field A list of Private Keys. Human-readable name for a Private Key. curve field Enum options: `CURVE_SECP256K1`, `CURVE_ED25519`, `CURVE_P256` A list of Private Key Tag IDs. This field, if not needed, should be an empty array in your request body. item field Cryptocurrency-specific formats for a derived address (e.g., Ethereum). item field Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` updateUserIntent field Unique identifier for a given User. Human-readable name for a User. The user's email address. An updated list of User Tags to apply to this User. This field, if not needed, should be an empty array in your request body. item field The user's phone number in E.164 format e.g. +13214567890 updatePolicyIntent field Unique identifier for a given Policy. Human-readable name for a Policy. policyEffect field Enum options: `EFFECT_ALLOW`, `EFFECT_DENY` The condition expression that triggers the Effect (optional). The consensus expression that triggers the Effect (optional). Accompanying notes for a Policy (optional). setPaymentMethodIntentV2 field The id of the payment method that was created clientside. The email that will receive invoices for the credit card. The name associated with the credit card. createSubOrganizationIntentV3 field Name for this sub-organization Root users to create within this sub-organization Human-readable name for a User. The user's email address. A list of API Key parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an API Key. The public component of a cryptographic key pair used to sign messages and transactions. Optional window (in seconds) indicating how long the API Key should last. A list of Authenticator parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an Authenticator. Challenge presented for authentication purposes. attestation field The cbor encoded then base64 url encoded id of the credential. A base64 url encoded payload containing metadata about the signing context and the challenge. A base64 url encoded payload containing authenticator data and any attestation the webauthn provider chooses. The type of authenticator transports. item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` The threshold of unique approvals to reach root quorum. This value must be less than or equal to the number of root users A list of Private Keys. Human-readable name for a Private Key. curve field Enum options: `CURVE_SECP256K1`, `CURVE_ED25519`, `CURVE_P256` A list of Private Key Tag IDs. This field, if not needed, should be an empty array in your request body. item field Cryptocurrency-specific formats for a derived address (e.g., Ethereum). item field Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` createWalletIntent field Human-readable name for a Wallet. A list of wallet Accounts. This field, if not needed, should be an empty array in your request body. curve field Enum options: `CURVE_SECP256K1`, `CURVE_ED25519`, `CURVE_P256` pathFormat field Enum options: `PATH_FORMAT_BIP32` Path used to generate a wallet Account. addressFormat field Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` Optional human-readable name for the account. Length of mnemonic to generate the Wallet seed. Defaults to 12. Accepted values: 12, 15, 18, 21, 24. createWalletAccountsIntent field Unique identifier for a given Wallet. A list of wallet Accounts. curve field Enum options: `CURVE_SECP256K1`, `CURVE_ED25519`, `CURVE_P256` pathFormat field Enum options: `PATH_FORMAT_BIP32` Path used to generate a wallet Account. addressFormat field Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` Optional human-readable name for the account. Indicates if the wallet accounts should be persisted. This is helpful if you'd like to see the addresses of different derivation paths without actually creating the accounts. Defaults to true. initUserEmailRecoveryIntent field Email of the user starting recovery Client-side public key generated by the user, to which the recovery bundle will be encrypted. Expiration window (in seconds) indicating how long the recovery credential is valid for. If not provided, a default of 15 minutes will be used. emailCustomization field The name of the application. A URL pointing to a logo in PNG format. Note this logo will be resized to fit into 340px x 124px. A template for the URL to be used in a magic link button, e.g. `https://dapp.xyz/%s`. The auth bundle will be interpolated into the `%s`. JSON object containing key/value pairs to be used with custom templates. Unique identifier for a given Email Template. If not specified, the default is the most recent Email Template. Optional custom email address from which to send the OTP email Optional custom sender name for use with sendFromEmailAddress; if left empty, will default to 'Notifications' Optional custom email address to use as reply-to recoverUserIntent field authenticator field Human-readable name for an Authenticator. Challenge presented for authentication purposes. attestation field The cbor encoded then base64 url encoded id of the credential. A base64 url encoded payload containing metadata about the signing context and the challenge. A base64 url encoded payload containing authenticator data and any attestation the webauthn provider chooses. The type of authenticator transports. item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` Unique identifier for the user performing recovery. setOrganizationFeatureIntent field name field Enum options: `FEATURE_NAME_ROOT_USER_EMAIL_RECOVERY`, `FEATURE_NAME_WEBAUTHN_ORIGINS`, `FEATURE_NAME_EMAIL_AUTH`, `FEATURE_NAME_EMAIL_RECOVERY`, `FEATURE_NAME_WEBHOOK`, `FEATURE_NAME_SMS_AUTH`, `FEATURE_NAME_OTP_EMAIL_AUTH`, `FEATURE_NAME_AUTH_PROXY`, `FEATURE_NAME_SOLANA_RENT_PREFUND_ENABLED` Optional value for the feature. Will override existing values if feature is already set. removeOrganizationFeatureIntent field name field Enum options: `FEATURE_NAME_ROOT_USER_EMAIL_RECOVERY`, `FEATURE_NAME_WEBAUTHN_ORIGINS`, `FEATURE_NAME_EMAIL_AUTH`, `FEATURE_NAME_EMAIL_RECOVERY`, `FEATURE_NAME_WEBHOOK`, `FEATURE_NAME_SMS_AUTH`, `FEATURE_NAME_OTP_EMAIL_AUTH`, `FEATURE_NAME_AUTH_PROXY`, `FEATURE_NAME_SOLANA_RENT_PREFUND_ENABLED` signRawPayloadIntentV2 field A Wallet account address, Private Key address, or Private Key identifier. Raw unsigned payload to be signed. encoding field Enum options: `PAYLOAD_ENCODING_HEXADECIMAL`, `PAYLOAD_ENCODING_TEXT_UTF8`, `PAYLOAD_ENCODING_EIP712`, `PAYLOAD_ENCODING_EIP7702_AUTHORIZATION` hashFunction field Enum options: `HASH_FUNCTION_NO_OP`, `HASH_FUNCTION_SHA256`, `HASH_FUNCTION_KECCAK256`, `HASH_FUNCTION_NOT_APPLICABLE` signTransactionIntentV2 field A Wallet account address, Private Key address, or Private Key identifier. Raw unsigned transaction to be signed type field Enum options: `TRANSACTION_TYPE_ETHEREUM`, `TRANSACTION_TYPE_SOLANA`, `TRANSACTION_TYPE_TRON`, `TRANSACTION_TYPE_BITCOIN`, `TRANSACTION_TYPE_TEMPO` exportPrivateKeyIntent field Unique identifier for a given Private Key. Client-side public key generated by the user, to which the export bundle will be encrypted. exportWalletIntent field Unique identifier for a given Wallet. Client-side public key generated by the user, to which the export bundle will be encrypted. language field Enum options: `MNEMONIC_LANGUAGE_ENGLISH`, `MNEMONIC_LANGUAGE_SIMPLIFIED_CHINESE`, `MNEMONIC_LANGUAGE_TRADITIONAL_CHINESE`, `MNEMONIC_LANGUAGE_CZECH`, `MNEMONIC_LANGUAGE_FRENCH`, `MNEMONIC_LANGUAGE_ITALIAN`, `MNEMONIC_LANGUAGE_JAPANESE`, `MNEMONIC_LANGUAGE_KOREAN`, `MNEMONIC_LANGUAGE_SPANISH` createSubOrganizationIntentV4 field Name for this sub-organization Root users to create within this sub-organization Human-readable name for a User. The user's email address. A list of API Key parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an API Key. The public component of a cryptographic key pair used to sign messages and transactions. Optional window (in seconds) indicating how long the API Key should last. A list of Authenticator parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an Authenticator. Challenge presented for authentication purposes. attestation field The cbor encoded then base64 url encoded id of the credential. A base64 url encoded payload containing metadata about the signing context and the challenge. A base64 url encoded payload containing authenticator data and any attestation the webauthn provider chooses. The type of authenticator transports. item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` The threshold of unique approvals to reach root quorum. This value must be less than or equal to the number of root users wallet field Human-readable name for a Wallet. A list of wallet Accounts. This field, if not needed, should be an empty array in your request body. curve field Enum options: `CURVE_SECP256K1`, `CURVE_ED25519`, `CURVE_P256` pathFormat field Enum options: `PATH_FORMAT_BIP32` Path used to generate a wallet Account. addressFormat field Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` Optional human-readable name for the account. Length of mnemonic to generate the Wallet seed. Defaults to 12. Accepted values: 12, 15, 18, 21, 24. Disable email recovery for the sub-organization Disable email auth for the sub-organization emailAuthIntent field Email of the authenticating user. Client-side public key generated by the user, to which the email auth bundle (credentials) will be encrypted. Optional human-readable name for an API Key. If none provided, default to Email Auth - \ Expiration window (in seconds) indicating how long the API key is valid for. If not provided, a default of 15 minutes will be used. emailCustomization field The name of the application. A URL pointing to a logo in PNG format. Note this logo will be resized to fit into 340px x 124px. A template for the URL to be used in a magic link button, e.g. `https://dapp.xyz/%s`. The auth bundle will be interpolated into the `%s`. JSON object containing key/value pairs to be used with custom templates. Unique identifier for a given Email Template. If not specified, the default is the most recent Email Template. Invalidate all other previously generated Email Auth API keys Optional custom email address from which to send the email Optional custom sender name for use with sendFromEmailAddress; if left empty, will default to 'Notifications' Optional custom email address to use as reply-to exportWalletAccountIntent field Address to identify Wallet Account. Client-side public key generated by the user, to which the export bundle will be encrypted. initImportWalletIntent field The ID of the User importing a Wallet. importWalletIntent field The ID of the User importing a Wallet. Human-readable name for a Wallet. Bundle containing a wallet mnemonic encrypted to the enclave's target public key. A list of wallet Accounts. curve field Enum options: `CURVE_SECP256K1`, `CURVE_ED25519`, `CURVE_P256` pathFormat field Enum options: `PATH_FORMAT_BIP32` Path used to generate a wallet Account. addressFormat field Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` Optional human-readable name for the account. initImportPrivateKeyIntent field The ID of the User importing a Private Key. importPrivateKeyIntent field The ID of the User importing a Private Key. Human-readable name for a Private Key. Bundle containing a raw private key encrypted to the enclave's target public key. curve field Enum options: `CURVE_SECP256K1`, `CURVE_ED25519`, `CURVE_P256` Cryptocurrency-specific formats for a derived address (e.g., Ethereum). item field Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` createPoliciesIntent field An array of policy intents to be created. Human-readable name for a Policy. effect field Enum options: `EFFECT_ALLOW`, `EFFECT_DENY` The condition expression that triggers the Effect The consensus expression that triggers the Effect Notes for a Policy. signRawPayloadsIntent field A Wallet account address, Private Key address, or Private Key identifier. An array of raw unsigned payloads to be signed. item field encoding field Enum options: `PAYLOAD_ENCODING_HEXADECIMAL`, `PAYLOAD_ENCODING_TEXT_UTF8`, `PAYLOAD_ENCODING_EIP712`, `PAYLOAD_ENCODING_EIP7702_AUTHORIZATION` hashFunction field Enum options: `HASH_FUNCTION_NO_OP`, `HASH_FUNCTION_SHA256`, `HASH_FUNCTION_KECCAK256`, `HASH_FUNCTION_NOT_APPLICABLE` createReadOnlySessionIntent field createOauthProvidersIntent field The ID of the User to add an Oauth provider to A list of Oauth providers. Human-readable name to identify a Provider. Base64 encoded OIDC token deleteOauthProvidersIntent field The ID of the User to remove an Oauth provider from Unique identifier for a given Provider. item field createSubOrganizationIntentV5 field Name for this sub-organization Root users to create within this sub-organization Human-readable name for a User. The user's email address. A list of API Key parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an API Key. The public component of a cryptographic key pair used to sign messages and transactions. Optional window (in seconds) indicating how long the API Key should last. A list of Authenticator parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an Authenticator. Challenge presented for authentication purposes. attestation field The cbor encoded then base64 url encoded id of the credential. A base64 url encoded payload containing metadata about the signing context and the challenge. A base64 url encoded payload containing authenticator data and any attestation the webauthn provider chooses. The type of authenticator transports. item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` A list of Oauth providers. This field, if not needed, should be an empty array in your request body. Human-readable name to identify a Provider. Base64 encoded OIDC token The threshold of unique approvals to reach root quorum. This value must be less than or equal to the number of root users wallet field Human-readable name for a Wallet. A list of wallet Accounts. This field, if not needed, should be an empty array in your request body. curve field Enum options: `CURVE_SECP256K1`, `CURVE_ED25519`, `CURVE_P256` pathFormat field Enum options: `PATH_FORMAT_BIP32` Path used to generate a wallet Account. addressFormat field Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` Optional human-readable name for the account. Length of mnemonic to generate the Wallet seed. Defaults to 12. Accepted values: 12, 15, 18, 21, 24. Disable email recovery for the sub-organization Disable email auth for the sub-organization oauthIntent field Base64 encoded OIDC token Client-side public key generated by the user, to which the oauth bundle (credentials) will be encrypted. Optional human-readable name for an API Key. If none provided, default to Oauth - \ Expiration window (in seconds) indicating how long the API key is valid for. If not provided, a default of 15 minutes will be used. Invalidate all other previously generated Oauth API keys createApiKeysIntentV2 field A list of API Keys. Human-readable name for an API Key. The public component of a cryptographic key pair used to sign messages and transactions. curveType field Enum options: `API_KEY_CURVE_P256`, `API_KEY_CURVE_SECP256K1`, `API_KEY_CURVE_ED25519` Optional window (in seconds) indicating how long the API Key should last. Unique identifier for a given User. createReadWriteSessionIntent field Client-side public key generated by the user, to which the read write session bundle (credentials) will be encrypted. Email of the user to create a read write session for Optional human-readable name for an API Key. If none provided, default to Read Write Session - \ Expiration window (in seconds) indicating how long the API key is valid for. If not provided, a default of 15 minutes will be used. emailAuthIntentV2 field Email of the authenticating user. Client-side public key generated by the user, to which the email auth bundle (credentials) will be encrypted. Optional human-readable name for an API Key. If none provided, default to Email Auth - \ Expiration window (in seconds) indicating how long the API key is valid for. If not provided, a default of 15 minutes will be used. emailCustomization field The name of the application. A URL pointing to a logo in PNG format. Note this logo will be resized to fit into 340px x 124px. A template for the URL to be used in a magic link button, e.g. `https://dapp.xyz/%s`. The auth bundle will be interpolated into the `%s`. JSON object containing key/value pairs to be used with custom templates. Unique identifier for a given Email Template. If not specified, the default is the most recent Email Template. Invalidate all other previously generated Email Auth API keys Optional custom email address from which to send the email Optional custom sender name for use with sendFromEmailAddress; if left empty, will default to 'Notifications' Optional custom email address to use as reply-to createSubOrganizationIntentV6 field Name for this sub-organization Root users to create within this sub-organization Human-readable name for a User. The user's email address. A list of API Key parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an API Key. The public component of a cryptographic key pair used to sign messages and transactions. curveType field Enum options: `API_KEY_CURVE_P256`, `API_KEY_CURVE_SECP256K1`, `API_KEY_CURVE_ED25519` Optional window (in seconds) indicating how long the API Key should last. A list of Authenticator parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an Authenticator. Challenge presented for authentication purposes. attestation field The cbor encoded then base64 url encoded id of the credential. A base64 url encoded payload containing metadata about the signing context and the challenge. A base64 url encoded payload containing authenticator data and any attestation the webauthn provider chooses. The type of authenticator transports. item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` A list of Oauth providers. This field, if not needed, should be an empty array in your request body. Human-readable name to identify a Provider. Base64 encoded OIDC token The threshold of unique approvals to reach root quorum. This value must be less than or equal to the number of root users wallet field Human-readable name for a Wallet. A list of wallet Accounts. This field, if not needed, should be an empty array in your request body. curve field Enum options: `CURVE_SECP256K1`, `CURVE_ED25519`, `CURVE_P256` pathFormat field Enum options: `PATH_FORMAT_BIP32` Path used to generate a wallet Account. addressFormat field Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` Optional human-readable name for the account. Length of mnemonic to generate the Wallet seed. Defaults to 12. Accepted values: 12, 15, 18, 21, 24. Disable email recovery for the sub-organization Disable email auth for the sub-organization deletePrivateKeysIntent field List of unique identifiers for private keys within an organization item field Optional parameter for deleting the private keys, even if any have not been previously exported. If they have been exported, this field is ignored. deleteWalletsIntent field List of unique identifiers for wallets within an organization item field Optional parameter for deleting the wallets, even if any have not been previously exported. If they have been exported, this field is ignored. createReadWriteSessionIntentV2 field Client-side public key generated by the user, to which the read write session bundle (credentials) will be encrypted. Optional unique identifier for a given User. If none provided, the read write session will be created for the user who is making the request. Optional human-readable name for an API Key. If none provided, default to Read Write Session - \ Expiration window (in seconds) indicating how long the API key is valid for. If not provided, a default of 15 minutes will be used. Invalidate all other previously generated ReadWriteSession API keys deleteSubOrganizationIntent field Sub-organization deletion, by default, requires associated wallets and private keys to be exported for security reasons. Set this boolean to true to force sub-organization deletion even if some wallets or private keys within it have not been exported yet. Default: false. initOtpAuthIntent field Enum to specify whether to send OTP via SMS or email Email or phone number to send the OTP code to emailCustomization field The name of the application. A URL pointing to a logo in PNG format. Note this logo will be resized to fit into 340px x 124px. A template for the URL to be used in a magic link button, e.g. `https://dapp.xyz/%s`. The auth bundle will be interpolated into the `%s`. JSON object containing key/value pairs to be used with custom templates. Unique identifier for a given Email Template. If not specified, the default is the most recent Email Template. smsCustomization field Template containing references to .OtpCode i.e Your OTP is \{\{.OtpCode}} Optional client-generated user identifier to enable per-user rate limiting for SMS auth. We recommend using a hash of the client-side IP address. Optional custom email address from which to send the OTP email Optional custom sender name for use with sendFromEmailAddress; if left empty, will default to 'Notifications' Optional custom email address to use as reply-to otpAuthIntent field ID representing the result of an init OTP activity. OTP sent out to a user's contact (email or SMS) Client-side public key generated by the user, to which the OTP bundle (credentials) will be encrypted. Optional human-readable name for an API Key. If none provided, default to OTP Auth - \ Expiration window (in seconds) indicating how long the API key is valid for. If not provided, a default of 15 minutes will be used. Invalidate all other previously generated OTP Auth API keys createSubOrganizationIntentV7 field Name for this sub-organization Root users to create within this sub-organization Human-readable name for a User. The user's email address. The user's phone number in E.164 format e.g. +13214567890 A list of API Key parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an API Key. The public component of a cryptographic key pair used to sign messages and transactions. curveType field Enum options: `API_KEY_CURVE_P256`, `API_KEY_CURVE_SECP256K1`, `API_KEY_CURVE_ED25519` Optional window (in seconds) indicating how long the API Key should last. A list of Authenticator parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an Authenticator. Challenge presented for authentication purposes. attestation field The cbor encoded then base64 url encoded id of the credential. A base64 url encoded payload containing metadata about the signing context and the challenge. A base64 url encoded payload containing authenticator data and any attestation the webauthn provider chooses. The type of authenticator transports. item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` A list of Oauth providers. This field, if not needed, should be an empty array in your request body. Human-readable name to identify a Provider. Base64 encoded OIDC token The threshold of unique approvals to reach root quorum. This value must be less than or equal to the number of root users wallet field Human-readable name for a Wallet. A list of wallet Accounts. This field, if not needed, should be an empty array in your request body. curve field Enum options: `CURVE_SECP256K1`, `CURVE_ED25519`, `CURVE_P256` pathFormat field Enum options: `PATH_FORMAT_BIP32` Path used to generate a wallet Account. addressFormat field Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` Optional human-readable name for the account. Length of mnemonic to generate the Wallet seed. Defaults to 12. Accepted values: 12, 15, 18, 21, 24. Disable email recovery for the sub-organization Disable email auth for the sub-organization Disable OTP SMS auth for the sub-organization Disable OTP email auth for the sub-organization Signed JWT containing a unique id, expiry, verification type, contact clientSignature field The public component of a cryptographic key pair used to create the signature. scheme field Enum options: `CLIENT_SIGNATURE_SCHEME_API_P256` The message that was signed. The cryptographic signature over the message. updateWalletIntent field Unique identifier for a given Wallet. Human-readable name for a Wallet. updatePolicyIntentV2 field Unique identifier for a given Policy. Human-readable name for a Policy. policyEffect field Enum options: `EFFECT_ALLOW`, `EFFECT_DENY` The condition expression that triggers the Effect (optional). The consensus expression that triggers the Effect (optional). Accompanying notes for a Policy (optional). createUsersIntentV3 field A list of Users. Human-readable name for a User. The user's email address. The user's phone number in E.164 format e.g. +13214567890 A list of API Key parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an API Key. The public component of a cryptographic key pair used to sign messages and transactions. curveType field Enum options: `API_KEY_CURVE_P256`, `API_KEY_CURVE_SECP256K1`, `API_KEY_CURVE_ED25519` Optional window (in seconds) indicating how long the API Key should last. A list of Authenticator parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an Authenticator. Challenge presented for authentication purposes. attestation field The cbor encoded then base64 url encoded id of the credential. A base64 url encoded payload containing metadata about the signing context and the challenge. A base64 url encoded payload containing authenticator data and any attestation the webauthn provider chooses. The type of authenticator transports. item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` A list of Oauth providers. This field, if not needed, should be an empty array in your request body. Human-readable name to identify a Provider. Base64 encoded OIDC token A list of User Tag IDs. This field, if not needed, should be an empty array in your request body. item field initOtpAuthIntentV2 field Enum to specify whether to send OTP via SMS or email Email or phone number to send the OTP code to Optional length of the OTP code. Default = 9 emailCustomization field The name of the application. A URL pointing to a logo in PNG format. Note this logo will be resized to fit into 340px x 124px. A template for the URL to be used in a magic link button, e.g. `https://dapp.xyz/%s`. The auth bundle will be interpolated into the `%s`. JSON object containing key/value pairs to be used with custom templates. Unique identifier for a given Email Template. If not specified, the default is the most recent Email Template. smsCustomization field Template containing references to .OtpCode i.e Your OTP is \{\{.OtpCode}} Optional client-generated user identifier to enable per-user rate limiting for SMS auth. We recommend using a hash of the client-side IP address. Optional custom email address from which to send the OTP email Optional flag to specify if the OTP code should be alphanumeric (Crockford’s Base32). Default = true Optional custom sender name for use with sendFromEmailAddress; if left empty, will default to 'Notifications' Optional custom email address to use as reply-to initOtpIntent field Whether to send OTP via SMS or email. Possible values: OTP\_TYPE\_SMS, OTP\_TYPE\_EMAIL Email or phone number to send the OTP code to Optional length of the OTP code. Default = 9 emailCustomization field The name of the application. A URL pointing to a logo in PNG format. Note this logo will be resized to fit into 340px x 124px. A template for the URL to be used in a magic link button, e.g. `https://dapp.xyz/%s`. The auth bundle will be interpolated into the `%s`. JSON object containing key/value pairs to be used with custom templates. Unique identifier for a given Email Template. If not specified, the default is the most recent Email Template. smsCustomization field Template containing references to .OtpCode i.e Your OTP is \{\{.OtpCode}} Optional client-generated user identifier to enable per-user rate limiting for SMS auth. We recommend using a hash of the client-side IP address. Optional custom email address from which to send the OTP email Optional flag to specify if the OTP code should be alphanumeric (Crockford’s Base32). Default = true Optional custom sender name for use with sendFromEmailAddress; if left empty, will default to 'Notifications' Expiration window (in seconds) indicating how long the OTP is valid for. If not provided, a default of 5 minutes will be used. Maximum value is 600 seconds (10 minutes) Optional custom email address to use as reply-to verifyOtpIntent field ID representing the result of an init OTP activity. OTP sent out to a user's contact (email or SMS) Expiration window (in seconds) indicating how long the verification token is valid for. If not provided, a default of 1 hour will be used. Maximum value is 86400 seconds (24 hours) Client-side public key generated by the user, which will be added to the JWT response and verified in subsequent requests via a client proof signature otpLoginIntent field Signed JWT containing a unique id, expiry, verification type, contact Client-side public key generated by the user, which will be conditionally added to org data based on the validity of the verification token Expiration window (in seconds) indicating how long the Session is valid for. If not provided, a default of 15 minutes will be used. Invalidate all other previously generated Login API keys clientSignature field The public component of a cryptographic key pair used to create the signature. scheme field Enum options: `CLIENT_SIGNATURE_SCHEME_API_P256` The message that was signed. The cryptographic signature over the message. Optional session profile ID to specify which Session Profile to use for this login. If not provided, the default read/write session will be used. stampLoginIntent field Client-side public key generated by the user, which will be conditionally added to org data based on the passkey stamp associated with this request Expiration window (in seconds) indicating how long the Session is valid for. If not provided, a default of 15 minutes will be used. Invalidate all other previously generated Login API keys Optional session profile ID to specify which Session Profile to use for this login. If not provided, the default read/write session will be used. oauthLoginIntent field Base64 encoded OIDC token Client-side public key generated by the user, which will be conditionally added to org data based on the validity of the oidc token associated with this request Expiration window (in seconds) indicating how long the Session is valid for. If not provided, a default of 15 minutes will be used. Invalidate all other previously generated Login API keys Optional session profile ID to specify which Session Profile to use for this login. If not provided, the default read/write session will be used. updateUserNameIntent field Unique identifier for a given User. Human-readable name for a User. updateUserEmailIntent field Unique identifier for a given User. The user's email address. Setting this to an empty string will remove the user's email. Signed JWT containing a unique id, expiry, verification type, contact updateUserPhoneNumberIntent field Unique identifier for a given User. The user's phone number in E.164 format e.g. +13214567890. Setting this to an empty string will remove the user's phone number. Signed JWT containing a unique id, expiry, verification type, contact initFiatOnRampIntent field onrampProvider field Enum options: `FIAT_ON_RAMP_PROVIDER_COINBASE`, `FIAT_ON_RAMP_PROVIDER_MOONPAY` Destination wallet address for the buy transaction. network field Enum options: `FIAT_ON_RAMP_BLOCKCHAIN_NETWORK_BITCOIN`, `FIAT_ON_RAMP_BLOCKCHAIN_NETWORK_ETHEREUM`, `FIAT_ON_RAMP_BLOCKCHAIN_NETWORK_SOLANA`, `FIAT_ON_RAMP_BLOCKCHAIN_NETWORK_BASE` cryptoCurrencyCode field Enum options: `FIAT_ON_RAMP_CRYPTO_CURRENCY_BTC`, `FIAT_ON_RAMP_CRYPTO_CURRENCY_ETH`, `FIAT_ON_RAMP_CRYPTO_CURRENCY_SOL`, `FIAT_ON_RAMP_CRYPTO_CURRENCY_USDC` fiatCurrencyCode field Enum options: `FIAT_ON_RAMP_CURRENCY_AUD`, `FIAT_ON_RAMP_CURRENCY_BGN`, `FIAT_ON_RAMP_CURRENCY_BRL`, `FIAT_ON_RAMP_CURRENCY_CAD`, `FIAT_ON_RAMP_CURRENCY_CHF`, `FIAT_ON_RAMP_CURRENCY_COP`, `FIAT_ON_RAMP_CURRENCY_CZK`, `FIAT_ON_RAMP_CURRENCY_DKK`, `FIAT_ON_RAMP_CURRENCY_DOP`, `FIAT_ON_RAMP_CURRENCY_EGP`, `FIAT_ON_RAMP_CURRENCY_EUR`, `FIAT_ON_RAMP_CURRENCY_GBP`, `FIAT_ON_RAMP_CURRENCY_HKD`, `FIAT_ON_RAMP_CURRENCY_IDR`, `FIAT_ON_RAMP_CURRENCY_ILS`, `FIAT_ON_RAMP_CURRENCY_JOD`, `FIAT_ON_RAMP_CURRENCY_KES`, `FIAT_ON_RAMP_CURRENCY_KWD`, `FIAT_ON_RAMP_CURRENCY_LKR`, `FIAT_ON_RAMP_CURRENCY_MXN`, `FIAT_ON_RAMP_CURRENCY_NGN`, `FIAT_ON_RAMP_CURRENCY_NOK`, `FIAT_ON_RAMP_CURRENCY_NZD`, `FIAT_ON_RAMP_CURRENCY_OMR`, `FIAT_ON_RAMP_CURRENCY_PEN`, `FIAT_ON_RAMP_CURRENCY_PLN`, `FIAT_ON_RAMP_CURRENCY_RON`, `FIAT_ON_RAMP_CURRENCY_SEK`, `FIAT_ON_RAMP_CURRENCY_THB`, `FIAT_ON_RAMP_CURRENCY_TRY`, `FIAT_ON_RAMP_CURRENCY_TWD`, `FIAT_ON_RAMP_CURRENCY_USD`, `FIAT_ON_RAMP_CURRENCY_VND`, `FIAT_ON_RAMP_CURRENCY_ZAR` Specifies a preset fiat amount for the transaction, e.g., '100'. Must be greater than '20'. If not provided, the user will be prompted to enter an amount. paymentMethod field Enum options: `FIAT_ON_RAMP_PAYMENT_METHOD_CREDIT_DEBIT_CARD`, `FIAT_ON_RAMP_PAYMENT_METHOD_APPLE_PAY`, `FIAT_ON_RAMP_PAYMENT_METHOD_GBP_BANK_TRANSFER`, `FIAT_ON_RAMP_PAYMENT_METHOD_GBP_OPEN_BANKING_PAYMENT`, `FIAT_ON_RAMP_PAYMENT_METHOD_GOOGLE_PAY`, `FIAT_ON_RAMP_PAYMENT_METHOD_SEPA_BANK_TRANSFER`, `FIAT_ON_RAMP_PAYMENT_METHOD_PIX_INSTANT_PAYMENT`, `FIAT_ON_RAMP_PAYMENT_METHOD_PAYPAL`, `FIAT_ON_RAMP_PAYMENT_METHOD_VENMO`, `FIAT_ON_RAMP_PAYMENT_METHOD_MOONPAY_BALANCE`, `FIAT_ON_RAMP_PAYMENT_METHOD_CRYPTO_ACCOUNT`, `FIAT_ON_RAMP_PAYMENT_METHOD_FIAT_WALLET`, `FIAT_ON_RAMP_PAYMENT_METHOD_ACH_BANK_ACCOUNT` ISO 3166-1 two-digit country code for Coinbase representing the purchasing user’s country of residence, e.g., US, GB. ISO 3166-2 two-digit country subdivision code for Coinbase representing the purchasing user’s subdivision of residence within their country, e.g. NY. Required if country\_code=US. Optional flag to indicate whether to use the sandbox mode to simulate transactions for the on-ramp provider. Default is false. Optional MoonPay Widget URL to sign when using MoonPay client SDKs with URL Signing enabled. createSmartContractInterfaceIntent field Corresponding contract address or program ID ABI/IDL as a JSON string. Limited to 400kb type field Enum options: `SMART_CONTRACT_INTERFACE_TYPE_ETHEREUM`, `SMART_CONTRACT_INTERFACE_TYPE_SOLANA` Human-readable name for a Smart Contract Interface. Notes for a Smart Contract Interface. deleteSmartContractInterfaceIntent field The ID of a Smart Contract Interface intended for deletion. enableAuthProxyIntent field disableAuthProxyIntent field updateAuthProxyConfigIntent field Updated list of allowed origins for CORS. item field Updated list of allowed proxy authentication methods. item field Custom 'from' address for auth-related emails. Custom reply-to address for auth-related emails. Template ID for email-auth messages. Template ID for OTP SMS messages. emailCustomizationParams field The name of the application. A URL pointing to a logo in PNG format. Note this logo will be resized to fit into 340px x 124px. A template for the URL to be used in a magic link button, e.g. `https://dapp.xyz/%s`. The auth bundle will be interpolated into the `%s`. JSON object containing key/value pairs to be used with custom templates. Unique identifier for a given Email Template. If not specified, the default is the most recent Email Template. smsCustomizationParams field Template containing references to .OtpCode i.e Your OTP is \{\{.OtpCode}} walletKitSettings field List of enabled social login providers (e.g., 'apple', 'google', 'facebook') item field Mapping of social login providers to their Oauth client IDs. Oauth redirect URL to be used for social login flows. OTP code lifetime in seconds. Verification-token lifetime in seconds. Session lifetime in seconds. Enable alphanumeric OTP codes. Desired OTP code length (6–9). Custom 'from' email sender for auth-related emails. Verification token required for get account with PII (email/phone number). Default false. Whitelisted OAuth client IDs for social account linking. When a user authenticates via a social provider with an email matching an existing account, the accounts will be linked if the client ID is in this list and the issuer is considered a trusted provider. item field createOauth2CredentialIntent field provider field Enum options: `OAUTH2_PROVIDER_X`, `OAUTH2_PROVIDER_DISCORD` The Client ID issued by the OAuth 2.0 provider The client secret issued by the OAuth 2.0 provider encrypted to the TLS Fetcher quorum key updateOauth2CredentialIntent field The ID of the OAuth 2.0 credential to update provider field Enum options: `OAUTH2_PROVIDER_X`, `OAUTH2_PROVIDER_DISCORD` The Client ID issued by the OAuth 2.0 provider The client secret issued by the OAuth 2.0 provider encrypted to the TLS Fetcher quorum key deleteOauth2CredentialIntent field The ID of the OAuth 2.0 credential to delete oauth2AuthenticateIntent field The OAuth 2.0 credential id whose client\_id and client\_secret will be used in the OAuth 2.0 flow The auth\_code provided by the OAuth 2.0 provider to the end user to be exchanged for a Bearer token in the OAuth 2.0 flow The URI the user is redirected to after they have authenticated with the OAuth 2.0 provider The code verifier used by OAuth 2.0 PKCE providers A nonce value set to sha256(publicKey), used to bind the OIDC token to a specific public key An optional P256 public key to which, if provided, the bearer token will be encrypted and returned via the `encrypted_bearer_token` claim of the OIDC Token deleteWalletAccountsIntent field List of unique identifiers for wallet accounts within an organization item field Optional parameter for deleting the wallet accounts, even if any have not been previously exported. If they have been exported, this field is ignored. deletePoliciesIntent field List of unique identifiers for policies within an organization item field ethSendRawTransactionIntent field The raw, signed transaction to be sent. CAIP-2 chain ID (e.g., 'eip155:1' for Ethereum mainnet). Enum options: `eip155:1`, `eip155:11155111`, `eip155:8453`, `eip155:84532`, `eip155:137`, `eip155:80002`, `eip155:56`, `eip155:97` ethSendTransactionIntent field A wallet or private key address to sign with. This does not support private key IDs. Whether to sponsor this transaction via Gas Station. CAIP-2 chain ID (e.g., 'eip155:1' for Ethereum mainnet). Enum options: `eip155:1`, `eip155:11155111`, `eip155:8453`, `eip155:84532`, `eip155:137`, `eip155:80002`, `eip155:56`, `eip155:97` Recipient address as a hex string with 0x prefix. Amount of native asset to send in wei. Hex-encoded call data for contract interactions. Transaction nonce, for EIP-1559 and Turnkey Gas Station authorizations. Maximum amount of gas to use for this transaction, for EIP-1559 transactions. Maximum total fee per gas unit (base fee + priority fee) in wei. Required for non-sponsored (EIP-1559) transactions. Not used for sponsored transactions. Maximum priority fee (tip) per gas unit in wei. Required for non-sponsored (EIP-1559) transactions. Not used for sponsored transactions. Unix timestamp in seconds for EIP-712 execution deadline. Only used when sponsor=true. The gas station delegate contract nonce. Only used when sponsor=true. Include this if you want maximal security posture. createFiatOnRampCredentialIntent field onrampProvider field Enum options: `FIAT_ON_RAMP_PROVIDER_COINBASE`, `FIAT_ON_RAMP_PROVIDER_MOONPAY` Project ID for the on-ramp provider. Some providers, like Coinbase, require this additional identifier Publishable API key for the on-ramp provider Secret API key for the on-ramp provider encrypted to our on-ramp encryption public key Private API key for the on-ramp provider encrypted to our on-ramp encryption public key. Some providers, like Coinbase, require this additional key. If the on-ramp credential is a sandbox credential updateFiatOnRampCredentialIntent field The ID of the fiat on-ramp credential to update onrampProvider field Enum options: `FIAT_ON_RAMP_PROVIDER_COINBASE`, `FIAT_ON_RAMP_PROVIDER_MOONPAY` Project ID for the on-ramp provider. Some providers, like Coinbase, require this additional identifier. Publishable API key for the on-ramp provider Secret API key for the on-ramp provider encrypted to our on-ramp encryption public key Private API key for the on-ramp provider encrypted to our on-ramp encryption public key. Some providers, like Coinbase, require this additional key. deleteFiatOnRampCredentialIntent field The ID of the fiat on-ramp credential to delete emailAuthIntentV3 field Email of the authenticating user. Client-side public key generated by the user, to which the email auth bundle (credentials) will be encrypted. Optional human-readable name for an API Key. If none provided, default to Email Auth - \ Expiration window (in seconds) indicating how long the API key is valid for. If not provided, a default of 15 minutes will be used. emailCustomization field The name of the application. This field is required and will be used in email notifications if an email template is not provided. A URL pointing to a logo in PNG format. Note this logo will be resized to fit into 340px x 124px. A template for the URL to be used in a magic link button, e.g. `https://dapp.xyz/%s`. The auth bundle will be interpolated into the `%s`. JSON object containing key/value pairs to be used with custom templates. Unique identifier for a given Email Template. If not specified, the default is the most recent Email Template. Invalidate all other previously generated Email Auth API keys Optional custom email address from which to send the email Optional custom sender name for use with sendFromEmailAddress; if left empty, will default to 'Notifications' Optional custom email address to use as reply-to initUserEmailRecoveryIntentV2 field Email of the user starting recovery Client-side public key generated by the user, to which the recovery bundle will be encrypted. Expiration window (in seconds) indicating how long the recovery credential is valid for. If not provided, a default of 15 minutes will be used. emailCustomization field The name of the application. This field is required and will be used in email notifications if an email template is not provided. A URL pointing to a logo in PNG format. Note this logo will be resized to fit into 340px x 124px. A template for the URL to be used in a magic link button, e.g. `https://dapp.xyz/%s`. The auth bundle will be interpolated into the `%s`. JSON object containing key/value pairs to be used with custom templates. Unique identifier for a given Email Template. If not specified, the default is the most recent Email Template. Optional custom email address from which to send the OTP email Optional custom sender name for use with sendFromEmailAddress; if left empty, will default to 'Notifications' Optional custom email address to use as reply-to initOtpIntentV2 field Whether to send OTP via SMS or email. Possible values: OTP\_TYPE\_SMS, OTP\_TYPE\_EMAIL Email or phone number to send the OTP code to Optional length of the OTP code. Default = 9 The name of the application. This field is required and will be used in email notifications if an email template is not provided. emailCustomization field A URL pointing to a logo in PNG format. Note this logo will be resized to fit into 340px x 124px. A template for the URL to be used in a magic link button, e.g. `https://dapp.xyz/%s`. The auth bundle will be interpolated into the `%s`. JSON object containing key/value pairs to be used with custom templates. Unique identifier for a given Email Template. If not specified, the default is the most recent Email Template. smsCustomization field Template containing references to .OtpCode i.e Your OTP is \{\{.OtpCode}} Optional client-generated user identifier to enable per-user rate limiting for SMS auth. We recommend using a hash of the client-side IP address. Optional custom email address from which to send the OTP email Optional flag to specify if the OTP code should be alphanumeric (Crockford’s Base32). Default = true Optional custom sender name for use with sendFromEmailAddress; if left empty, will default to 'Notifications' Expiration window (in seconds) indicating how long the OTP is valid for. If not provided, a default of 5 minutes will be used. Maximum value is 600 seconds (10 minutes) Optional custom email address to use as reply-to initOtpAuthIntentV3 field Whether to send OTP via SMS or email. Possible values: OTP\_TYPE\_SMS, OTP\_TYPE\_EMAIL Email or phone number to send the OTP code to Optional length of the OTP code. Default = 9 The name of the application. This field is required and will be used in email notifications if an email template is not provided. emailCustomization field A URL pointing to a logo in PNG format. Note this logo will be resized to fit into 340px x 124px. A template for the URL to be used in a magic link button, e.g. `https://dapp.xyz/%s`. The auth bundle will be interpolated into the `%s`. JSON object containing key/value pairs to be used with custom templates. Unique identifier for a given Email Template. If not specified, the default is the most recent Email Template. smsCustomization field Template containing references to .OtpCode i.e Your OTP is \{\{.OtpCode}} Optional client-generated user identifier to enable per-user rate limiting for SMS auth. We recommend using a hash of the client-side IP address. Optional custom email address from which to send the OTP email Optional flag to specify if the OTP code should be alphanumeric (Crockford’s Base32). Default = true Optional custom sender name for use with sendFromEmailAddress; if left empty, will default to 'Notifications' Expiration window (in seconds) indicating how long the OTP is valid for. If not provided, a default of 5 minutes will be used. Maximum value is 600 seconds (10 minutes) Optional custom email address to use as reply-to upsertGasUsageConfigIntent field Gas sponsorship USD limit for the billing organization window. Gas sponsorship USD limit for sub-organizations under the billing organization. Rolling sponsorship window duration, expressed in minutes. This value can't exceed 30 days (43200 minutes). Whether gas sponsorship is enabled for the organization. solanaConfig field Whether Solana rent prefunding is enabled for the organization. When omitted, the existing rent-prefund state is left unchanged. createTvcAppIntent field The name of the new TVC application Quorum public key to use for this application Unique identifier for an existing TVC operator set to use as the Manifest Set for this TVC application. If left empty, a new Manifest Set configuration is required manifestSetParams field Short description for this new operator set Operators to create as part of this new operator set The name for this new operator Public key for this operator Existing operators to use as part of this new operator set item field The threshold of operators needed to reach consensus in this new Operator Set Unique identifier for an existing TVC operator set to use as the Share Set for this TVC application. If left empty, a new Share Set configuration is required shareSetParams field Short description for this new operator set Operators to create as part of this new operator set The name for this new operator Public key for this operator Existing operators to use as part of this new operator set item field The threshold of operators needed to reach consensus in this new Operator Set Enables network egress for this TVC app. Default if not provided: false. When true, this app may create deployments in debug-mode. Debug-mode deployments expose logs and emit zero'd attestation PCRs, so remote attestation cannot succeed. Cannot be changed after app creation. Setting this true means the app's quorum key is considered permanently insecure, and a new app with a fresh quorum key must be created. Default if not provided: false. createTvcDeploymentIntent field The unique identifier of the to-be-deployed TVC application The QuorumOS version to use to deploy this application URL of the container containing the pivot binary Location of the binary in the pivot container Arguments to pass to the pivot binary at startup. Encoded as a list of strings, for example \["--foo", "bar"] item field Digest of the pivot binary in the pivot container. This value will be inserted in the QOS manifest to ensure application integrity. Optional nonce to ensure uniqueness of the deployment manifest. If not provided, it defaults to the current Unix timestamp in seconds. Optional encrypted pull secret to authorize Turnkey to pull the pivot container image. If your image is public, leave this empty. Optional flag to indicate whether to deploy the TVC app in debug mode, which includes additional logging and debugging tools. Default is false. healthCheckType field Enum options: `TVC_HEALTH_CHECK_TYPE_HTTP`, `TVC_HEALTH_CHECK_TYPE_GRPC` Port to use for health checks. Port to use for public ingress. createTvcManifestApprovalsIntent field Unique identifier of the TVC deployment to approve List of manifest approvals Unique identifier of the operator providing this approval Signature from the operator approving the manifest solSendTransactionIntent field Base64-encoded serialized unsigned Solana transaction A wallet or private key address to sign with. This does not support private key IDs. Whether to sponsor this transaction via Gas Station. CAIP-2 chain ID (e.g., 'solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp' for Solana mainnet). Human-readable Solana aliases ('solana:mainnet', 'solana:devnet') are also accepted and normalized to canonical CAIP-2 values. Enum options: `solana:mainnet`, `solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp`, `solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdpKuc147dw2N9d`, `solana:devnet`, `solana:EtWTRABZaYq6iMfeYKouRu166VU2xqa1`, `solana:EtWTRABZaYq6iMfeYKouRu166VU2xqa1wcaWoxPkrZBG` user-provided blockhash for replay protection / deadline control. If omitted and sponsor=true, we fetch a fresh blockhash during execution initOtpIntentV3 field Whether to send OTP via SMS or email. Possible values: OTP\_TYPE\_SMS, OTP\_TYPE\_EMAIL Email or phone number to send the OTP code to The name of the application. Optional length of the OTP code. Default = 9 emailCustomization field A URL pointing to a logo in PNG format. Note this logo will be resized to fit into 340px x 124px. A template for the URL to be used in a magic link button, e.g. `https://dapp.xyz/%s`. The auth bundle will be interpolated into the `%s`. JSON object containing key/value pairs to be used with custom templates. Unique identifier for a given Email Template. If not specified, the default is the most recent Email Template. smsCustomization field Template containing references to .OtpCode i.e Your OTP is \{\{.OtpCode}} Optional client-generated user identifier to enable per-user rate limiting for SMS auth. We recommend using a hash of the client-side IP address. Optional custom email address from which to send the OTP email Optional flag to specify if the OTP code should be alphanumeric (Crockford’s Base32). If set to false, OTP code will only be numeric. Default = true Optional custom sender name for use with sendFromEmailAddress; if left empty, will default to 'Notifications' Expiration window (in seconds) indicating how long the OTP is valid for. If not provided, a default of 5 minutes will be used. Maximum value is 600 seconds (10 minutes) Optional custom email address to use as reply-to verifyOtpIntentV2 field UUID representing an OTP flow. A new UUID is created for each init OTP activity. Encrypted bundle containing the OTP code and a client-generated public key. Turnkey's secure enclaves will decrypt this bundle, verify the OTP code, and issue a new Verification Token. Encrypted using the target encryption key provided in the INIT\_OTP activity result. Expiration window (in seconds) indicating how long the verification token is valid for. If not provided, a default of 1 hour will be used. Maximum value is 86400 seconds (24 hours) otpLoginIntentV2 field Signed Verification Token containing a unique id, expiry, verification type, contact Client-side public key generated by the user, used as the session public key upon successful login clientSignature field The public component of a cryptographic key pair used to create the signature. scheme field Enum options: `CLIENT_SIGNATURE_SCHEME_API_P256` The message that was signed. The cryptographic signature over the message. Expiration window (in seconds) indicating how long the Session is valid for. If not provided, a default of 15 minutes will be used. Invalidate all other previously generated Login sessions Optional session profile ID to specify which Session Profile to use for this login. If not provided, the default read/write session will be used. updateOrganizationNameIntent field New name for the Organization. createSubOrganizationIntentV8 field Name for this sub-organization Root users to create within this sub-organization Human-readable name for a User. The user's email address. The user's phone number in E.164 format e.g. +13214567890 A list of API Key parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an API Key. The public component of a cryptographic key pair used to sign messages and transactions. curveType field Enum options: `API_KEY_CURVE_P256`, `API_KEY_CURVE_SECP256K1`, `API_KEY_CURVE_ED25519` Optional window (in seconds) indicating how long the API Key should last. A list of Authenticator parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an Authenticator. Challenge presented for authentication purposes. attestation field The cbor encoded then base64 url encoded id of the credential. A base64 url encoded payload containing metadata about the signing context and the challenge. A base64 url encoded payload containing authenticator data and any attestation the webauthn provider chooses. The type of authenticator transports. item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` A list of Oauth providers. This field, if not needed, should be an empty array in your request body. Human-readable name to identify a Provider. Base64 encoded OIDC token oidcClaims field The issuer identifier from the OIDC token (iss claim) The subject identifier from the OIDC token (sub claim) The audience from the OIDC token (aud claim) The threshold of unique approvals to reach root quorum. This value must be less than or equal to the number of root users wallet field Human-readable name for a Wallet. A list of wallet Accounts. This field, if not needed, should be an empty array in your request body. curve field Enum options: `CURVE_SECP256K1`, `CURVE_ED25519`, `CURVE_P256` pathFormat field Enum options: `PATH_FORMAT_BIP32` Path used to generate a wallet Account. addressFormat field Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` Optional human-readable name for the account. Length of mnemonic to generate the Wallet seed. Defaults to 12. Accepted values: 12, 15, 18, 21, 24. Disable email recovery for the sub-organization Disable email auth for the sub-organization Disable OTP SMS auth for the sub-organization Disable OTP email auth for the sub-organization Signed JWT containing a unique id, expiry, verification type, contact clientSignature field The public component of a cryptographic key pair used to create the signature. scheme field Enum options: `CLIENT_SIGNATURE_SCHEME_API_P256` The message that was signed. The cryptographic signature over the message. createOauthProvidersIntentV2 field The ID of the User to add an Oauth provider to A list of Oauth providers. Human-readable name to identify a Provider. Base64 encoded OIDC token oidcClaims field The issuer identifier from the OIDC token (iss claim) The subject identifier from the OIDC token (sub claim) The audience from the OIDC token (aud claim) createUsersIntentV4 field A list of Users. Human-readable name for a User. The user's email address. The user's phone number in E.164 format e.g. +13214567890 A list of API Key parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an API Key. The public component of a cryptographic key pair used to sign messages and transactions. curveType field Enum options: `API_KEY_CURVE_P256`, `API_KEY_CURVE_SECP256K1`, `API_KEY_CURVE_ED25519` Optional window (in seconds) indicating how long the API Key should last. A list of Authenticator parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an Authenticator. Challenge presented for authentication purposes. attestation field The cbor encoded then base64 url encoded id of the credential. A base64 url encoded payload containing metadata about the signing context and the challenge. A base64 url encoded payload containing authenticator data and any attestation the webauthn provider chooses. The type of authenticator transports. item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` A list of Oauth providers. This field, if not needed, should be an empty array in your request body. Human-readable name to identify a Provider. Base64 encoded OIDC token oidcClaims field The issuer identifier from the OIDC token (iss claim) The subject identifier from the OIDC token (sub claim) The audience from the OIDC token (aud claim) A list of User Tag IDs. This field, if not needed, should be an empty array in your request body. item field createWebhookEndpointIntent field The destination URL for webhook delivery. Human-readable name for this webhook endpoint. Event subscriptions to create for this endpoint. The event type to subscribe to (for example, ACTIVITY\_UPDATES, BALANCE\_CONFIRMED\_UPDATES, or BALANCE\_FINALIZED\_UPDATES). JSON-encoded filter criteria for this subscription. Whether this subscription is active. updateWebhookEndpointIntent field Unique identifier of the webhook endpoint to update. Updated destination URL for webhook delivery. Updated human-readable name for this webhook endpoint. Whether this webhook endpoint is active. deleteWebhookEndpointIntent field Unique identifier of the webhook endpoint to delete. setIpAllowlistIntent field The public component of an API key. If null, the IP allowlist applies at the organization level. If set, it applies only to this specific API key. Whether the IP allowlist is enabled. Only meaningful for organization-level allowlists. Omit for API key-level allowlists. List of IP allowlist rules with CIDR blocks and optional labels. CIDR block (e.g., '192.168.1.0/24', '2001:db8::/32'). Optional human-readable label for this rule (e.g., 'Office VPN'). Behavior when an error occurs during IP allowlist evaluation. Valid values: ALLOW, DENY. Defaults to DENY. removeIpAllowlistIntent field The public component of an API key. If null, removes the organization-level IP allowlist. If set, removes the IP allowlist for this specific API key. updateTvcAppLiveDeploymentIntent field The unique identifier of the TVC deployment to set as live for the app. deleteTvcDeploymentIntent field The unique identifier of the TVC deployment to delete. deleteTvcAppAndDeploymentsIntent field The unique identifier of the TVC app to delete. The app and all associated deployments will be removed. restoreTvcDeploymentIntent field The unique identifier of the TVC deployment to restore. sparkSignFrostIntent field A Spark wallet account address identifying the wallet to sign with. Batched sign requests. Each produces a partial signature plus Turnkey's public commitments. derivation field identity field signingLeaf field Unique identifier for the Spark signing leaf. deposit field staticDeposit field Index used to derive the static deposit key. htlcPreimage field Hex-encoded 32-byte sighash to sign. Aggregate group verifying key (hex-encoded compressed secp256k1 point), computed as P\_ops + P\_user. Bound into the nonce HMAC. Commitments for every non-Turnkey participant. MUST NOT include an entry under Turnkey's identifier. Bound into the nonce HMAC. FROST participant identifier, hex-encoded (32-byte scalar). Hiding commitment D, hex-encoded compressed secp256k1 point. Binding commitment E, hex-encoded compressed secp256k1 point. Optional adaptor point T (hex-encoded 33-byte compressed secp256k1 pubkey). When set, Turnkey produces a Schnorr adaptor pre-signature with the FROST challenge bound to `R+T` (where `R` is the aggregate group nonce commitment from FROST). The party holding the discrete log `t` completes the pre-sig to a valid BIP-340 signature by adding `t` (or `-t`, for parity) to the signature scalar `s`. This is primarily used by Spark leaves-swap and other adaptor-bound flows; absent or empty leads to plain FROST signing (the typical case). sparkPrepareTransferIntent field A Spark wallet account address identifying the wallet. transfer field Spark transfer identifier (UUID). Leaves being transferred. Leaf identifier (UUID). oldLeafDerivation field identity field signingLeaf field Unique identifier for the Spark signing leaf. deposit field staticDeposit field Index used to derive the static deposit key. htlcPreimage field newLeafDerivation field identity field signingLeaf field Unique identifier for the Spark signing leaf. deposit field staticDeposit field Index used to derive the static deposit key. htlcPreimage field Client-produced CPFP refund signature (hex-encoded), passed through verbatim into the per-operator SendLeafKeyTweak. Empty omits the field from the operator package. Client-produced direct refund signature (hex-encoded). Passed through verbatim. Client-produced direct-from-CPFP refund signature (hex-encoded). Passed through verbatim. Feldman VSS threshold for reconstructing the per-leaf tweak scalar. Operators that will receive Feldman shares of the per-leaf tweak. Order must match the operators' numeric IDs in the Spark operator config - share index is the 1-based position in this list. Spark operator identifier (UUID). Operator's ECIES encryption pubkey (hex-encoded compressed secp256k1 point). Recipient's identity pubkey (hex-encoded compressed secp256k1 point). Each leaf's new\_priv is ECIES-encrypted to this key and embedded in the per-operator package for claim-time delivery. sparkClaimTransferIntent field A Spark wallet account address identifying the wallet. claim field Leaves being claimed. Leaf identifier (UUID). ECIES ciphertext (hex-encoded) containing the inbound transfer secret. Decrypted inside the enclave using the wallet's Identity key. Hex-encoded 64-byte compact ECDSA signature binding (leaf\_id, transfer\_id, ciphertext) to the sender's identity key. Verified inside the enclave before decryption. Shamir threshold for reconstructing the per-leaf claim secret. Operators that will receive Shamir shares. Spark operator identifier (UUID). Operator's ECIES encryption pubkey (hex-encoded compressed secp256k1 point). Spark transfer identifier (UUID). Used together with each leaf's sender\_signature to verify the sender bound this ciphertext to this transfer. Sender's compressed secp256k1 identity public key (hex-encoded, 33 bytes). Used to verify the per-leaf sender\_signature fields. sparkPrepareLightningReceiveIntent field A Spark wallet account address identifying the wallet. lightningReceive field Feldman VSS threshold for reconstructing the preimage. Operators that will receive Feldman shares of the preimage. Order must match the operators' numeric IDs in the Spark operator config - share index is the 1-based position in this list. Spark operator identifier (UUID). Operator's ECIES encryption pubkey (hex-encoded compressed secp256k1 point). postTvcQuorumKeyShareIntent field Unique identifier of the TVC deployment receiving quorum key share Hex-encoded ephemeral public key used to encrypt the quorum key share shareApprovalBundle field Unique identifier of the operator providing this quorum key share Hex-encoded re-encrypted quorum key share Signature from the share set operator approving the manifest ethSendTransactionIntentV2 field A wallet or private key address to sign with. This does not support private key IDs. CAIP-2 chain ID (e.g., 'eip155:1' for Ethereum mainnet). Enum options: `eip155:1`, `eip155:11155111`, `eip155:8453`, `eip155:84532`, `eip155:137`, `eip155:80002`, `eip155:56`, `eip155:97` Whether to sponsor this transaction via Gas Station. If false or unset, the EOA pays gas. A single call uses EIP-1559; multiple calls use EIP-7702 batch execution via Gas Station. Outer transaction nonce. Omit to auto-fetch. Maximum amount of gas for the outer transaction. Omit to auto-estimate. Maximum total fee per gas unit (base fee + priority fee) in wei. Omit to auto-estimate. Maximum priority fee (tip) per gas unit in wei. Omit to auto-estimate. Unix timestamp in seconds for EIP-712 execution deadline. Only used when sponsor=true. The gas station delegate contract nonce. Only used when sponsor=true. Omit to auto-fetch. Ordered list of calls to execute. Must contain between 1 and 50 entries. A single entry with sponsor=false uses EIP-1559; multiple entries use EIP-7702 batch execution via Gas Station. Recipient address as a hex string with 0x prefix. Amount of native asset to send in wei. Hex-encoded call data for contract interactions. createMfaPolicyIntent field The ID of the User to add the MFA Policy to. Human-readable name for a Policy. A condition expression that evaluates to true or false, determining when this MFA policy applies. An ordered list of authentication requirements. Each requirement must be satisfied sequentially to complete MFA. A list of authentication methods for this MFA step. If only one method is provided, it is required. If multiple are provided, the user must satisfy ANY one of them. type field Enum options: `AUTHENTICATION_TYPE_EMAIL_OTP`, `AUTHENTICATION_TYPE_SMS_OTP`, `AUTHENTICATION_TYPE_PASSKEY`, `AUTHENTICATION_TYPE_API_KEY`, `AUTHENTICATION_TYPE_OAUTH`, `AUTHENTICATION_TYPE_SESSION` Optional specific authenticator ID required (e.g., UUID of a passkey authenticator). If not provided, any authenticator of the specified type can be used. The order in which this MFA policy is evaluated, starting from 0, relative to other MFA policies. Lower order values are evaluated first. Notes for an MFA Policy. updateMfaPolicyIntent field The ID of the User to update the MFA Policy for. Unique identifier for a given MFA Policy. Human-readable name for a Policy. A condition expression that evaluates to true or false, determining when this MFA policy applies. An ordered list of authentication requirements. Each requirement must be satisfied sequentially to complete MFA. A list of authentication methods for this MFA step. If only one method is provided, it is required. If multiple are provided, the user must satisfy ANY one of them. type field Enum options: `AUTHENTICATION_TYPE_EMAIL_OTP`, `AUTHENTICATION_TYPE_SMS_OTP`, `AUTHENTICATION_TYPE_PASSKEY`, `AUTHENTICATION_TYPE_API_KEY`, `AUTHENTICATION_TYPE_OAUTH`, `AUTHENTICATION_TYPE_SESSION` Optional specific authenticator ID required (e.g., UUID of a passkey authenticator). If not provided, any authenticator of the specified type can be used. The order in which this MFA policy is evaluated, starting from 0, relative to other MFA policies. Lower order values are evaluated first. Notes for an MFA Policy. deleteMfaPolicyIntent field The ID of the User to delete the MFA Policy from. Unique identifier for a given MFA Policy. createSessionProfileIntent field Human-readable name for a Session Profile. The scope string that defines the permissions for this Session Profile. The duration in seconds for which sessions created with this Session Profile are valid. If not set, expiration will be determined by the value passed in to the intent of login activities. Notes for a Session Profile. result field createOrganizationResult field Unique identifier for a given Organization. createAuthenticatorsResult field A list of Authenticator IDs. item field createUsersResult field A list of User IDs. item field createPrivateKeysResult field A list of Private Key IDs. item field createInvitationsResult field A list of Invitation IDs item field acceptInvitationResult field Unique identifier for a given Invitation. Unique identifier for a given User. signRawPayloadResult field Component of an ECSDA signature. Component of an ECSDA signature. Component of an ECSDA signature. createPolicyResult field Unique identifier for a given Policy. disablePrivateKeyResult field Unique identifier for a given Private Key. deleteUsersResult field A list of User IDs. item field deleteAuthenticatorsResult field Unique identifier for a given Authenticator. item field deleteInvitationResult field Unique identifier for a given Invitation. deleteOrganizationResult field Unique identifier for a given Organization. deletePolicyResult field Unique identifier for a given Policy. createUserTagResult field Unique identifier for a given User Tag. A list of User IDs. item field deleteUserTagsResult field A list of User Tag IDs. item field A list of User IDs. item field signTransactionResult field signedTransaction field deleteApiKeysResult field A list of API Key IDs. item field createApiKeysResult field A list of API Key IDs. item field createPrivateKeyTagResult field Unique identifier for a given Private Key Tag. A list of Private Key IDs. item field deletePrivateKeyTagsResult field A list of Private Key Tag IDs. item field A list of Private Key IDs. item field setPaymentMethodResult field The last four digits of the credit card added. The name associated with the payment method. The email address associated with the payment method. activateBillingTierResult field The id of the product being subscribed to. deletePaymentMethodResult field The payment method that was removed. createApiOnlyUsersResult field A list of API-only User IDs. item field updateRootQuorumResult field updateUserTagResult field Unique identifier for a given User Tag. updatePrivateKeyTagResult field Unique identifier for a given Private Key Tag. createSubOrganizationResult field subOrganizationId field rootUserIds field item field updateAllowedOriginsResult field createPrivateKeysResultV2 field A list of Private Key IDs and addresses. privateKeyId field addresses field format field Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` address field updateUserResult field A User ID. updatePolicyResult field Unique identifier for a given Policy. createSubOrganizationResultV3 field subOrganizationId field A list of Private Key IDs and addresses. privateKeyId field addresses field format field Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` address field rootUserIds field item field createWalletResult field Unique identifier for a Wallet. A list of account addresses. item field createWalletAccountsResult field A list of derived addresses. item field initUserEmailRecoveryResult field Unique identifier for the user being recovered. recoverUserResult field ID of the authenticator created. item field setOrganizationFeatureResult field Resulting list of organization features. name field Enum options: `FEATURE_NAME_ROOT_USER_EMAIL_RECOVERY`, `FEATURE_NAME_WEBAUTHN_ORIGINS`, `FEATURE_NAME_EMAIL_AUTH`, `FEATURE_NAME_EMAIL_RECOVERY`, `FEATURE_NAME_WEBHOOK`, `FEATURE_NAME_SMS_AUTH`, `FEATURE_NAME_OTP_EMAIL_AUTH`, `FEATURE_NAME_AUTH_PROXY`, `FEATURE_NAME_SOLANA_RENT_PREFUND_ENABLED` value field removeOrganizationFeatureResult field Resulting list of organization features. name field Enum options: `FEATURE_NAME_ROOT_USER_EMAIL_RECOVERY`, `FEATURE_NAME_WEBAUTHN_ORIGINS`, `FEATURE_NAME_EMAIL_AUTH`, `FEATURE_NAME_EMAIL_RECOVERY`, `FEATURE_NAME_WEBHOOK`, `FEATURE_NAME_SMS_AUTH`, `FEATURE_NAME_OTP_EMAIL_AUTH`, `FEATURE_NAME_AUTH_PROXY`, `FEATURE_NAME_SOLANA_RENT_PREFUND_ENABLED` value field exportPrivateKeyResult field Unique identifier for a given Private Key. Export bundle containing a private key encrypted to the client's target public key. exportWalletResult field Unique identifier for a given Wallet. Export bundle containing a wallet mnemonic + optional newline passphrase encrypted by the client's target public key. createSubOrganizationResultV4 field subOrganizationId field wallet field walletId field A list of account addresses. item field rootUserIds field item field emailAuthResult field Unique identifier for the authenticating User. Unique identifier for the created API key. exportWalletAccountResult field Address to identify Wallet Account. Export bundle containing a private key encrypted by the client's target public key. initImportWalletResult field Import bundle containing a public key and signature to use for importing client data. importWalletResult field Unique identifier for a Wallet. A list of account addresses. item field initImportPrivateKeyResult field Import bundle containing a public key and signature to use for importing client data. importPrivateKeyResult field Unique identifier for a Private Key. A list of addresses. format field Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` address field createPoliciesResult field A list of unique identifiers for the created policies. item field signRawPayloadsResult field signatures field Component of an ECSDA signature. Component of an ECSDA signature. Component of an ECSDA signature. createReadOnlySessionResult field Unique identifier for a given Organization. If the request is being made by a user and their Sub-Organization ID is unknown, this can be the Parent Organization ID. However, using the Sub-Organization ID is preferred due to performance reasons. Human-readable name for an Organization. Unique identifier for a given User. Human-readable name for a User. String representing a read only session UTC timestamp in seconds representing the expiry time for the read only session. createOauthProvidersResult field A list of unique identifiers for Oauth Providers item field deleteOauthProvidersResult field A list of unique identifiers for Oauth Providers item field createSubOrganizationResultV5 field subOrganizationId field wallet field walletId field A list of account addresses. item field rootUserIds field item field oauthResult field Unique identifier for the authenticating User. Unique identifier for the created API key. HPKE encrypted credential bundle createReadWriteSessionResult field Unique identifier for a given Organization. If the request is being made by a user and their Sub-Organization ID is unknown, this can be the Parent Organization ID. However, using the Sub-Organization ID is preferred due to performance reasons. Human-readable name for an Organization. Unique identifier for a given User. Human-readable name for a User. Unique identifier for the created API key. HPKE encrypted credential bundle createSubOrganizationResultV6 field subOrganizationId field wallet field walletId field A list of account addresses. item field rootUserIds field item field deletePrivateKeysResult field A list of private key unique identifiers that were removed item field deleteWalletsResult field A list of wallet unique identifiers that were removed item field createReadWriteSessionResultV2 field Unique identifier for a given Organization. If the request is being made by a user and their Sub-Organization ID is unknown, this can be the Parent Organization ID. However, using the Sub-Organization ID is preferred due to performance reasons. Human-readable name for an Organization. Unique identifier for a given User. Human-readable name for a User. Unique identifier for the created API key. HPKE encrypted credential bundle deleteSubOrganizationResult field Unique identifier of the sub organization that was removed initOtpAuthResult field Unique identifier for an OTP authentication otpAuthResult field Unique identifier for the authenticating User. Unique identifier for the created API key. HPKE encrypted credential bundle createSubOrganizationResultV7 field subOrganizationId field wallet field walletId field A list of account addresses. item field rootUserIds field item field updateWalletResult field A Wallet ID. updatePolicyResultV2 field Unique identifier for a given Policy. initOtpAuthResultV2 field Unique identifier for an OTP authentication initOtpResult field Unique identifier for an OTP authentication verifyOtpResult field Signed JWT containing a unique id, expiry, verification type, contact. Verification status of a user is updated when the token is consumed (in OTP\_LOGIN requests) otpLoginResult field Signed JWT containing an expiry, public key, session type, user id, and organization id stampLoginResult field Signed JWT containing an expiry, public key, session type, user id, and organization id oauthLoginResult field Signed JWT containing an expiry, public key, session type, user id, and organization id updateUserNameResult field Unique identifier of the User whose name was updated. updateUserEmailResult field Unique identifier of the User whose email was updated. updateUserPhoneNumberResult field Unique identifier of the User whose phone number was updated. initFiatOnRampResult field Unique URL for a given fiat on-ramp flow. Unique identifier used to retrieve transaction statuses for a given fiat on-ramp flow. Optional signature of the MoonPay Widget URL. The signature is generated if the Init Fiat On Ramp intent includes the urlForSignature field. The signature can be used to initialize the MoonPay SDKs when URL signing is enabled for your project. createSmartContractInterfaceResult field The ID of the created Smart Contract Interface. deleteSmartContractInterfaceResult field The ID of the deleted Smart Contract Interface. enableAuthProxyResult field A User ID with permission to initiate authentication. disableAuthProxyResult field updateAuthProxyConfigResult field Unique identifier for a given User. (representing the turnkey signer user id) createOauth2CredentialResult field Unique identifier of the OAuth 2.0 credential that was created updateOauth2CredentialResult field Unique identifier of the OAuth 2.0 credential that was updated deleteOauth2CredentialResult field Unique identifier of the OAuth 2.0 credential that was deleted oauth2AuthenticateResult field Base64 encoded OIDC token issued by Turnkey to be used with the LoginWithOAuth activity deleteWalletAccountsResult field A list of wallet account unique identifiers that were removed item field deletePoliciesResult field A list of unique identifiers for the deleted policies. item field ethSendRawTransactionResult field The transaction hash of the sent transaction createFiatOnRampCredentialResult field Unique identifier of the Fiat On-Ramp credential that was created updateFiatOnRampCredentialResult field Unique identifier of the Fiat On-Ramp credential that was updated deleteFiatOnRampCredentialResult field Unique identifier of the Fiat On-Ramp credential that was deleted ethSendTransactionResult field The send\_transaction\_status ID associated with the transaction submission upsertGasUsageConfigResult field Unique identifier for the gas usage configuration that was created or updated. createTvcAppResult field The unique identifier for the TVC application The unique identifier for the TVC manifest set The unique identifier(s) of the manifest set operators item field The required number of approvals for the manifest set createTvcDeploymentResult field The unique identifier for the TVC deployment The unique identifier for the TVC manifest createTvcManifestApprovalsResult field The unique identifier(s) for the manifest approvals item field solSendTransactionResult field The send\_transaction\_status ID associated with the transaction submission initOtpResultV2 field Unique identifier for an OTP flow Signed bundle containing a target encryption key to use when submitting OTP codes. updateOrganizationNameResult field Unique identifier for the Organization. The updated organization name. createSubOrganizationResultV8 field subOrganizationId field wallet field walletId field A list of account addresses. item field rootUserIds field item field createOauthProvidersResultV2 field A list of unique identifiers for Oauth Providers item field createWebhookEndpointResult field Unique identifier of the created webhook endpoint. webhookEndpoint field Unique identifier of the webhook endpoint. Unique identifier for a given Organization. The destination URL for webhook delivery. Human-readable name for this webhook endpoint. Whether this webhook endpoint is active. Current subscriptions attached to this endpoint. The event type to subscribe to (for example, ACTIVITY\_UPDATES, BALANCE\_CONFIRMED\_UPDATES, or BALANCE\_FINALIZED\_UPDATES). JSON-encoded filter criteria for this subscription. Whether this subscription is active. updateWebhookEndpointResult field Unique identifier of the updated webhook endpoint. webhookEndpoint field Unique identifier of the webhook endpoint. Unique identifier for a given Organization. The destination URL for webhook delivery. Human-readable name for this webhook endpoint. Whether this webhook endpoint is active. Current subscriptions attached to this endpoint. The event type to subscribe to (for example, ACTIVITY\_UPDATES, BALANCE\_CONFIRMED\_UPDATES, or BALANCE\_FINALIZED\_UPDATES). JSON-encoded filter criteria for this subscription. Whether this subscription is active. deleteWebhookEndpointResult field Unique identifier of the deleted webhook endpoint. setIpAllowlistResult field removeIpAllowlistResult field updateTvcAppLiveDeploymentResult field deleteTvcDeploymentResult field The unique identifier of the deleted TVC deployment. deleteTvcAppAndDeploymentsResult field The unique identifier of the deleted TVC app. restoreTvcDeploymentResult field The unique identifier of the restored TVC deployment. sparkSignFrostResult field Partial signatures plus Turnkey commitments, one per request, in order. Hex-encoded FROST partial signature. Turnkey's hiding commitment D (hex-encoded compressed secp256k1 point). Forward to the Spark Operator. Turnkey's binding commitment E (hex-encoded compressed secp256k1 point). Forward to the Spark Operator. sparkPrepareTransferResult field Per-operator ECIES-encrypted packages. Spark operator identifier (UUID). ECIES ciphertext (hex-encoded) opaque to Turnkey after emission. Hex-encoded ECDSA-DER signature of the TransferPackage signing payload, signed with the wallet's IDENTITY key. Newly-derived SigningLeaf public keys, one per leaf, in input order. The Spark leaf\_id this public key was derived for. Hex-encoded compressed secp256k1 point (33 bytes) for the SigningLeaf derivation at leaf\_id. sparkClaimTransferResult field Per-operator ECIES-encrypted packages. Spark operator identifier (UUID). ECIES ciphertext (hex-encoded) opaque to Turnkey after emission. Newly-derived SigningLeaf public keys, one per leaf, in input order. The Spark leaf\_id this public key was derived for. Hex-encoded compressed secp256k1 point (33 bytes) for the SigningLeaf derivation at leaf\_id. sparkPrepareLightningReceiveResult field Per-operator ECIES-encrypted Feldman share packages. Spark operator identifier (UUID). ECIES ciphertext (hex-encoded) opaque to Turnkey after emission. Hex-encoded SHA256(preimage). Forward to the Lightning node. postTvcQuorumKeyShareResult field The unique identifier for the provisioning quorum key share ethSendTransactionResultV2 field The send\_transaction\_status ID associated with the transaction submission createMfaPolicyResult field Unique identifier for a given MFA Policy. updateMfaPolicyResult field Unique identifier for a given MFA Policy. deleteMfaPolicyResult field Unique identifier for a given MFA Policy. createSessionProfileResult field Unique identifier for a given Session Profile. A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. Unique identifier for a given Vote object. Unique identifier for a given User. user field Unique identifier for a given User. Human-readable name for a User. The user's email address. The user's phone number in E.164 format e.g. +13214567890 A list of Authenticator parameters. Types of transports that may be used by an Authenticator (e.g., USB, NFC, BLE). item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` attestationType field Identifier indicating the type of the Security Key. Unique identifier for a WebAuthn credential. The type of Authenticator device. credential field The public component of a cryptographic key pair used to sign messages and transactions. type field Enum options: `CREDENTIAL_TYPE_WEBAUTHN_AUTHENTICATOR`, `CREDENTIAL_TYPE_API_KEY_P256`, `CREDENTIAL_TYPE_RECOVER_USER_KEY_P256`, `CREDENTIAL_TYPE_API_KEY_SECP256K1`, `CREDENTIAL_TYPE_EMAIL_AUTH_KEY_P256`, `CREDENTIAL_TYPE_API_KEY_ED25519`, `CREDENTIAL_TYPE_OTP_AUTH_KEY_P256`, `CREDENTIAL_TYPE_READ_WRITE_SESSION_KEY_P256`, `CREDENTIAL_TYPE_OAUTH_KEY_P256`, `CREDENTIAL_TYPE_LOGIN` The session profile associated with this credential, if any. This field is only applicable for credentials of type CREDENTIAL\_TYPE\_LOGIN. Unique identifier for a given Authenticator. Human-readable name for an Authenticator. createdAt field seconds field nanos field updatedAt field seconds field nanos field A list of API Key parameters. This field, if not needed, should be an empty array in your request body. credential field The public component of a cryptographic key pair used to sign messages and transactions. type field Enum options: `CREDENTIAL_TYPE_WEBAUTHN_AUTHENTICATOR`, `CREDENTIAL_TYPE_API_KEY_P256`, `CREDENTIAL_TYPE_RECOVER_USER_KEY_P256`, `CREDENTIAL_TYPE_API_KEY_SECP256K1`, `CREDENTIAL_TYPE_EMAIL_AUTH_KEY_P256`, `CREDENTIAL_TYPE_API_KEY_ED25519`, `CREDENTIAL_TYPE_OTP_AUTH_KEY_P256`, `CREDENTIAL_TYPE_READ_WRITE_SESSION_KEY_P256`, `CREDENTIAL_TYPE_OAUTH_KEY_P256`, `CREDENTIAL_TYPE_LOGIN` The session profile associated with this credential, if any. This field is only applicable for credentials of type CREDENTIAL\_TYPE\_LOGIN. Unique identifier for a given API Key. Human-readable name for an API Key. createdAt field seconds field nanos field updatedAt field seconds field nanos field Optional window (in seconds) indicating how long the API Key should last. A list of User Tag IDs. item field A list of Oauth Providers. Unique identifier for an OAuth Provider Human-readable name to identify a Provider. The issuer of the token, typically a URL indicating the authentication server, e.g [https://accounts.google.com](https://accounts.google.com) Expected audience ('aud' attribute of the signed token) which represents the app ID Expected subject ('sub' attribute of the signed token) which represents the user ID createdAt field seconds field nanos field updatedAt field seconds field nanos field createdAt field seconds field nanos field updatedAt field seconds field nanos field A list of MFA Policies that define multi-factor authentication requirements for this user. Unique identifier for a given MFA Policy. Human-readable name for an MFA Policy. A condition expression that evaluates to true or false, determining when this MFA policy applies. An ordered list of authentication requirements. Each requirement must be satisfied sequentially to complete MFA. A list of authentication methods for this MFA step. If only one method is provided, it is required. If multiple are provided, the user must satisfy ANY one of them. type field Enum options: `AUTHENTICATION_TYPE_EMAIL_OTP`, `AUTHENTICATION_TYPE_SMS_OTP`, `AUTHENTICATION_TYPE_PASSKEY`, `AUTHENTICATION_TYPE_API_KEY`, `AUTHENTICATION_TYPE_OAUTH`, `AUTHENTICATION_TYPE_SESSION` Optional specific authenticator ID required (e.g., for requiring a specific session profile id) The order in which this policy is evaluated relative to other MFA policies. Optional human-readable notes added by a User to describe a particular MFA policy. createdAt field seconds field nanos field updatedAt field seconds field nanos field Unique identifier for a given Activity object. selection field Enum options: `VOTE_SELECTION_APPROVED`, `VOTE_SELECTION_REJECTED` The raw message being signed within a Vote. The public component of a cryptographic key pair used to sign messages and transactions. The signature applied to a particular vote. Method used to produce a signature. createdAt field seconds field nanos field A list of App Proofs generated by enclaves during activity execution, providing verifiable attestations of performed operations. scheme field Enum options: `SIGNATURE_SCHEME_EPHEMERAL_KEY_P256` Ephemeral public key. JSON serialized AppProofPayload. Signature over hashed proof\_payload. An artifact verifying a User's action. canApprove field canReject field createdAt field seconds field nanos field updatedAt field seconds field nanos field failure field code field message field details field @type field ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/get_activity \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "", "activityId": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getActivity({ organizationId: " (Unique identifier for a given organization.)", activityId: " (Unique identifier for a given activity object.)" }); ``` ```json 200 theme={"system"} { "activity": { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "createOrganizationIntent": { "organizationName": "", "rootEmail": "", "rootAuthenticator": { "authenticatorName": "", "userId": "", "attestation": { "id": "", "type": "", "rawId": "", "authenticatorAttachment": "", "response": { "clientDataJson": "", "attestationObject": "", "transports": [ "" ], "authenticatorAttachment": "" }, "clientExtensionResults": { "appid": "", "appidExclude": "", "credProps": { "rk": "" } } }, "challenge": "" }, "rootUserId": "" } }, "result": { "createOrganizationResult": { "organizationId": "" }, "createAuthenticatorsResult": { "authenticatorIds": [ "" ] }, "createUsersResult": { "userIds": [ "" ] }, "createPrivateKeysResult": { "privateKeyIds": [ "" ] }, "createInvitationsResult": { "invitationIds": [ "" ] }, "acceptInvitationResult": { "invitationId": "", "userId": "" }, "signRawPayloadResult": { "r": "", "s": "", "v": "" }, "createPolicyResult": { "policyId": "" }, "disablePrivateKeyResult": { "privateKeyId": "" }, "deleteUsersResult": { "userIds": [ "" ] }, "deleteAuthenticatorsResult": { "authenticatorIds": [ "" ] }, "deleteInvitationResult": { "invitationId": "" }, "deleteOrganizationResult": { "organizationId": "" }, "deletePolicyResult": { "policyId": "" }, "createUserTagResult": { "userTagId": "", "userIds": [ "" ] }, "deleteUserTagsResult": { "userTagIds": [ "" ], "userIds": [ "" ] }, "signTransactionResult": { "signedTransaction": "" }, "deleteApiKeysResult": { "apiKeyIds": [ "" ] }, "createApiKeysResult": { "apiKeyIds": [ "" ] }, "createPrivateKeyTagResult": { "privateKeyTagId": "", "privateKeyIds": [ "" ] }, "deletePrivateKeyTagsResult": { "privateKeyTagIds": [ "" ], "privateKeyIds": [ "" ] }, "setPaymentMethodResult": { "lastFour": "", "cardHolderName": "", "cardHolderEmail": "" }, "activateBillingTierResult": { "productId": "" }, "deletePaymentMethodResult": { "paymentMethodId": "" }, "createApiOnlyUsersResult": { "userIds": [ "" ] }, "updateRootQuorumResult": "", "updateUserTagResult": { "userTagId": "" }, "updatePrivateKeyTagResult": { "privateKeyTagId": "" }, "createSubOrganizationResult": { "subOrganizationId": "", "rootUserIds": [ "" ] }, "updateAllowedOriginsResult": "", "createPrivateKeysResultV2": { "privateKeys": [ { "privateKeyId": "", "addresses": [ { "format": "", "address": "" } ] } ] }, "updateUserResult": { "userId": "" }, "updatePolicyResult": { "policyId": "" }, "createSubOrganizationResultV3": { "subOrganizationId": "", "privateKeys": [ { "privateKeyId": "", "addresses": [ { "format": "", "address": "" } ] } ], "rootUserIds": [ "" ] }, "createWalletResult": { "walletId": "", "addresses": [ "" ] }, "createWalletAccountsResult": { "addresses": [ "" ] }, "initUserEmailRecoveryResult": { "userId": "" }, "recoverUserResult": { "authenticatorId": [ "" ] }, "setOrganizationFeatureResult": { "features": [ { "name": "", "value": "" } ] }, "removeOrganizationFeatureResult": { "features": [ { "name": "", "value": "" } ] }, "exportPrivateKeyResult": { "privateKeyId": "", "exportBundle": "" }, "exportWalletResult": { "walletId": "", "exportBundle": "" }, "createSubOrganizationResultV4": { "subOrganizationId": "", "wallet": { "walletId": "", "addresses": [ "" ] }, "rootUserIds": [ "" ] }, "emailAuthResult": { "userId": "", "apiKeyId": "" }, "exportWalletAccountResult": { "address": "", "exportBundle": "" }, "initImportWalletResult": { "importBundle": "" }, "importWalletResult": { "walletId": "", "addresses": [ "" ] }, "initImportPrivateKeyResult": { "importBundle": "" }, "importPrivateKeyResult": { "privateKeyId": "", "addresses": [ { "format": "", "address": "" } ] }, "createPoliciesResult": { "policyIds": [ "" ] }, "signRawPayloadsResult": { "signatures": [ { "r": "", "s": "", "v": "" } ] }, "createReadOnlySessionResult": { "organizationId": "", "organizationName": "", "userId": "", "username": "", "session": "", "sessionExpiry": "" }, "createOauthProvidersResult": { "providerIds": [ "" ] }, "deleteOauthProvidersResult": { "providerIds": [ "" ] }, "createSubOrganizationResultV5": { "subOrganizationId": "", "wallet": { "walletId": "", "addresses": [ "" ] }, "rootUserIds": [ "" ] }, "oauthResult": { "userId": "", "apiKeyId": "", "credentialBundle": "" }, "createReadWriteSessionResult": { "organizationId": "", "organizationName": "", "userId": "", "username": "", "apiKeyId": "", "credentialBundle": "" }, "createSubOrganizationResultV6": { "subOrganizationId": "", "wallet": { "walletId": "", "addresses": [ "" ] }, "rootUserIds": [ "" ] }, "deletePrivateKeysResult": { "privateKeyIds": [ "" ] }, "deleteWalletsResult": { "walletIds": [ "" ] }, "createReadWriteSessionResultV2": { "organizationId": "", "organizationName": "", "userId": "", "username": "", "apiKeyId": "", "credentialBundle": "" }, "deleteSubOrganizationResult": { "subOrganizationUuid": "" }, "initOtpAuthResult": { "otpId": "" }, "otpAuthResult": { "userId": "", "apiKeyId": "", "credentialBundle": "" }, "createSubOrganizationResultV7": { "subOrganizationId": "", "wallet": { "walletId": "", "addresses": [ "" ] }, "rootUserIds": [ "" ] }, "updateWalletResult": { "walletId": "" }, "updatePolicyResultV2": { "policyId": "" }, "initOtpAuthResultV2": { "otpId": "" }, "initOtpResult": { "otpId": "" }, "verifyOtpResult": { "verificationToken": "" }, "otpLoginResult": { "session": "" }, "stampLoginResult": { "session": "" }, "oauthLoginResult": { "session": "" }, "updateUserNameResult": { "userId": "" }, "updateUserEmailResult": { "userId": "" }, "updateUserPhoneNumberResult": { "userId": "" }, "initFiatOnRampResult": { "onRampUrl": "", "onRampTransactionId": "", "onRampUrlSignature": "" }, "createSmartContractInterfaceResult": { "smartContractInterfaceId": "" }, "deleteSmartContractInterfaceResult": { "smartContractInterfaceId": "" }, "enableAuthProxyResult": { "userId": "" }, "disableAuthProxyResult": "", "updateAuthProxyConfigResult": { "configId": "" }, "createOauth2CredentialResult": { "oauth2CredentialId": "" }, "updateOauth2CredentialResult": { "oauth2CredentialId": "" }, "deleteOauth2CredentialResult": { "oauth2CredentialId": "" }, "oauth2AuthenticateResult": { "oidcToken": "" }, "deleteWalletAccountsResult": { "walletAccountIds": [ "" ] }, "deletePoliciesResult": { "policyIds": [ "" ] }, "ethSendRawTransactionResult": { "transactionHash": "" }, "createFiatOnRampCredentialResult": { "fiatOnRampCredentialId": "" }, "updateFiatOnRampCredentialResult": { "fiatOnRampCredentialId": "" }, "deleteFiatOnRampCredentialResult": { "fiatOnRampCredentialId": "" }, "ethSendTransactionResult": { "sendTransactionStatusId": "" }, "upsertGasUsageConfigResult": { "gasUsageConfigId": "" }, "createTvcAppResult": { "appId": "", "manifestSetId": "", "manifestSetOperatorIds": [ "" ], "manifestSetThreshold": "" }, "createTvcDeploymentResult": { "deploymentId": "", "manifestId": "" }, "createTvcManifestApprovalsResult": { "approvalIds": [ "" ] }, "solSendTransactionResult": { "sendTransactionStatusId": "" }, "initOtpResultV2": { "otpId": "", "otpEncryptionTargetBundle": "" }, "updateOrganizationNameResult": { "organizationId": "", "organizationName": "" }, "createSubOrganizationResultV8": { "subOrganizationId": "", "wallet": { "walletId": "", "addresses": [ "" ] }, "rootUserIds": [ "" ] }, "createOauthProvidersResultV2": { "providerIds": [ "" ] }, "createWebhookEndpointResult": { "endpointId": "", "webhookEndpoint": { "endpointId": "", "organizationId": "", "url": "", "name": "", "isActive": "", "subscriptions": [ { "eventType": "", "filtersJson": "", "isActive": "" } ] } }, "updateWebhookEndpointResult": { "endpointId": "", "webhookEndpoint": { "endpointId": "", "organizationId": "", "url": "", "name": "", "isActive": "", "subscriptions": [ { "eventType": "", "filtersJson": "", "isActive": "" } ] } }, "deleteWebhookEndpointResult": { "endpointId": "" }, "setIpAllowlistResult": "", "removeIpAllowlistResult": "", "updateTvcAppLiveDeploymentResult": "", "deleteTvcDeploymentResult": { "deploymentId": "" }, "deleteTvcAppAndDeploymentsResult": { "appId": "" }, "restoreTvcDeploymentResult": { "deploymentId": "" }, "sparkSignFrostResult": { "signatures": [ { "signatureShare": "", "hiding": "", "binding": "" } ] }, "sparkPrepareTransferResult": { "operatorPackages": [ { "operatorId": "", "encryptedPackage": "" } ], "transferUserSignature": "", "newLeafPublicKeys": [ { "leafId": "", "publicKey": "" } ] }, "sparkClaimTransferResult": { "operatorPackages": [ { "operatorId": "", "encryptedPackage": "" } ], "newLeafPublicKeys": [ { "leafId": "", "publicKey": "" } ] }, "sparkPrepareLightningReceiveResult": { "operatorPackages": [ { "operatorId": "", "encryptedPackage": "" } ], "paymentHash": "" }, "postTvcQuorumKeyShareResult": { "provisioningShareId": "" }, "ethSendTransactionResultV2": { "sendTransactionStatusId": "" }, "createMfaPolicyResult": { "mfaPolicyId": "" }, "updateMfaPolicyResult": { "mfaPolicyId": "" }, "deleteMfaPolicyResult": { "mfaPolicyId": "" }, "createSessionProfileResult": { "sessionProfileId": "" } }, "votes": [ { "id": "", "userId": "", "user": { "userId": "", "userName": "", "userEmail": "", "userPhoneNumber": "", "authenticators": [ { "transports": [ "" ], "attestationType": "", "aaguid": "", "credentialId": "", "model": "", "credential": { "publicKey": "", "type": "", "sessionProfileId": "" }, "authenticatorId": "", "authenticatorName": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } } ], "apiKeys": [ { "credential": { "publicKey": "", "type": "", "sessionProfileId": "" }, "apiKeyId": "", "apiKeyName": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" }, "expirationSeconds": "" } ], "userTags": [ "" ], "oauthProviders": [ { "providerId": "", "providerName": "", "issuer": "", "audience": "", "subject": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } } ], "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" }, "mfaPolicies": [ { "mfaPolicyId": "", "mfaPolicyName": "", "condition": "", "requiredAuthenticationMethods": [ { "any": [ { "type": "", "id": "" } ] } ], "order": "", "notes": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } } ] }, "activityId": "", "selection": "", "message": "", "publicKey": "", "signature": "", "scheme": "", "createdAt": { "seconds": "", "nanos": "" } } ], "appProofs": [ { "scheme": "", "publicKey": "", "proofPayload": "", "signature": "" } ], "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" }, "failure": { "code": "", "message": "", "details": [ { "@type": "" } ] } } } ``` # Get API key Source: https://docs.turnkey.com/api-reference/queries/get-api-key Get details about an API key. Unique identifier for a given organization. Unique identifier for a given API key. A successful response returns the following fields: apiKey field credential field The public component of a cryptographic key pair used to sign messages and transactions. type field Enum options: `CREDENTIAL_TYPE_WEBAUTHN_AUTHENTICATOR`, `CREDENTIAL_TYPE_API_KEY_P256`, `CREDENTIAL_TYPE_RECOVER_USER_KEY_P256`, `CREDENTIAL_TYPE_API_KEY_SECP256K1`, `CREDENTIAL_TYPE_EMAIL_AUTH_KEY_P256`, `CREDENTIAL_TYPE_API_KEY_ED25519`, `CREDENTIAL_TYPE_OTP_AUTH_KEY_P256`, `CREDENTIAL_TYPE_READ_WRITE_SESSION_KEY_P256`, `CREDENTIAL_TYPE_OAUTH_KEY_P256`, `CREDENTIAL_TYPE_LOGIN` The session profile associated with this credential, if any. This field is only applicable for credentials of type CREDENTIAL\_TYPE\_LOGIN. Unique identifier for a given API Key. Human-readable name for an API Key. createdAt field seconds field nanos field updatedAt field seconds field nanos field Optional window (in seconds) indicating how long the API Key should last. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/get_api_key \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "", "apiKeyId": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getApiKey({ organizationId: " (Unique identifier for a given organization.)", apiKeyId: " (Unique identifier for a given API key.)" }); ``` ```json 200 theme={"system"} { "apiKey": { "credential": { "publicKey": "", "type": "", "sessionProfileId": "" }, "apiKeyId": "", "apiKeyName": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" }, "expirationSeconds": "" } } ``` # Get API keys Source: https://docs.turnkey.com/api-reference/queries/get-api-keys Get details about API keys for a user. Unique identifier for a given organization. Unique identifier for a given user. A successful response returns the following fields: A list of API keys. credential field The public component of a cryptographic key pair used to sign messages and transactions. type field Enum options: `CREDENTIAL_TYPE_WEBAUTHN_AUTHENTICATOR`, `CREDENTIAL_TYPE_API_KEY_P256`, `CREDENTIAL_TYPE_RECOVER_USER_KEY_P256`, `CREDENTIAL_TYPE_API_KEY_SECP256K1`, `CREDENTIAL_TYPE_EMAIL_AUTH_KEY_P256`, `CREDENTIAL_TYPE_API_KEY_ED25519`, `CREDENTIAL_TYPE_OTP_AUTH_KEY_P256`, `CREDENTIAL_TYPE_READ_WRITE_SESSION_KEY_P256`, `CREDENTIAL_TYPE_OAUTH_KEY_P256`, `CREDENTIAL_TYPE_LOGIN` The session profile associated with this credential, if any. This field is only applicable for credentials of type CREDENTIAL\_TYPE\_LOGIN. Unique identifier for a given API Key. Human-readable name for an API Key. createdAt field seconds field nanos field updatedAt field seconds field nanos field Optional window (in seconds) indicating how long the API Key should last. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/get_api_keys \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "", "userId": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getApiKeys({ organizationId: " (Unique identifier for a given organization.)", userId: " (Unique identifier for a given user.)" }); ``` ```json 200 theme={"system"} { "apiKeys": [ { "credential": { "publicKey": "", "type": "", "sessionProfileId": "" }, "apiKeyId": "", "apiKeyName": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" }, "expirationSeconds": "" } ] } ``` # Get authenticator Source: https://docs.turnkey.com/api-reference/queries/get-authenticator Get details about an authenticator. Unique identifier for a given organization. Unique identifier for a given authenticator. A successful response returns the following fields: authenticator field Types of transports that may be used by an Authenticator (e.g., USB, NFC, BLE). item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` attestationType field Identifier indicating the type of the Security Key. Unique identifier for a WebAuthn credential. The type of Authenticator device. credential field The public component of a cryptographic key pair used to sign messages and transactions. type field Enum options: `CREDENTIAL_TYPE_WEBAUTHN_AUTHENTICATOR`, `CREDENTIAL_TYPE_API_KEY_P256`, `CREDENTIAL_TYPE_RECOVER_USER_KEY_P256`, `CREDENTIAL_TYPE_API_KEY_SECP256K1`, `CREDENTIAL_TYPE_EMAIL_AUTH_KEY_P256`, `CREDENTIAL_TYPE_API_KEY_ED25519`, `CREDENTIAL_TYPE_OTP_AUTH_KEY_P256`, `CREDENTIAL_TYPE_READ_WRITE_SESSION_KEY_P256`, `CREDENTIAL_TYPE_OAUTH_KEY_P256`, `CREDENTIAL_TYPE_LOGIN` The session profile associated with this credential, if any. This field is only applicable for credentials of type CREDENTIAL\_TYPE\_LOGIN. Unique identifier for a given Authenticator. Human-readable name for an Authenticator. createdAt field seconds field nanos field updatedAt field seconds field nanos field ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/get_authenticator \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "", "authenticatorId": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getAuthenticator({ organizationId: " (Unique identifier for a given organization.)", authenticatorId: " (Unique identifier for a given authenticator.)" }); ``` ```json 200 theme={"system"} { "authenticator": { "transports": [ "" ], "attestationType": "", "aaguid": "", "credentialId": "", "model": "", "credential": { "publicKey": "", "type": "", "sessionProfileId": "" }, "authenticatorId": "", "authenticatorName": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } } } ``` # Get authenticators Source: https://docs.turnkey.com/api-reference/queries/get-authenticators Get details about authenticators for a user. Unique identifier for a given organization. Unique identifier for a given user. A successful response returns the following fields: A list of authenticators. Types of transports that may be used by an Authenticator (e.g., USB, NFC, BLE). item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` attestationType field Identifier indicating the type of the Security Key. Unique identifier for a WebAuthn credential. The type of Authenticator device. credential field The public component of a cryptographic key pair used to sign messages and transactions. type field Enum options: `CREDENTIAL_TYPE_WEBAUTHN_AUTHENTICATOR`, `CREDENTIAL_TYPE_API_KEY_P256`, `CREDENTIAL_TYPE_RECOVER_USER_KEY_P256`, `CREDENTIAL_TYPE_API_KEY_SECP256K1`, `CREDENTIAL_TYPE_EMAIL_AUTH_KEY_P256`, `CREDENTIAL_TYPE_API_KEY_ED25519`, `CREDENTIAL_TYPE_OTP_AUTH_KEY_P256`, `CREDENTIAL_TYPE_READ_WRITE_SESSION_KEY_P256`, `CREDENTIAL_TYPE_OAUTH_KEY_P256`, `CREDENTIAL_TYPE_LOGIN` The session profile associated with this credential, if any. This field is only applicable for credentials of type CREDENTIAL\_TYPE\_LOGIN. Unique identifier for a given Authenticator. Human-readable name for an Authenticator. createdAt field seconds field nanos field updatedAt field seconds field nanos field ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/get_authenticators \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "", "userId": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getAuthenticators({ organizationId: " (Unique identifier for a given organization.)", userId: " (Unique identifier for a given user.)" }); ``` ```json 200 theme={"system"} { "authenticators": [ { "transports": [ "" ], "attestationType": "", "aaguid": "", "credentialId": "", "model": "", "credential": { "publicKey": "", "type": "", "sessionProfileId": "" }, "authenticatorId": "", "authenticatorName": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } } ] } ``` # Get balances Source: https://docs.turnkey.com/api-reference/queries/get-balances Get balances of supported assets for an address on the specified network. Only non-zero balances are returned. Unique identifier for a given organization. Address corresponding to a wallet account. Private key addresses are not supported. Enum options: `eip155:1`, `eip155:11155111`, `eip155:8453`, `eip155:84532`, `eip155:137`, `eip155:80002`, `eip155:42161`, `eip155:4217`, `eip155:42431`, `eip155:421614`, `eip155:56`, `eip155:97`, `solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp`, `solana:EtWTRABZaYq6iMfeYKouRu166VU2xqa1` A successful response returns the following fields: List of asset balances The caip-19 asset identifier The asset symbol The balance in atomic units The number of decimals this asset uses display field USD value for display purposes only. Do not do any arithmetic or calculations with these, as the results could be imprecise. Normalized crypto value for display purposes only. Do not do any arithmetic or calculations with these, as the results could be imprecise. The asset name ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/get_wallet_address_balances \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "", "address": "", "caip2": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getWalletAddressBalances({ organizationId: " (Unique identifier for a given organization.)", address: " (Address corresponding to a wallet account. Private key addresses are not supported.)", caip2: "" // CAIP-2 chain ID (e.g., 'eip155:1' for Ethereum mainnet or 'solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp' for Solana mainnet). Human-readable Solana aliases ('solana:mainnet', 'solana:devnet') are also accepted and normalized to canonical CAIP-2 values. }); ``` ```json 200 theme={"system"} { "balances": [ { "caip19": "", "symbol": "", "balance": "", "decimals": "", "display": { "usd": "", "crypto": "" }, "name": "" } ] } ``` # Get configs Source: https://docs.turnkey.com/api-reference/queries/get-configs Get quorum settings and features for an organization. Unique identifier for a given organization. A successful response returns the following fields: configs field features field name field Enum options: `FEATURE_NAME_ROOT_USER_EMAIL_RECOVERY`, `FEATURE_NAME_WEBAUTHN_ORIGINS`, `FEATURE_NAME_EMAIL_AUTH`, `FEATURE_NAME_EMAIL_RECOVERY`, `FEATURE_NAME_WEBHOOK`, `FEATURE_NAME_SMS_AUTH`, `FEATURE_NAME_OTP_EMAIL_AUTH`, `FEATURE_NAME_AUTH_PROXY`, `FEATURE_NAME_SOLANA_RENT_PREFUND_ENABLED` value field quorum field Count of unique approvals required to meet quorum. Unique identifiers of quorum set members. item field ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/get_organization_configs \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getOrganizationConfigs({ organizationId: " (Unique identifier for a given organization.)" }); ``` ```json 200 theme={"system"} { "configs": { "features": [ { "name": "", "value": "" } ], "quorum": { "threshold": "", "userIds": [ "" ] } } } ``` # Get gas usage Source: https://docs.turnkey.com/api-reference/queries/get-gas-usage Get gas usage and gas limits for either the parent organization or a sub-organization. Unique identifier for a given Organization. A successful response returns the following fields: The window duration (in minutes) for the organization or sub-organization. The window limit (in USD) for the organization or sub-organization. The total gas usage (in USD) of all sponsored transactions processed over the last `window_duration_minutes` ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/get_gas_usage \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getGasUsage({ organizationId: " (Unique identifier for a given Organization.)" }); ``` ```json 200 theme={"system"} { "windowDurationMinutes": "", "windowLimitUsd": "", "usageUsd": "" } ``` # Get IP Allowlist Source: https://docs.turnkey.com/api-reference/queries/get-ip-allowlist Get IP allowlist and rules for an organization. Unique identifier for a given organization. If provided, return only the allowlist for this specific API key. A successful response returns the following fields: allowlist field Unique identifier for the organization this allowlist belongs to. List of IP allowlist rules with their metadata. CIDR block (e.g., '192.168.1.0/24'). Optional human-readable label for this rule. Creation timestamp as millisecond epoch string. Public key of the API key this allowlist applies to. Null means the allowlist applies to the entire organization. Whether the IP allowlist is enabled. Only present for organization-level allowlists. Null for API key-level allowlists (presence of the allowlist implies enablement). Behavior when an error occurs during IP allowlist evaluation. Valid values: ALLOW, DENY. Defaults to DENY. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/get_ip_allowlist \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "", "publicKey": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getIpAllowlist({ organizationId: " (Unique identifier for a given organization.)", publicKey: " (If provided, return only the allowlist for this specific API key.)" }); ``` ```json 200 theme={"system"} { "allowlist": { "organizationId": "", "rules": [ { "cidr": "", "label": "", "createdAt": "" } ], "publicKey": "", "enabled": "", "onEvaluationError": "" } } ``` # Get MFA policies Source: https://docs.turnkey.com/api-reference/queries/get-mfa-policies Get all MFA policies for a user. Unique identifier for a given organization. Unique identifier for a given user. A successful response returns the following fields: A list of multi-factor authentication policies for a user. Unique identifier for a given MFA Policy. Human-readable name for an MFA Policy. A condition expression that evaluates to true or false, determining when this MFA policy applies. An ordered list of authentication requirements. Each requirement must be satisfied sequentially to complete MFA. A list of authentication methods for this MFA step. If only one method is provided, it is required. If multiple are provided, the user must satisfy ANY one of them. type field Enum options: `AUTHENTICATION_TYPE_EMAIL_OTP`, `AUTHENTICATION_TYPE_SMS_OTP`, `AUTHENTICATION_TYPE_PASSKEY`, `AUTHENTICATION_TYPE_API_KEY`, `AUTHENTICATION_TYPE_OAUTH`, `AUTHENTICATION_TYPE_SESSION` Optional specific authenticator ID required (e.g., for requiring a specific session profile id) The order in which this policy is evaluated relative to other MFA policies. Optional human-readable notes added by a User to describe a particular MFA policy. createdAt field seconds field nanos field updatedAt field seconds field nanos field ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/get_mfa_policies \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "", "userId": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getMfaPolicies({ organizationId: " (Unique identifier for a given organization.)", userId: " (Unique identifier for a given user.)" }); ``` ```json 200 theme={"system"} { "mfaPolicies": [ { "mfaPolicyId": "", "mfaPolicyName": "", "condition": "", "requiredAuthenticationMethods": [ { "any": [ { "type": "", "id": "" } ] } ], "order": "", "notes": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } } ] } ``` # Get MFA policy Source: https://docs.turnkey.com/api-reference/queries/get-mfa-policy Get a single MFA policy for a user. Unique identifier for a given organization. Unique identifier for a given user. Unique identifier for a given MFA policy. A successful response returns the following fields: mfaPolicy field Unique identifier for a given MFA Policy. Human-readable name for an MFA Policy. A condition expression that evaluates to true or false, determining when this MFA policy applies. An ordered list of authentication requirements. Each requirement must be satisfied sequentially to complete MFA. A list of authentication methods for this MFA step. If only one method is provided, it is required. If multiple are provided, the user must satisfy ANY one of them. type field Enum options: `AUTHENTICATION_TYPE_EMAIL_OTP`, `AUTHENTICATION_TYPE_SMS_OTP`, `AUTHENTICATION_TYPE_PASSKEY`, `AUTHENTICATION_TYPE_API_KEY`, `AUTHENTICATION_TYPE_OAUTH`, `AUTHENTICATION_TYPE_SESSION` Optional specific authenticator ID required (e.g., for requiring a specific session profile id) The order in which this policy is evaluated relative to other MFA policies. Optional human-readable notes added by a User to describe a particular MFA policy. createdAt field seconds field nanos field updatedAt field seconds field nanos field ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/get_mfa_policy \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "", "userId": "", "mfaPolicyId": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getMfaPolicy({ organizationId: " (Unique identifier for a given organization.)", userId: " (Unique identifier for a given user.)", mfaPolicyId: " (Unique identifier for a given MFA policy.)" }); ``` ```json 200 theme={"system"} { "mfaPolicy": { "mfaPolicyId": "", "mfaPolicyName": "", "condition": "", "requiredAuthenticationMethods": [ { "any": [ { "type": "", "id": "" } ] } ], "order": "", "notes": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } } } ``` # Get MFA status Source: https://docs.turnkey.com/api-reference/queries/get-mfa-status Get the MFA status of an activity for a specific user or all voting users. Unique identifier for a given organization. The unique identifier of the activity to get MFA status for. Optional user ID to filter MFA status for a specific user. A successful response returns the following fields: A list of MFA statuses for the activity's votes. Unique identifier for a given MFA Policy. Unique identifier for a given User. Whether the MFA policy requirements are currently satisfied. A list of authentication methods already satisfied for this MFA policy. type field Enum options: `AUTHENTICATION_TYPE_EMAIL_OTP`, `AUTHENTICATION_TYPE_SMS_OTP`, `AUTHENTICATION_TYPE_PASSKEY`, `AUTHENTICATION_TYPE_API_KEY`, `AUTHENTICATION_TYPE_OAUTH`, `AUTHENTICATION_TYPE_SESSION` Optional specific authenticator ID required (e.g., for requiring a specific session profile id) An ordered list of authentication requirements needed to satisfy this MFA policy. A list of authentication methods for this MFA step. If only one method is provided, it is required. If multiple are provided, the user must satisfy ANY one of them. type field Enum options: `AUTHENTICATION_TYPE_EMAIL_OTP`, `AUTHENTICATION_TYPE_SMS_OTP`, `AUTHENTICATION_TYPE_PASSKEY`, `AUTHENTICATION_TYPE_API_KEY`, `AUTHENTICATION_TYPE_OAUTH`, `AUTHENTICATION_TYPE_SESSION` Optional specific authenticator ID required (e.g., for requiring a specific session profile id) ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/get_mfa_status \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "", "activityId": "", "userId": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getMfaStatus({ organizationId: " (Unique identifier for a given organization.)", activityId: " (The unique identifier of the activity to get MFA status for.)", userId: " (Optional user ID to filter MFA status for a specific user.)" }); ``` ```json 200 theme={"system"} { "mfaStatuses": [ { "mfaPolicyId": "", "userId": "", "satisfied": "", "satisfiedMethods": [ { "type": "", "id": "" } ], "requiredMethods": [ { "any": [ { "type": "", "id": "" } ] } ] } ] } ``` # Get nonces Source: https://docs.turnkey.com/api-reference/queries/get-nonces Get nonce values for an address on a given network. Can fetch the standard on-chain nonce and/or the gas station nonce used for sponsored transactions. Unique identifier for a given Organization. The Ethereum address to query nonces for. Enum options: `eip155:1`, `eip155:11155111`, `eip155:8453`, `eip155:84532`, `eip155:137`, `eip155:80002`, `eip155:56`, `eip155:97` Whether to fetch the standard on-chain nonce. Whether to fetch the gas station nonce used for sponsored transactions. A successful response returns the following fields: The standard on-chain nonce for the address, if requested. The gas station nonce for sponsored transactions, if requested. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/get_nonces \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "", "address": "", "caip2": "", "nonce": "", "gasStationNonce": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getNonces({ organizationId: " (Unique identifier for a given Organization.)", address: " (The Ethereum address to query nonces for.)", caip2: "" // CAIP-2 chain ID (e.g., 'eip155:1' for Ethereum mainnet)., nonce: true // Whether to fetch the standard on-chain nonce., gasStationNonce: true // Whether to fetch the gas station nonce used for sponsored transactions. }); ``` ```json 200 theme={"system"} { "nonce": "", "gasStationNonce": "" } ``` # Get OAuth 2.0 credential Source: https://docs.turnkey.com/api-reference/queries/get-oauth-20-credential Get details about an OAuth 2.0 credential. Unique identifier for a given Organization. Unique identifier for a given OAuth 2.0 Credential. A successful response returns the following fields: oauth2Credential field Unique identifier for a given OAuth 2.0 Credential. Unique identifier for an Organization. provider field Enum options: `OAUTH2_PROVIDER_X`, `OAUTH2_PROVIDER_DISCORD` The client id for a given OAuth 2.0 Credential. The encrypted client secret for a given OAuth 2.0 Credential encrypted to the TLS Fetcher quorum key. createdAt field seconds field nanos field updatedAt field seconds field nanos field ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/get_oauth2_credential \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "", "oauth2CredentialId": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getOauth2Credential({ organizationId: " (Unique identifier for a given Organization.)", oauth2CredentialId: " (Unique identifier for a given OAuth 2.0 Credential.)" }); ``` ```json 200 theme={"system"} { "oauth2Credential": { "oauth2CredentialId": "", "organizationId": "", "provider": "", "clientId": "", "encryptedClientSecret": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } } } ``` # Get Oauth providers Source: https://docs.turnkey.com/api-reference/queries/get-oauth-providers Get details about Oauth providers for a user. Unique identifier for a given organization. Unique identifier for a given user. A successful response returns the following fields: A list of Oauth providers. Unique identifier for an OAuth Provider Human-readable name to identify a Provider. The issuer of the token, typically a URL indicating the authentication server, e.g [https://accounts.google.com](https://accounts.google.com) Expected audience ('aud' attribute of the signed token) which represents the app ID Expected subject ('sub' attribute of the signed token) which represents the user ID createdAt field seconds field nanos field updatedAt field seconds field nanos field ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/get_oauth_providers \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "", "userId": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getOauthProviders({ organizationId: " (Unique identifier for a given organization.)", userId: " (Unique identifier for a given user.)" }); ``` ```json 200 theme={"system"} { "oauthProviders": [ { "providerId": "", "providerName": "", "issuer": "", "audience": "", "subject": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } } ] } ``` # Get On Ramp transaction status Source: https://docs.turnkey.com/api-reference/queries/get-on-ramp-transaction-status Get the status of an on ramp transaction. Unique identifier for a given organization. The unique identifier for the fiat on ramp transaction. Optional flag to specify if the transaction status should be refreshed from the fiat on ramp provider. Default = false. A successful response returns the following fields: The status of the fiat on ramp transaction. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/get_onramp_transaction_status \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "", "transactionId": "", "refresh": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getOnRampTransactionStatus({ organizationId: " (Unique identifier for a given organization.)", transactionId: " (The unique identifier for the fiat on ramp transaction.)", refresh: true // Optional flag to specify if the transaction status should be refreshed from the fiat on ramp provider. Default = false. }); ``` ```json 200 theme={"system"} { "transactionStatus": "" } ``` # Get policy Source: https://docs.turnkey.com/api-reference/queries/get-policy Get details about a policy. Unique identifier for a given organization. Unique identifier for a given policy. A successful response returns the following fields: policy field Unique identifier for a given Policy. Human-readable name for a Policy. effect field Enum options: `EFFECT_ALLOW`, `EFFECT_DENY` createdAt field seconds field nanos field updatedAt field seconds field nanos field Human-readable notes added by a User to describe a particular policy. A consensus expression that evalutes to true or false. A condition expression that evalutes to true or false. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/get_policy \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "", "policyId": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getPolicy({ organizationId: " (Unique identifier for a given organization.)", policyId: " (Unique identifier for a given policy.)" }); ``` ```json 200 theme={"system"} { "policy": { "policyId": "", "policyName": "", "effect": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" }, "notes": "", "consensus": "", "condition": "" } } ``` # Get policy evaluations Source: https://docs.turnkey.com/api-reference/queries/get-policy-evaluations Get the policy evaluations for an activity. Unique identifier for a given organization. Unique identifier for a given activity. A successful response returns the following fields: policyEvaluations field Unique identifier for a given policy evaluation. Unique identifier for a given Activity. Unique identifier for the Organization the Activity belongs to. Unique identifier for the Vote associated with this policy evaluation. Detailed evaluation result for each Policy that was run. policyId field outcome field Enum options: `OUTCOME_ALLOW`, `OUTCOME_DENY_EXPLICIT`, `OUTCOME_DENY_IMPLICIT`, `OUTCOME_REQUIRES_CONSENSUS`, `OUTCOME_REJECTED`, `OUTCOME_ERROR`, `OUTCOME_REQUIRES_AUTHENTICATORS` createdAt field seconds field nanos field ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/get_policy_evaluations \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "", "activityId": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getPolicyEvaluations({ organizationId: " (Unique identifier for a given organization.)", activityId: " (Unique identifier for a given activity.)" }); ``` ```json 200 theme={"system"} { "policyEvaluations": [ { "id": "", "activityId": "", "organizationId": "", "voteId": "", "policyEvaluations": [ { "policyId": "", "outcome": "" } ], "createdAt": { "seconds": "", "nanos": "" } } ] } ``` # Get private key Source: https://docs.turnkey.com/api-reference/queries/get-private-key Get details about a private key. Unique identifier for a given organization. Unique identifier for a given private key. A successful response returns the following fields: privateKey field Unique identifier for a given Private Key. The public component of a cryptographic key pair used to sign messages and transactions. Human-readable name for a Private Key. curve field Enum options: `CURVE_SECP256K1`, `CURVE_ED25519`, `CURVE_P256` Derived cryptocurrency addresses for a given Private Key. format field Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` address field A list of Private Key Tag IDs. item field createdAt field seconds field nanos field updatedAt field seconds field nanos field True when a given Private Key is exported, false otherwise. True when a given Private Key is imported, false otherwise. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/get_private_key \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "", "privateKeyId": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getPrivateKey({ organizationId: " (Unique identifier for a given organization.)", privateKeyId: " (Unique identifier for a given private key.)" }); ``` ```json 200 theme={"system"} { "privateKey": { "privateKeyId": "", "publicKey": "", "privateKeyName": "", "curve": "", "addresses": [ { "format": "", "address": "" } ], "privateKeyTags": [ "" ], "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" }, "exported": "", "imported": "" } } ``` # Get send transaction status Source: https://docs.turnkey.com/api-reference/queries/get-send-transaction-status Get the status of a send transaction request. Unique identifier for a given organization. The unique identifier of a send transaction request. A successful response returns the following fields: The current status of the send transaction. eth field The Ethereum transaction hash, if available. solana field The Solana transaction signature, if available. The error encountered when broadcasting or confirming the transaction, if any. error field Human-readable error message describing what went wrong. Chain of revert errors from nested contract calls, ordered from outermost to innermost. The contract address where the revert occurred. Type of error: 'unknown', 'native', or 'custom'. Human-readable message describing this revert. unknown field The 4-byte error selector, if available. The raw error data, hex-encoded. native field The type of native error: 'error\_string', 'panic', or 'execution\_reverted'. The error message for Error(string) reverts. The panic code for Panic(uint256) reverts. custom field The name of the custom error. The decoded parameters as a JSON object. solana field Where the Solana failure occurred, such as simulation or preflight. The Solana JSON-RPC error code, if available. The Solana JSON-RPC error message, if available. The raw Solana transaction error object serialized as JSON, if available. Program logs returned by Solana simulation or preflight, if available. item field Compute units consumed during simulation or preflight, if available. The raw Solana inner instructions payload serialized as JSON, if available. eth field Ethereum revert chain, ordered from outermost to innermost. The contract address where the revert occurred. Type of error: 'unknown', 'native', or 'custom'. Human-readable message describing this revert. unknown field The 4-byte error selector, if available. The raw error data, hex-encoded. native field The type of native error: 'error\_string', 'panic', or 'execution\_reverted'. The error message for Error(string) reverts. The panic code for Panic(uint256) reverts. custom field The name of the custom error. The decoded parameters as a JSON object. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/get_send_transaction_status \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "", "sendTransactionStatusId": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getSendTransactionStatus({ organizationId: " (Unique identifier for a given organization.)", sendTransactionStatusId: " (The unique identifier of a send transaction request.)" }); ``` ```json 200 theme={"system"} { "txStatus": "", "eth": { "txHash": "" }, "solana": { "signature": "" }, "txError": "", "error": { "message": "", "revertChain": [ { "address": "", "errorType": "", "displayMessage": "", "unknown": { "selector": "", "data": "" }, "native": { "nativeType": "", "message": "", "panicCode": "" }, "custom": { "errorName": "", "paramsJson": "" } } ], "solana": { "source": "", "rpcCode": "", "rpcMessage": "", "transactionErrorJson": "", "logs": [ "" ], "unitsConsumed": "", "innerInstructionsJson": "" }, "eth": { "revertChain": [ { "address": "", "errorType": "", "displayMessage": "", "unknown": { "selector": "", "data": "" }, "native": { "nativeType": "", "message": "", "panicCode": "" }, "custom": { "errorName": "", "paramsJson": "" } } ] } } } ``` # Get session profile Source: https://docs.turnkey.com/api-reference/queries/get-session-profile Get a single session profile for an organization. Unique identifier for a given organization. Unique identifier for a session profile. A successful response returns the following fields: sessionProfile field Unique identifier for a given Session Profile. Human-readable name for a Session Profile. The specific scope that a session created with this profile is limited to. Optional window (in seconds) indicating how long sessions created with this profile should last. Optional human-readable notes added by a User to describe a particular Session Profile. createdAt field seconds field nanos field updatedAt field seconds field nanos field ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/get_session_profile \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "", "sessionProfileId": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getSessionProfile({ organizationId: " (Unique identifier for a given organization.)", sessionProfileId: " (Unique identifier for a session profile.)" }); ``` ```json 200 theme={"system"} { "sessionProfile": { "sessionProfileId": "", "sessionProfileName": "", "scope": "", "expirationSeconds": "", "notes": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } } } ``` # Get session profiles Source: https://docs.turnkey.com/api-reference/queries/get-session-profiles Get all session profiles for an organization. Unique identifier for a given organization. A successful response returns the following fields: A list of session profiles for users in the organization. Unique identifier for a given Session Profile. Human-readable name for a Session Profile. The specific scope that a session created with this profile is limited to. Optional window (in seconds) indicating how long sessions created with this profile should last. Optional human-readable notes added by a User to describe a particular Session Profile. createdAt field seconds field nanos field updatedAt field seconds field nanos field ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/get_session_profiles \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getSessionProfiles({ organizationId: " (Unique identifier for a given organization.)" }); ``` ```json 200 theme={"system"} { "sessionProfiles": [ { "sessionProfileId": "", "sessionProfileName": "", "scope": "", "expirationSeconds": "", "notes": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } } ] } ``` # Get smart contract interface Source: https://docs.turnkey.com/api-reference/queries/get-smart-contract-interface Get details about a smart contract interface. Unique identifier for a given organization. Unique identifier for a given smart contract interface. A successful response returns the following fields: smartContractInterface field The Organization the Smart Contract Interface belongs to. Unique identifier for a given Smart Contract Interface (ABI or IDL). The address corresponding to the Smart Contract or Program. The JSON corresponding to the Smart Contract Interface (ABI or IDL). The type corresponding to the Smart Contract Interface (either ETHEREUM or SOLANA). The label corresponding to the Smart Contract Interface (either ETHEREUM or SOLANA). The notes corresponding to the Smart Contract Interface (either ETHEREUM or SOLANA). createdAt field seconds field nanos field updatedAt field seconds field nanos field ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/get_smart_contract_interface \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "", "smartContractInterfaceId": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getSmartContractInterface({ organizationId: " (Unique identifier for a given organization.)", smartContractInterfaceId: " (Unique identifier for a given smart contract interface.)" }); ``` ```json 200 theme={"system"} { "smartContractInterface": { "organizationId": "", "smartContractInterfaceId": "", "smartContractAddress": "", "smartContractInterface": "", "type": "", "label": "", "notes": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } } } ``` # Get sub-organizations Source: https://docs.turnkey.com/api-reference/queries/get-sub-organizations Get all suborg IDs associated given a parent org ID and an optional filter. Unique identifier for the parent organization. This is used to find sub-organizations within it. Specifies the type of filter to apply, i.e 'CREDENTIAL\_ID', 'NAME', 'USERNAME', 'EMAIL', 'PHONE\_NUMBER', 'OIDC\_TOKEN', 'WALLET\_ACCOUNT\_ADDRESS' or 'PUBLIC\_KEY' The value of the filter to apply for the specified type. For example, a specific email or name string.

paginationOptions field

A limit of the number of object to be returned, between 1 and 100. Defaults to 10. A pagination cursor. This is an object ID that enables you to fetch all objects before this ID. A pagination cursor. This is an object ID that enables you to fetch all objects after this ID. A successful response returns the following fields: List of unique identifiers for the matching sub-organizations. item field ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/list_suborgs \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "", "filterType": "", "filterValue": "", "paginationOptions": { "limit": "", "before": "", "after": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getSubOrgIds({ organizationId: " (Unique identifier for the parent organization. This is used to find sub-organizations within it.)", filterType: " (Specifies the type of filter to apply, i.e 'CREDENTIAL_ID', 'NAME', 'USERNAME', 'EMAIL', 'PHONE_NUMBER', 'OIDC_TOKEN', 'WALLET_ACCOUNT_ADDRESS' or 'PUBLIC_KEY')", filterValue: " (The value of the filter to apply for the specified type. For example, a specific email or name string.)", paginationOptions: { // paginationOptions field, limit: " (A limit of the number of object to be returned, between 1 and 100. Defaults to 10.)", before: " (A pagination cursor. This is an object ID that enables you to fetch all objects before this ID.)", after: " (A pagination cursor. This is an object ID that enables you to fetch all objects after this ID.)", } }); ``` ```json 200 theme={"system"} { "organizationIds": [ "" ] } ``` # Get the latest boot proof for an app Source: https://docs.turnkey.com/api-reference/queries/get-the-latest-boot-proof-for-an-app Get the latest boot proof for a given enclave app name. Unique identifier for a given Organization. Name of enclave app. A successful response returns the following fields: bootProof field The hex encoded Ephemeral Public Key. The DER encoded COSE Sign1 struct Attestation doc. The base64 encoded QOS manifest. Encoding depends on qos\_manifest\_version. The base64 encoded QOS manifest envelope. Encoding depends on qos\_manifest\_version. The label under which the enclave app was deployed. Name of the enclave app Owner of the app i.e. 'tkhq' createdAt field seconds field nanos field QOS manifest schema version. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/get_latest_boot_proof \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "", "appName": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getLatestBootProof({ organizationId: " (Unique identifier for a given Organization.)", appName: " (Name of enclave app.)" }); ``` ```json 200 theme={"system"} { "bootProof": { "ephemeralPublicKeyHex": "", "awsAttestationDocB64": "", "qosManifestB64": "", "qosManifestEnvelopeB64": "", "deploymentLabel": "", "enclaveApp": "", "owner": "", "createdAt": { "seconds": "", "nanos": "" }, "qosManifestVersion": "" } } ``` # Get TVC App Source: https://docs.turnkey.com/api-reference/queries/get-tvc-app Get details about a single TVC App Unique identifier for a given organization. Unique identifier for a given TVC App. A successful response returns the following fields: tvcApp field Unique Identifier for this TVC App. Unique Identifier of the Organization for this TVC App Name for this TVC App. Public key for the Quorum Key associated with this TVC App manifestSet field Unique Identifier for this TVC Operator Set. Name of this TVC Operator Set. Unique Identifier of the Organization for this TVC Operator Set List of TVC Operators in this set Unique Identifier for this TVC Operator. Name of this TVC Operator. Public key for this TVC Operator. createdAt field seconds field nanos field updatedAt field seconds field nanos field Threshold number of operators required for quorum. createdAt field seconds field nanos field updatedAt field seconds field nanos field shareSet field Unique Identifier for this TVC Operator Set. Name of this TVC Operator Set. Unique Identifier of the Organization for this TVC Operator Set List of TVC Operators in this set Unique Identifier for this TVC Operator. Name of this TVC Operator. Public key for this TVC Operator. createdAt field seconds field nanos field updatedAt field seconds field nanos field Threshold number of operators required for quorum. createdAt field seconds field nanos field updatedAt field seconds field nanos field Whether or not this TVC App has network egress enabled. createdAt field seconds field nanos field updatedAt field seconds field nanos field The deployment currently designated to receive traffic. Null if no deployment for this app is deployed. The public domain for ingress to this TVC App (in the format "app-\.turnkey.cloud"). Whether this app permits debug-mode deployments. Set at app creation via CreateTvcAppIntent.enable\_debug\_mode\_deployments and never updated thereafter. Debug-mode deployments expose logs and emit zero'd attestation PCRs, so remote attestation cannot succeed. The app's quorum key is therefore considered permanently insecure once enabled — a new app with a fresh quorum key must be created to return to a secure posture. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/get_tvc_app \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "", "tvcAppId": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getTvcApp({ organizationId: " (Unique identifier for a given organization.)", tvcAppId: " (Unique identifier for a given TVC App.)" }); ``` ```json 200 theme={"system"} { "tvcApp": { "id": "", "organizationId": "", "name": "", "quorumPublicKey": "", "manifestSet": { "id": "", "name": "", "organizationId": "", "operators": [ { "id": "", "name": "", "publicKey": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } } ], "threshold": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } }, "shareSet": { "id": "", "name": "", "organizationId": "", "operators": [ { "id": "", "name": "", "publicKey": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } } ], "threshold": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } }, "enableEgress": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" }, "liveDeploymentId": "", "publicDomain": "", "enableDebugModeDeployments": "" } } ``` # Get TVC App status Source: https://docs.turnkey.com/api-reference/queries/get-tvc-app-status Get live runtime status for a TVC App from the cluster. Unique identifier for a given Organization. Unique identifier for a given TVC App. A successful response returns the following fields: appStatus field Unique identifier for this TVC App List of deployment statuses for this app Unique identifier for this deployment (corresponds to k8s deployment label) Number of ready replicas Desired number of replicas lastUpdatedTime field seconds field nanos field The deployment ID currently serving traffic for this app ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/get_app_status \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "", "appId": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getAppStatus({ organizationId: " (Unique identifier for a given Organization.)", appId: " (Unique identifier for a given TVC App.)" }); ``` ```json 200 theme={"system"} { "appStatus": { "appId": "", "deployments": [ { "deploymentId": "", "readyReplicas": "", "desiredReplicas": "", "lastUpdatedTime": { "seconds": "", "nanos": "" } } ], "targetedDeploymentId": "" } } ``` # Get TVC Deployment Source: https://docs.turnkey.com/api-reference/queries/get-tvc-deployment Get details about a single TVC Deployment Unique identifier for a given organization. Unique identifier for a given TVC Deployment. A successful response returns the following fields: tvcDeployment field Unique Identifier for this TVC Deployment. Unique Identifier of the Organization for this TVC Deployment Unique Identifier of the TVC App for this deployment manifestSet field Unique Identifier for this TVC Operator Set. Name of this TVC Operator Set. Unique Identifier of the Organization for this TVC Operator Set List of TVC Operators in this set Unique Identifier for this TVC Operator. Name of this TVC Operator. Public key for this TVC Operator. createdAt field seconds field nanos field updatedAt field seconds field nanos field Threshold number of operators required for quorum. createdAt field seconds field nanos field updatedAt field seconds field nanos field shareSet field Unique Identifier for this TVC Operator Set. Name of this TVC Operator Set. Unique Identifier of the Organization for this TVC Operator Set List of TVC Operators in this set Unique Identifier for this TVC Operator. Name of this TVC Operator. Public key for this TVC Operator. createdAt field seconds field nanos field updatedAt field seconds field nanos field Threshold number of operators required for quorum. createdAt field seconds field nanos field updatedAt field seconds field nanos field manifest field Unique Identifier for this TVC Manifest. The manifest content (raw UTF-8 JSON bytes) createdAt field seconds field nanos field updatedAt field seconds field nanos field List of operator approvals for this manifest Unique ID for this approval Unique Identifier of the TVC Manifest being approved operator field Unique Identifier for this TVC Operator. Name of this TVC Operator. Public key for this TVC Operator. createdAt field seconds field nanos field updatedAt field seconds field nanos field Signature of the operator over the deployment manifest createdAt field seconds field nanos field updatedAt field seconds field nanos field QOS Version used for this deployment pivotContainer field The URL for this container image. The path (in-container) to the executable binary. The arguments to pass to the executable. item field Whether or not this container requires a pull secret to access. healthCheckType field Enum options: `TVC_HEALTH_CHECK_TYPE_HTTP`, `TVC_HEALTH_CHECK_TYPE_GRPC` The port to use for health checks against this executable. The port to use for public ingress to this executable. createdAt field seconds field nanos field updatedAt field seconds field nanos field Whether or not the user wants this deployment deleted from the cluster. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/get_tvc_deployment \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "", "deploymentId": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getTvcDeployment({ organizationId: " (Unique identifier for a given organization.)", deploymentId: " (Unique identifier for a given TVC Deployment.)" }); ``` ```json 200 theme={"system"} { "tvcDeployment": { "id": "", "organizationId": "", "appId": "", "manifestSet": { "id": "", "name": "", "organizationId": "", "operators": [ { "id": "", "name": "", "publicKey": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } } ], "threshold": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } }, "shareSet": { "id": "", "name": "", "organizationId": "", "operators": [ { "id": "", "name": "", "publicKey": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } } ], "threshold": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } }, "manifest": { "id": "", "manifest": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } }, "manifestApprovals": [ { "id": "", "manifestId": "", "operator": { "id": "", "name": "", "publicKey": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } }, "approval": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } } ], "qosVersion": "", "pivotContainer": { "containerUrl": "", "path": "", "args": [ "" ], "hasPullSecret": "", "healthCheckType": "", "healthCheckPort": "", "publicIngressPort": "" }, "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" }, "delete": "" } } ``` # Get TVC Deployment debug logs Source: https://docs.turnkey.com/api-reference/queries/get-tvc-deployment-debug-logs Get a bounded window of application logs from a debug-mode TVC deployment. Returned lines are collected from every running replica and sorted by platform timestamp. Unique identifier for a given Organization. Unique identifier for a given TVC Deployment. The deployment must be running in debug mode. Limit returned history to the last N lines per replica. If unset or zero, no tail-line limit is applied. Return logs newer than this many seconds ago. If unset or zero, no since-time limit is applied. Useful for clients that poll to follow logs. A successful response returns the following fields: Application log entries sorted by platform timestamp. line field One log line, exactly as the application printed it (without the trailing newline) ts field seconds field nanos field Public replica label that produced this log line, for example 'replica 2/3'. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/get_tvc_deployment_debug_logs \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "", "deploymentId": "", "tailLines": "", "sinceSeconds": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getTvcDeploymentDebugLogs({ organizationId: " (Unique identifier for a given Organization.)", deploymentId: " (Unique identifier for a given TVC Deployment. The deployment must be running in debug mode.)", tailLines: 0 // Limit returned history to the last N lines per replica. If unset or zero, no tail-line limit is applied., sinceSeconds: " (Return logs newer than this many seconds ago. If unset or zero, no since-time limit is applied. Useful for clients that poll to follow logs.)" }); ``` ```json 200 theme={"system"} { "entries": [ { "line": { "content": "", "ts": { "seconds": "", "nanos": "" } }, "replicaLabel": "" } ] } ``` # Get user Source: https://docs.turnkey.com/api-reference/queries/get-user Get details about a user. Unique identifier for a given organization. Unique identifier for a given user. A successful response returns the following fields: user field Unique identifier for a given User. Human-readable name for a User. The user's email address. The user's phone number in E.164 format e.g. +13214567890 A list of Authenticator parameters. Types of transports that may be used by an Authenticator (e.g., USB, NFC, BLE). item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` attestationType field Identifier indicating the type of the Security Key. Unique identifier for a WebAuthn credential. The type of Authenticator device. credential field The public component of a cryptographic key pair used to sign messages and transactions. type field Enum options: `CREDENTIAL_TYPE_WEBAUTHN_AUTHENTICATOR`, `CREDENTIAL_TYPE_API_KEY_P256`, `CREDENTIAL_TYPE_RECOVER_USER_KEY_P256`, `CREDENTIAL_TYPE_API_KEY_SECP256K1`, `CREDENTIAL_TYPE_EMAIL_AUTH_KEY_P256`, `CREDENTIAL_TYPE_API_KEY_ED25519`, `CREDENTIAL_TYPE_OTP_AUTH_KEY_P256`, `CREDENTIAL_TYPE_READ_WRITE_SESSION_KEY_P256`, `CREDENTIAL_TYPE_OAUTH_KEY_P256`, `CREDENTIAL_TYPE_LOGIN` The session profile associated with this credential, if any. This field is only applicable for credentials of type CREDENTIAL\_TYPE\_LOGIN. Unique identifier for a given Authenticator. Human-readable name for an Authenticator. createdAt field seconds field nanos field updatedAt field seconds field nanos field A list of API Key parameters. This field, if not needed, should be an empty array in your request body. credential field The public component of a cryptographic key pair used to sign messages and transactions. type field Enum options: `CREDENTIAL_TYPE_WEBAUTHN_AUTHENTICATOR`, `CREDENTIAL_TYPE_API_KEY_P256`, `CREDENTIAL_TYPE_RECOVER_USER_KEY_P256`, `CREDENTIAL_TYPE_API_KEY_SECP256K1`, `CREDENTIAL_TYPE_EMAIL_AUTH_KEY_P256`, `CREDENTIAL_TYPE_API_KEY_ED25519`, `CREDENTIAL_TYPE_OTP_AUTH_KEY_P256`, `CREDENTIAL_TYPE_READ_WRITE_SESSION_KEY_P256`, `CREDENTIAL_TYPE_OAUTH_KEY_P256`, `CREDENTIAL_TYPE_LOGIN` The session profile associated with this credential, if any. This field is only applicable for credentials of type CREDENTIAL\_TYPE\_LOGIN. Unique identifier for a given API Key. Human-readable name for an API Key. createdAt field seconds field nanos field updatedAt field seconds field nanos field Optional window (in seconds) indicating how long the API Key should last. A list of User Tag IDs. item field A list of Oauth Providers. Unique identifier for an OAuth Provider Human-readable name to identify a Provider. The issuer of the token, typically a URL indicating the authentication server, e.g [https://accounts.google.com](https://accounts.google.com) Expected audience ('aud' attribute of the signed token) which represents the app ID Expected subject ('sub' attribute of the signed token) which represents the user ID createdAt field seconds field nanos field updatedAt field seconds field nanos field createdAt field seconds field nanos field updatedAt field seconds field nanos field A list of MFA Policies that define multi-factor authentication requirements for this user. Unique identifier for a given MFA Policy. Human-readable name for an MFA Policy. A condition expression that evaluates to true or false, determining when this MFA policy applies. An ordered list of authentication requirements. Each requirement must be satisfied sequentially to complete MFA. A list of authentication methods for this MFA step. If only one method is provided, it is required. If multiple are provided, the user must satisfy ANY one of them. type field Enum options: `AUTHENTICATION_TYPE_EMAIL_OTP`, `AUTHENTICATION_TYPE_SMS_OTP`, `AUTHENTICATION_TYPE_PASSKEY`, `AUTHENTICATION_TYPE_API_KEY`, `AUTHENTICATION_TYPE_OAUTH`, `AUTHENTICATION_TYPE_SESSION` Optional specific authenticator ID required (e.g., for requiring a specific session profile id) The order in which this policy is evaluated relative to other MFA policies. Optional human-readable notes added by a User to describe a particular MFA policy. createdAt field seconds field nanos field updatedAt field seconds field nanos field ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/get_user \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "", "userId": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getUser({ organizationId: " (Unique identifier for a given organization.)", userId: " (Unique identifier for a given user.)" }); ``` ```json 200 theme={"system"} { "user": { "userId": "", "userName": "", "userEmail": "", "userPhoneNumber": "", "authenticators": [ { "transports": [ "" ], "attestationType": "", "aaguid": "", "credentialId": "", "model": "", "credential": { "publicKey": "", "type": "", "sessionProfileId": "" }, "authenticatorId": "", "authenticatorName": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } } ], "apiKeys": [ { "credential": { "publicKey": "", "type": "", "sessionProfileId": "" }, "apiKeyId": "", "apiKeyName": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" }, "expirationSeconds": "" } ], "userTags": [ "" ], "oauthProviders": [ { "providerId": "", "providerName": "", "issuer": "", "audience": "", "subject": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } } ], "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" }, "mfaPolicies": [ { "mfaPolicyId": "", "mfaPolicyName": "", "condition": "", "requiredAuthenticationMethods": [ { "any": [ { "type": "", "id": "" } ] } ], "order": "", "notes": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } } ] } } ``` # Get verified sub-organizations Source: https://docs.turnkey.com/api-reference/queries/get-verified-sub-organizations Get all email or phone verified suborg IDs associated given a parent org ID. Unique identifier for the parent organization. This is used to find sub-organizations within it. Specifies the type of filter to apply, i.e 'EMAIL', 'PHONE\_NUMBER'. The value of the filter to apply for the specified type. For example, a specific email or phone number string.

paginationOptions field

A limit of the number of object to be returned, between 1 and 100. Defaults to 10. A pagination cursor. This is an object ID that enables you to fetch all objects before this ID. A pagination cursor. This is an object ID that enables you to fetch all objects after this ID. A successful response returns the following fields: List of unique identifiers for the matching sub-organizations. item field ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/list_verified_suborgs \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "", "filterType": "", "filterValue": "", "paginationOptions": { "limit": "", "before": "", "after": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getVerifiedSubOrgIds({ organizationId: " (Unique identifier for the parent organization. This is used to find sub-organizations within it.)", filterType: " (Specifies the type of filter to apply, i.e 'EMAIL', 'PHONE_NUMBER'.)", filterValue: " (The value of the filter to apply for the specified type. For example, a specific email or phone number string.)", paginationOptions: { // paginationOptions field, limit: " (A limit of the number of object to be returned, between 1 and 100. Defaults to 10.)", before: " (A pagination cursor. This is an object ID that enables you to fetch all objects before this ID.)", after: " (A pagination cursor. This is an object ID that enables you to fetch all objects after this ID.)", } }); ``` ```json 200 theme={"system"} { "organizationIds": [ "" ] } ``` # Get wallet Source: https://docs.turnkey.com/api-reference/queries/get-wallet Get details about a wallet. Unique identifier for a given organization. Unique identifier for a given wallet. A successful response returns the following fields: wallet field Unique identifier for a given Wallet. Human-readable name for a Wallet. createdAt field seconds field nanos field updatedAt field seconds field nanos field True when a given Wallet is exported, false otherwise. True when a given Wallet is imported, false otherwise. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/get_wallet \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "", "walletId": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getWallet({ organizationId: " (Unique identifier for a given organization.)", walletId: " (Unique identifier for a given wallet.)" }); ``` ```json 200 theme={"system"} { "wallet": { "walletId": "", "walletName": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" }, "exported": "", "imported": "" } } ``` # Get wallet account Source: https://docs.turnkey.com/api-reference/queries/get-wallet-account Get a single wallet account. Unique identifier for a given organization. Unique identifier for a given wallet. Address corresponding to a wallet account. Path corresponding to a wallet account. A successful response returns the following fields: account field Unique identifier for a given Wallet Account. The Organization the Account belongs to. The Wallet the Account was derived from. curve field Enum options: `CURVE_SECP256K1`, `CURVE_ED25519`, `CURVE_P256` pathFormat field Enum options: `PATH_FORMAT_BIP32` Path used to generate the Account. addressFormat field Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` Address generated using the Wallet seed and Account parameters. createdAt field seconds field nanos field updatedAt field seconds field nanos field The public component of this wallet account's underlying cryptographic key pair. walletDetails field Unique identifier for a given Wallet. Human-readable name for a Wallet. createdAt field seconds field nanos field updatedAt field seconds field nanos field True when a given Wallet is exported, false otherwise. True when a given Wallet is imported, false otherwise. Human-readable name for this Wallet Account, unique within the organization. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/get_wallet_account \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "", "walletId": "", "address": "", "path": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getWalletAccount({ organizationId: " (Unique identifier for a given organization.)", walletId: " (Unique identifier for a given wallet.)", address: " (Address corresponding to a wallet account.)", path: " (Path corresponding to a wallet account.)" }); ``` ```json 200 theme={"system"} { "account": { "walletAccountId": "", "organizationId": "", "walletId": "", "curve": "", "pathFormat": "", "path": "", "addressFormat": "", "address": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" }, "publicKey": "", "walletDetails": { "walletId": "", "walletName": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" }, "exported": "", "imported": "" }, "name": "" } } ``` # Get webhook JWKS Source: https://docs.turnkey.com/api-reference/queries/get-webhook-jwks GET https://api.turnkey.com/public/v1/discovery/webhooks/jwks Fetch Turnkey webhook signature verification keys. Fetch the public Ed25519 keys used to verify Turnkey webhook signatures. This endpoint requires no authentication. For full verification guidance, including signed message construction and SDK helper usage, see [Verify webhook signatures](/features/webhooks/verify-signatures). Cache the JWKS response according to the `Cache-Control` header. Match each JWK `kid` to the webhook delivery's `X-Turnkey-Signature-Key-Id` header, and refetch JWKS before rejecting a delivery with an unknown `kid`. Current production `Cache-Control`: ```text theme={"system"} public, max-age=86400, s-maxage=86400, stale-if-error=604800 ``` A successful response returns the following fields: Public webhook signature verification keys. Key identifier. Match this value against the `X-Turnkey-Signature-Key-Id` delivery header. Key type. The current value is `OKP` for Ed25519 public keys. Key curve. The current value is `Ed25519`. JWK algorithm. The current value is `EdDSA`. Key use. The current value is `sig` for signature verification. Base64url-encoded Ed25519 public key. Turnkey signature algorithm metadata. The current value is `ed25519`. Turnkey signature contract version metadata. The current value is `v1`. ```json 200 theme={"system"} { "keys": [ { "kid": "", "kty": "OKP", "crv": "Ed25519", "alg": "EdDSA", "use": "sig", "x": "", "turnkey_signature_algorithm": "ed25519", "turnkey_signature_version": "v1" } ] } ``` # List activities Source: https://docs.turnkey.com/api-reference/queries/list-activities List all activities within an organization. Unique identifier for a given organization. Enum options: `ACTIVITY_STATUS_CREATED`, `ACTIVITY_STATUS_PENDING`, `ACTIVITY_STATUS_COMPLETED`, `ACTIVITY_STATUS_FAILED`, `ACTIVITY_STATUS_CONSENSUS_NEEDED`, `ACTIVITY_STATUS_REJECTED`, `ACTIVITY_STATUS_AUTHENTICATORS_NEEDED`

paginationOptions field

A limit of the number of object to be returned, between 1 and 100. Defaults to 10. A pagination cursor. This is an object ID that enables you to fetch all objects before this ID. A pagination cursor. This is an object ID that enables you to fetch all objects after this ID. Enum options: `ACTIVITY_TYPE_CREATE_API_KEYS`, `ACTIVITY_TYPE_CREATE_USERS`, `ACTIVITY_TYPE_CREATE_PRIVATE_KEYS`, `ACTIVITY_TYPE_SIGN_RAW_PAYLOAD`, `ACTIVITY_TYPE_CREATE_INVITATIONS`, `ACTIVITY_TYPE_ACCEPT_INVITATION`, `ACTIVITY_TYPE_CREATE_POLICY`, `ACTIVITY_TYPE_DISABLE_PRIVATE_KEY`, `ACTIVITY_TYPE_DELETE_USERS`, `ACTIVITY_TYPE_DELETE_API_KEYS`, `ACTIVITY_TYPE_DELETE_INVITATION`, `ACTIVITY_TYPE_DELETE_ORGANIZATION`, `ACTIVITY_TYPE_DELETE_POLICY`, `ACTIVITY_TYPE_CREATE_USER_TAG`, `ACTIVITY_TYPE_DELETE_USER_TAGS`, `ACTIVITY_TYPE_CREATE_ORGANIZATION`, `ACTIVITY_TYPE_SIGN_TRANSACTION`, `ACTIVITY_TYPE_APPROVE_ACTIVITY`, `ACTIVITY_TYPE_REJECT_ACTIVITY`, `ACTIVITY_TYPE_DELETE_AUTHENTICATORS`, `ACTIVITY_TYPE_CREATE_AUTHENTICATORS`, `ACTIVITY_TYPE_CREATE_PRIVATE_KEY_TAG`, `ACTIVITY_TYPE_DELETE_PRIVATE_KEY_TAGS`, `ACTIVITY_TYPE_SET_PAYMENT_METHOD`, `ACTIVITY_TYPE_ACTIVATE_BILLING_TIER`, `ACTIVITY_TYPE_DELETE_PAYMENT_METHOD`, `ACTIVITY_TYPE_CREATE_POLICY_V2`, `ACTIVITY_TYPE_CREATE_POLICY_V3`, `ACTIVITY_TYPE_CREATE_API_ONLY_USERS`, `ACTIVITY_TYPE_UPDATE_ROOT_QUORUM`, `ACTIVITY_TYPE_UPDATE_USER_TAG`, `ACTIVITY_TYPE_UPDATE_PRIVATE_KEY_TAG`, `ACTIVITY_TYPE_CREATE_AUTHENTICATORS_V2`, `ACTIVITY_TYPE_CREATE_ORGANIZATION_V2`, `ACTIVITY_TYPE_CREATE_USERS_V2`, `ACTIVITY_TYPE_ACCEPT_INVITATION_V2`, `ACTIVITY_TYPE_CREATE_SUB_ORGANIZATION`, `ACTIVITY_TYPE_CREATE_SUB_ORGANIZATION_V2`, `ACTIVITY_TYPE_UPDATE_ALLOWED_ORIGINS`, `ACTIVITY_TYPE_CREATE_PRIVATE_KEYS_V2`, `ACTIVITY_TYPE_UPDATE_USER`, `ACTIVITY_TYPE_UPDATE_POLICY`, `ACTIVITY_TYPE_SET_PAYMENT_METHOD_V2`, `ACTIVITY_TYPE_CREATE_SUB_ORGANIZATION_V3`, `ACTIVITY_TYPE_CREATE_WALLET`, `ACTIVITY_TYPE_CREATE_WALLET_ACCOUNTS`, `ACTIVITY_TYPE_INIT_USER_EMAIL_RECOVERY`, `ACTIVITY_TYPE_RECOVER_USER`, `ACTIVITY_TYPE_SET_ORGANIZATION_FEATURE`, `ACTIVITY_TYPE_REMOVE_ORGANIZATION_FEATURE`, `ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2`, `ACTIVITY_TYPE_SIGN_TRANSACTION_V2`, `ACTIVITY_TYPE_EXPORT_PRIVATE_KEY`, `ACTIVITY_TYPE_EXPORT_WALLET`, `ACTIVITY_TYPE_CREATE_SUB_ORGANIZATION_V4`, `ACTIVITY_TYPE_EMAIL_AUTH`, `ACTIVITY_TYPE_EXPORT_WALLET_ACCOUNT`, `ACTIVITY_TYPE_INIT_IMPORT_WALLET`, `ACTIVITY_TYPE_IMPORT_WALLET`, `ACTIVITY_TYPE_INIT_IMPORT_PRIVATE_KEY`, `ACTIVITY_TYPE_IMPORT_PRIVATE_KEY`, `ACTIVITY_TYPE_CREATE_POLICIES`, `ACTIVITY_TYPE_SIGN_RAW_PAYLOADS`, `ACTIVITY_TYPE_CREATE_READ_ONLY_SESSION`, `ACTIVITY_TYPE_CREATE_OAUTH_PROVIDERS`, `ACTIVITY_TYPE_DELETE_OAUTH_PROVIDERS`, `ACTIVITY_TYPE_CREATE_SUB_ORGANIZATION_V5`, `ACTIVITY_TYPE_OAUTH`, `ACTIVITY_TYPE_CREATE_API_KEYS_V2`, `ACTIVITY_TYPE_CREATE_READ_WRITE_SESSION`, `ACTIVITY_TYPE_EMAIL_AUTH_V2`, `ACTIVITY_TYPE_CREATE_SUB_ORGANIZATION_V6`, `ACTIVITY_TYPE_DELETE_PRIVATE_KEYS`, `ACTIVITY_TYPE_DELETE_WALLETS`, `ACTIVITY_TYPE_CREATE_READ_WRITE_SESSION_V2`, `ACTIVITY_TYPE_DELETE_SUB_ORGANIZATION`, `ACTIVITY_TYPE_INIT_OTP_AUTH`, `ACTIVITY_TYPE_OTP_AUTH`, `ACTIVITY_TYPE_CREATE_SUB_ORGANIZATION_V7`, `ACTIVITY_TYPE_UPDATE_WALLET`, `ACTIVITY_TYPE_UPDATE_POLICY_V2`, `ACTIVITY_TYPE_CREATE_USERS_V3`, `ACTIVITY_TYPE_INIT_OTP_AUTH_V2`, `ACTIVITY_TYPE_INIT_OTP`, `ACTIVITY_TYPE_VERIFY_OTP`, `ACTIVITY_TYPE_OTP_LOGIN`, `ACTIVITY_TYPE_STAMP_LOGIN`, `ACTIVITY_TYPE_OAUTH_LOGIN`, `ACTIVITY_TYPE_UPDATE_USER_NAME`, `ACTIVITY_TYPE_UPDATE_USER_EMAIL`, `ACTIVITY_TYPE_UPDATE_USER_PHONE_NUMBER`, `ACTIVITY_TYPE_INIT_FIAT_ON_RAMP`, `ACTIVITY_TYPE_CREATE_SMART_CONTRACT_INTERFACE`, `ACTIVITY_TYPE_DELETE_SMART_CONTRACT_INTERFACE`, `ACTIVITY_TYPE_ENABLE_AUTH_PROXY`, `ACTIVITY_TYPE_DISABLE_AUTH_PROXY`, `ACTIVITY_TYPE_UPDATE_AUTH_PROXY_CONFIG`, `ACTIVITY_TYPE_CREATE_OAUTH2_CREDENTIAL`, `ACTIVITY_TYPE_UPDATE_OAUTH2_CREDENTIAL`, `ACTIVITY_TYPE_DELETE_OAUTH2_CREDENTIAL`, `ACTIVITY_TYPE_OAUTH2_AUTHENTICATE`, `ACTIVITY_TYPE_DELETE_WALLET_ACCOUNTS`, `ACTIVITY_TYPE_DELETE_POLICIES`, `ACTIVITY_TYPE_ETH_SEND_RAW_TRANSACTION`, `ACTIVITY_TYPE_ETH_SEND_TRANSACTION`, `ACTIVITY_TYPE_CREATE_FIAT_ON_RAMP_CREDENTIAL`, `ACTIVITY_TYPE_UPDATE_FIAT_ON_RAMP_CREDENTIAL`, `ACTIVITY_TYPE_DELETE_FIAT_ON_RAMP_CREDENTIAL`, `ACTIVITY_TYPE_EMAIL_AUTH_V3`, `ACTIVITY_TYPE_INIT_USER_EMAIL_RECOVERY_V2`, `ACTIVITY_TYPE_INIT_OTP_AUTH_V3`, `ACTIVITY_TYPE_INIT_OTP_V2`, `ACTIVITY_TYPE_UPSERT_GAS_USAGE_CONFIG`, `ACTIVITY_TYPE_CREATE_TVC_APP`, `ACTIVITY_TYPE_CREATE_TVC_DEPLOYMENT`, `ACTIVITY_TYPE_CREATE_TVC_MANIFEST_APPROVALS`, `ACTIVITY_TYPE_SOL_SEND_TRANSACTION`, `ACTIVITY_TYPE_INIT_OTP_V3`, `ACTIVITY_TYPE_VERIFY_OTP_V2`, `ACTIVITY_TYPE_OTP_LOGIN_V2`, `ACTIVITY_TYPE_UPDATE_ORGANIZATION_NAME`, `ACTIVITY_TYPE_CREATE_SUB_ORGANIZATION_V8`, `ACTIVITY_TYPE_CREATE_OAUTH_PROVIDERS_V2`, `ACTIVITY_TYPE_CREATE_USERS_V4`, `ACTIVITY_TYPE_CREATE_WEBHOOK_ENDPOINT`, `ACTIVITY_TYPE_UPDATE_WEBHOOK_ENDPOINT`, `ACTIVITY_TYPE_DELETE_WEBHOOK_ENDPOINT`, `ACTIVITY_TYPE_SET_IP_ALLOWLIST`, `ACTIVITY_TYPE_REMOVE_IP_ALLOWLIST`, `ACTIVITY_TYPE_UPDATE_TVC_APP_LIVE_DEPLOYMENT`, `ACTIVITY_TYPE_DELETE_TVC_DEPLOYMENT`, `ACTIVITY_TYPE_DELETE_TVC_APP_AND_DEPLOYMENTS`, `ACTIVITY_TYPE_RESTORE_TVC_DEPLOYMENT`, `ACTIVITY_TYPE_SPARK_SIGN_FROST`, `ACTIVITY_TYPE_SPARK_PREPARE_TRANSFER`, `ACTIVITY_TYPE_SPARK_CLAIM_TRANSFER`, `ACTIVITY_TYPE_SPARK_PREPARE_LIGHTNING_RECEIVE`, `ACTIVITY_TYPE_POST_TVC_QUORUM_KEY_SHARE`, `ACTIVITY_TYPE_ETH_SEND_TRANSACTION_V2`, `ACTIVITY_TYPE_CREATE_MFA_POLICY`, `ACTIVITY_TYPE_UPDATE_MFA_POLICY`, `ACTIVITY_TYPE_DELETE_MFA_POLICY`, `ACTIVITY_TYPE_CREATE_SESSION_PROFILE` A successful response returns the following fields: A list of activities. Unique identifier for a given Activity object. Unique identifier for a given Organization. status field Enum options: `ACTIVITY_STATUS_CREATED`, `ACTIVITY_STATUS_PENDING`, `ACTIVITY_STATUS_COMPLETED`, `ACTIVITY_STATUS_FAILED`, `ACTIVITY_STATUS_CONSENSUS_NEEDED`, `ACTIVITY_STATUS_REJECTED`, `ACTIVITY_STATUS_AUTHENTICATORS_NEEDED` type field Enum options: `ACTIVITY_TYPE_CREATE_API_KEYS`, `ACTIVITY_TYPE_CREATE_USERS`, `ACTIVITY_TYPE_CREATE_PRIVATE_KEYS`, `ACTIVITY_TYPE_SIGN_RAW_PAYLOAD`, `ACTIVITY_TYPE_CREATE_INVITATIONS`, `ACTIVITY_TYPE_ACCEPT_INVITATION`, `ACTIVITY_TYPE_CREATE_POLICY`, `ACTIVITY_TYPE_DISABLE_PRIVATE_KEY`, `ACTIVITY_TYPE_DELETE_USERS`, `ACTIVITY_TYPE_DELETE_API_KEYS`, `ACTIVITY_TYPE_DELETE_INVITATION`, `ACTIVITY_TYPE_DELETE_ORGANIZATION`, `ACTIVITY_TYPE_DELETE_POLICY`, `ACTIVITY_TYPE_CREATE_USER_TAG`, `ACTIVITY_TYPE_DELETE_USER_TAGS`, `ACTIVITY_TYPE_CREATE_ORGANIZATION`, `ACTIVITY_TYPE_SIGN_TRANSACTION`, `ACTIVITY_TYPE_APPROVE_ACTIVITY`, `ACTIVITY_TYPE_REJECT_ACTIVITY`, `ACTIVITY_TYPE_DELETE_AUTHENTICATORS`, `ACTIVITY_TYPE_CREATE_AUTHENTICATORS`, `ACTIVITY_TYPE_CREATE_PRIVATE_KEY_TAG`, `ACTIVITY_TYPE_DELETE_PRIVATE_KEY_TAGS`, `ACTIVITY_TYPE_SET_PAYMENT_METHOD`, `ACTIVITY_TYPE_ACTIVATE_BILLING_TIER`, `ACTIVITY_TYPE_DELETE_PAYMENT_METHOD`, `ACTIVITY_TYPE_CREATE_POLICY_V2`, `ACTIVITY_TYPE_CREATE_POLICY_V3`, `ACTIVITY_TYPE_CREATE_API_ONLY_USERS`, `ACTIVITY_TYPE_UPDATE_ROOT_QUORUM`, `ACTIVITY_TYPE_UPDATE_USER_TAG`, `ACTIVITY_TYPE_UPDATE_PRIVATE_KEY_TAG`, `ACTIVITY_TYPE_CREATE_AUTHENTICATORS_V2`, `ACTIVITY_TYPE_CREATE_ORGANIZATION_V2`, `ACTIVITY_TYPE_CREATE_USERS_V2`, `ACTIVITY_TYPE_ACCEPT_INVITATION_V2`, `ACTIVITY_TYPE_CREATE_SUB_ORGANIZATION`, `ACTIVITY_TYPE_CREATE_SUB_ORGANIZATION_V2`, `ACTIVITY_TYPE_UPDATE_ALLOWED_ORIGINS`, `ACTIVITY_TYPE_CREATE_PRIVATE_KEYS_V2`, `ACTIVITY_TYPE_UPDATE_USER`, `ACTIVITY_TYPE_UPDATE_POLICY`, `ACTIVITY_TYPE_SET_PAYMENT_METHOD_V2`, `ACTIVITY_TYPE_CREATE_SUB_ORGANIZATION_V3`, `ACTIVITY_TYPE_CREATE_WALLET`, `ACTIVITY_TYPE_CREATE_WALLET_ACCOUNTS`, `ACTIVITY_TYPE_INIT_USER_EMAIL_RECOVERY`, `ACTIVITY_TYPE_RECOVER_USER`, `ACTIVITY_TYPE_SET_ORGANIZATION_FEATURE`, `ACTIVITY_TYPE_REMOVE_ORGANIZATION_FEATURE`, `ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2`, `ACTIVITY_TYPE_SIGN_TRANSACTION_V2`, `ACTIVITY_TYPE_EXPORT_PRIVATE_KEY`, `ACTIVITY_TYPE_EXPORT_WALLET`, `ACTIVITY_TYPE_CREATE_SUB_ORGANIZATION_V4`, `ACTIVITY_TYPE_EMAIL_AUTH`, `ACTIVITY_TYPE_EXPORT_WALLET_ACCOUNT`, `ACTIVITY_TYPE_INIT_IMPORT_WALLET`, `ACTIVITY_TYPE_IMPORT_WALLET`, `ACTIVITY_TYPE_INIT_IMPORT_PRIVATE_KEY`, `ACTIVITY_TYPE_IMPORT_PRIVATE_KEY`, `ACTIVITY_TYPE_CREATE_POLICIES`, `ACTIVITY_TYPE_SIGN_RAW_PAYLOADS`, `ACTIVITY_TYPE_CREATE_READ_ONLY_SESSION`, `ACTIVITY_TYPE_CREATE_OAUTH_PROVIDERS`, `ACTIVITY_TYPE_DELETE_OAUTH_PROVIDERS`, `ACTIVITY_TYPE_CREATE_SUB_ORGANIZATION_V5`, `ACTIVITY_TYPE_OAUTH`, `ACTIVITY_TYPE_CREATE_API_KEYS_V2`, `ACTIVITY_TYPE_CREATE_READ_WRITE_SESSION`, `ACTIVITY_TYPE_EMAIL_AUTH_V2`, `ACTIVITY_TYPE_CREATE_SUB_ORGANIZATION_V6`, `ACTIVITY_TYPE_DELETE_PRIVATE_KEYS`, `ACTIVITY_TYPE_DELETE_WALLETS`, `ACTIVITY_TYPE_CREATE_READ_WRITE_SESSION_V2`, `ACTIVITY_TYPE_DELETE_SUB_ORGANIZATION`, `ACTIVITY_TYPE_INIT_OTP_AUTH`, `ACTIVITY_TYPE_OTP_AUTH`, `ACTIVITY_TYPE_CREATE_SUB_ORGANIZATION_V7`, `ACTIVITY_TYPE_UPDATE_WALLET`, `ACTIVITY_TYPE_UPDATE_POLICY_V2`, `ACTIVITY_TYPE_CREATE_USERS_V3`, `ACTIVITY_TYPE_INIT_OTP_AUTH_V2`, `ACTIVITY_TYPE_INIT_OTP`, `ACTIVITY_TYPE_VERIFY_OTP`, `ACTIVITY_TYPE_OTP_LOGIN`, `ACTIVITY_TYPE_STAMP_LOGIN`, `ACTIVITY_TYPE_OAUTH_LOGIN`, `ACTIVITY_TYPE_UPDATE_USER_NAME`, `ACTIVITY_TYPE_UPDATE_USER_EMAIL`, `ACTIVITY_TYPE_UPDATE_USER_PHONE_NUMBER`, `ACTIVITY_TYPE_INIT_FIAT_ON_RAMP`, `ACTIVITY_TYPE_CREATE_SMART_CONTRACT_INTERFACE`, `ACTIVITY_TYPE_DELETE_SMART_CONTRACT_INTERFACE`, `ACTIVITY_TYPE_ENABLE_AUTH_PROXY`, `ACTIVITY_TYPE_DISABLE_AUTH_PROXY`, `ACTIVITY_TYPE_UPDATE_AUTH_PROXY_CONFIG`, `ACTIVITY_TYPE_CREATE_OAUTH2_CREDENTIAL`, `ACTIVITY_TYPE_UPDATE_OAUTH2_CREDENTIAL`, `ACTIVITY_TYPE_DELETE_OAUTH2_CREDENTIAL`, `ACTIVITY_TYPE_OAUTH2_AUTHENTICATE`, `ACTIVITY_TYPE_DELETE_WALLET_ACCOUNTS`, `ACTIVITY_TYPE_DELETE_POLICIES`, `ACTIVITY_TYPE_ETH_SEND_RAW_TRANSACTION`, `ACTIVITY_TYPE_ETH_SEND_TRANSACTION`, `ACTIVITY_TYPE_CREATE_FIAT_ON_RAMP_CREDENTIAL`, `ACTIVITY_TYPE_UPDATE_FIAT_ON_RAMP_CREDENTIAL`, `ACTIVITY_TYPE_DELETE_FIAT_ON_RAMP_CREDENTIAL`, `ACTIVITY_TYPE_EMAIL_AUTH_V3`, `ACTIVITY_TYPE_INIT_USER_EMAIL_RECOVERY_V2`, `ACTIVITY_TYPE_INIT_OTP_AUTH_V3`, `ACTIVITY_TYPE_INIT_OTP_V2`, `ACTIVITY_TYPE_UPSERT_GAS_USAGE_CONFIG`, `ACTIVITY_TYPE_CREATE_TVC_APP`, `ACTIVITY_TYPE_CREATE_TVC_DEPLOYMENT`, `ACTIVITY_TYPE_CREATE_TVC_MANIFEST_APPROVALS`, `ACTIVITY_TYPE_SOL_SEND_TRANSACTION`, `ACTIVITY_TYPE_INIT_OTP_V3`, `ACTIVITY_TYPE_VERIFY_OTP_V2`, `ACTIVITY_TYPE_OTP_LOGIN_V2`, `ACTIVITY_TYPE_UPDATE_ORGANIZATION_NAME`, `ACTIVITY_TYPE_CREATE_SUB_ORGANIZATION_V8`, `ACTIVITY_TYPE_CREATE_OAUTH_PROVIDERS_V2`, `ACTIVITY_TYPE_CREATE_USERS_V4`, `ACTIVITY_TYPE_CREATE_WEBHOOK_ENDPOINT`, `ACTIVITY_TYPE_UPDATE_WEBHOOK_ENDPOINT`, `ACTIVITY_TYPE_DELETE_WEBHOOK_ENDPOINT`, `ACTIVITY_TYPE_SET_IP_ALLOWLIST`, `ACTIVITY_TYPE_REMOVE_IP_ALLOWLIST`, `ACTIVITY_TYPE_UPDATE_TVC_APP_LIVE_DEPLOYMENT`, `ACTIVITY_TYPE_DELETE_TVC_DEPLOYMENT`, `ACTIVITY_TYPE_DELETE_TVC_APP_AND_DEPLOYMENTS`, `ACTIVITY_TYPE_RESTORE_TVC_DEPLOYMENT`, `ACTIVITY_TYPE_SPARK_SIGN_FROST`, `ACTIVITY_TYPE_SPARK_PREPARE_TRANSFER`, `ACTIVITY_TYPE_SPARK_CLAIM_TRANSFER`, `ACTIVITY_TYPE_SPARK_PREPARE_LIGHTNING_RECEIVE`, `ACTIVITY_TYPE_POST_TVC_QUORUM_KEY_SHARE`, `ACTIVITY_TYPE_ETH_SEND_TRANSACTION_V2`, `ACTIVITY_TYPE_CREATE_MFA_POLICY`, `ACTIVITY_TYPE_UPDATE_MFA_POLICY`, `ACTIVITY_TYPE_DELETE_MFA_POLICY`, `ACTIVITY_TYPE_CREATE_SESSION_PROFILE` intent field createOrganizationIntent field Human-readable name for an Organization. The root user's email address. rootAuthenticator field Human-readable name for an Authenticator. Unique identifier for a given User. attestation field id field type field Enum options: `public-key` rawId field authenticatorAttachment field Enum options: `cross-platform`, `platform` response field clientDataJson field attestationObject field transports field item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` authenticatorAttachment field Enum options: `cross-platform`, `platform` clientExtensionResults field appid field appidExclude field credProps field rk field Challenge presented for authentication purposes. Unique identifier for the root user object. createAuthenticatorsIntent field A list of Authenticators. Human-readable name for an Authenticator. Unique identifier for a given User. attestation field id field type field Enum options: `public-key` rawId field authenticatorAttachment field Enum options: `cross-platform`, `platform` response field clientDataJson field attestationObject field transports field item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` authenticatorAttachment field Enum options: `cross-platform`, `platform` clientExtensionResults field appid field appidExclude field credProps field rk field Challenge presented for authentication purposes. Unique identifier for a given User. createUsersIntent field A list of Users. Human-readable name for a User. The user's email address. accessType field Enum options: `ACCESS_TYPE_WEB`, `ACCESS_TYPE_API`, `ACCESS_TYPE_ALL` A list of API Key parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an API Key. The public component of a cryptographic key pair used to sign messages and transactions. Optional window (in seconds) indicating how long the API Key should last. A list of Authenticator parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an Authenticator. Unique identifier for a given User. attestation field id field type field Enum options: `public-key` rawId field authenticatorAttachment field Enum options: `cross-platform`, `platform` response field clientDataJson field attestationObject field transports field item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` authenticatorAttachment field Enum options: `cross-platform`, `platform` clientExtensionResults field appid field appidExclude field credProps field rk field Challenge presented for authentication purposes. A list of User Tag IDs. This field, if not needed, should be an empty array in your request body. item field createPrivateKeysIntent field A list of Private Keys. Human-readable name for a Private Key. curve field Enum options: `CURVE_SECP256K1`, `CURVE_ED25519`, `CURVE_P256` A list of Private Key Tag IDs. This field, if not needed, should be an empty array in your request body. item field Cryptocurrency-specific formats for a derived address (e.g., Ethereum). item field Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` signRawPayloadIntent field Unique identifier for a given Private Key. Raw unsigned payload to be signed. encoding field Enum options: `PAYLOAD_ENCODING_HEXADECIMAL`, `PAYLOAD_ENCODING_TEXT_UTF8`, `PAYLOAD_ENCODING_EIP712`, `PAYLOAD_ENCODING_EIP7702_AUTHORIZATION` hashFunction field Enum options: `HASH_FUNCTION_NO_OP`, `HASH_FUNCTION_SHA256`, `HASH_FUNCTION_KECCAK256`, `HASH_FUNCTION_NOT_APPLICABLE` createInvitationsIntent field A list of Invitations. The name of the intended Invitation recipient. The email address of the intended Invitation recipient. A list of tags assigned to the Invitation recipient. This field, if not needed, should be an empty array in your request body. item field accessType field Enum options: `ACCESS_TYPE_WEB`, `ACCESS_TYPE_API`, `ACCESS_TYPE_ALL` Unique identifier for the Sender of an Invitation. acceptInvitationIntent field Unique identifier for a given Invitation object. Unique identifier for a given User. authenticator field Human-readable name for an Authenticator. Unique identifier for a given User. attestation field id field type field Enum options: `public-key` rawId field authenticatorAttachment field Enum options: `cross-platform`, `platform` response field clientDataJson field attestationObject field transports field item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` authenticatorAttachment field Enum options: `cross-platform`, `platform` clientExtensionResults field appid field appidExclude field credProps field rk field Challenge presented for authentication purposes. createPolicyIntent field Human-readable name for a Policy. A list of simple functions each including a subject, target and boolean. See Policy Engine Language section for additional details. subject field operator field Enum options: `OPERATOR_EQUAL`, `OPERATOR_MORE_THAN`, `OPERATOR_MORE_THAN_OR_EQUAL`, `OPERATOR_LESS_THAN`, `OPERATOR_LESS_THAN_OR_EQUAL`, `OPERATOR_CONTAINS`, `OPERATOR_NOT_EQUAL`, `OPERATOR_IN`, `OPERATOR_NOT_IN`, `OPERATOR_CONTAINS_ONE`, `OPERATOR_CONTAINS_ALL` target field effect field Enum options: `EFFECT_ALLOW`, `EFFECT_DENY` notes field disablePrivateKeyIntent field Unique identifier for a given Private Key. deleteUsersIntent field A list of User IDs. item field deleteAuthenticatorsIntent field Unique identifier for a given User. A list of Authenticator IDs. item field deleteInvitationIntent field Unique identifier for a given Invitation object. deleteOrganizationIntent field Unique identifier for a given Organization. deletePolicyIntent field Unique identifier for a given Policy. createUserTagIntent field Human-readable name for a User Tag. A list of User IDs. item field deleteUserTagsIntent field A list of User Tag IDs. item field signTransactionIntent field Unique identifier for a given Private Key. Raw unsigned transaction to be signed by a particular Private Key. type field Enum options: `TRANSACTION_TYPE_ETHEREUM`, `TRANSACTION_TYPE_SOLANA`, `TRANSACTION_TYPE_TRON`, `TRANSACTION_TYPE_BITCOIN`, `TRANSACTION_TYPE_TEMPO` createApiKeysIntent field A list of API Keys. Human-readable name for an API Key. The public component of a cryptographic key pair used to sign messages and transactions. Optional window (in seconds) indicating how long the API Key should last. Unique identifier for a given User. deleteApiKeysIntent field Unique identifier for a given User. A list of API Key IDs. item field approveActivityIntent field An artifact verifying a User's action. rejectActivityIntent field An artifact verifying a User's action. createPrivateKeyTagIntent field Human-readable name for a Private Key Tag. A list of Private Key IDs. item field deletePrivateKeyTagsIntent field A list of Private Key Tag IDs. item field createPolicyIntentV2 field Human-readable name for a Policy. A list of simple functions each including a subject, target and boolean. See Policy Engine Language section for additional details. subject field operator field Enum options: `OPERATOR_EQUAL`, `OPERATOR_MORE_THAN`, `OPERATOR_MORE_THAN_OR_EQUAL`, `OPERATOR_LESS_THAN`, `OPERATOR_LESS_THAN_OR_EQUAL`, `OPERATOR_CONTAINS`, `OPERATOR_NOT_EQUAL`, `OPERATOR_IN`, `OPERATOR_NOT_IN`, `OPERATOR_CONTAINS_ONE`, `OPERATOR_CONTAINS_ALL` targets field item field effect field Enum options: `EFFECT_ALLOW`, `EFFECT_DENY` notes field setPaymentMethodIntent field The account number of the customer's credit card. The verification digits of the customer's credit card. The month that the credit card expires. The year that the credit card expires. The email that will receive invoices for the credit card. The name associated with the credit card. activateBillingTierIntent field The product that the customer wants to subscribe to. orbPlanId field deletePaymentMethodIntent field The payment method that the customer wants to remove. createPolicyIntentV3 field Human-readable name for a Policy. effect field Enum options: `EFFECT_ALLOW`, `EFFECT_DENY` The condition expression that triggers the Effect The consensus expression that triggers the Effect Notes for a Policy. createApiOnlyUsersIntent field A list of API-only Users to create. The name of the new API-only User. The email address for this API-only User (optional). A list of tags assigned to the new API-only User. This field, if not needed, should be an empty array in your request body. item field A list of API Key parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an API Key. The public component of a cryptographic key pair used to sign messages and transactions. Optional window (in seconds) indicating how long the API Key should last. updateRootQuorumIntent field The threshold of unique approvals to reach quorum. The unique identifiers of users who comprise the quorum set. item field updateUserTagIntent field Unique identifier for a given User Tag. The new, human-readable name for the tag with the given ID. A list of User IDs to add this tag to. item field A list of User IDs to remove this tag from. item field updatePrivateKeyTagIntent field Unique identifier for a given Private Key Tag. The new, human-readable name for the tag with the given ID. A list of Private Keys IDs to add this tag to. item field A list of Private Key IDs to remove this tag from. item field createAuthenticatorsIntentV2 field A list of Authenticators. Human-readable name for an Authenticator. Challenge presented for authentication purposes. attestation field The cbor encoded then base64 url encoded id of the credential. A base64 url encoded payload containing metadata about the signing context and the challenge. A base64 url encoded payload containing authenticator data and any attestation the webauthn provider chooses. The type of authenticator transports. item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` Unique identifier for a given User. acceptInvitationIntentV2 field Unique identifier for a given Invitation object. Unique identifier for a given User. authenticator field Human-readable name for an Authenticator. Challenge presented for authentication purposes. attestation field The cbor encoded then base64 url encoded id of the credential. A base64 url encoded payload containing metadata about the signing context and the challenge. A base64 url encoded payload containing authenticator data and any attestation the webauthn provider chooses. The type of authenticator transports. item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` createOrganizationIntentV2 field Human-readable name for an Organization. The root user's email address. rootAuthenticator field Human-readable name for an Authenticator. Challenge presented for authentication purposes. attestation field The cbor encoded then base64 url encoded id of the credential. A base64 url encoded payload containing metadata about the signing context and the challenge. A base64 url encoded payload containing authenticator data and any attestation the webauthn provider chooses. The type of authenticator transports. item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` Unique identifier for the root user object. createUsersIntentV2 field A list of Users. Human-readable name for a User. The user's email address. A list of API Key parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an API Key. The public component of a cryptographic key pair used to sign messages and transactions. Optional window (in seconds) indicating how long the API Key should last. A list of Authenticator parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an Authenticator. Challenge presented for authentication purposes. attestation field The cbor encoded then base64 url encoded id of the credential. A base64 url encoded payload containing metadata about the signing context and the challenge. A base64 url encoded payload containing authenticator data and any attestation the webauthn provider chooses. The type of authenticator transports. item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` A list of User Tag IDs. This field, if not needed, should be an empty array in your request body. item field createSubOrganizationIntent field Name for this sub-organization rootAuthenticator field Human-readable name for an Authenticator. Challenge presented for authentication purposes. attestation field The cbor encoded then base64 url encoded id of the credential. A base64 url encoded payload containing metadata about the signing context and the challenge. A base64 url encoded payload containing authenticator data and any attestation the webauthn provider chooses. The type of authenticator transports. item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` createSubOrganizationIntentV2 field Name for this sub-organization Root users to create within this sub-organization Human-readable name for a User. The user's email address. A list of API Key parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an API Key. The public component of a cryptographic key pair used to sign messages and transactions. Optional window (in seconds) indicating how long the API Key should last. A list of Authenticator parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an Authenticator. Challenge presented for authentication purposes. attestation field The cbor encoded then base64 url encoded id of the credential. A base64 url encoded payload containing metadata about the signing context and the challenge. A base64 url encoded payload containing authenticator data and any attestation the webauthn provider chooses. The type of authenticator transports. item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` The threshold of unique approvals to reach root quorum. This value must be less than or equal to the number of root users updateAllowedOriginsIntent field Additional origins requests are allowed from besides Turnkey origins item field createPrivateKeysIntentV2 field A list of Private Keys. Human-readable name for a Private Key. curve field Enum options: `CURVE_SECP256K1`, `CURVE_ED25519`, `CURVE_P256` A list of Private Key Tag IDs. This field, if not needed, should be an empty array in your request body. item field Cryptocurrency-specific formats for a derived address (e.g., Ethereum). item field Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` updateUserIntent field Unique identifier for a given User. Human-readable name for a User. The user's email address. An updated list of User Tags to apply to this User. This field, if not needed, should be an empty array in your request body. item field The user's phone number in E.164 format e.g. +13214567890 updatePolicyIntent field Unique identifier for a given Policy. Human-readable name for a Policy. policyEffect field Enum options: `EFFECT_ALLOW`, `EFFECT_DENY` The condition expression that triggers the Effect (optional). The consensus expression that triggers the Effect (optional). Accompanying notes for a Policy (optional). setPaymentMethodIntentV2 field The id of the payment method that was created clientside. The email that will receive invoices for the credit card. The name associated with the credit card. createSubOrganizationIntentV3 field Name for this sub-organization Root users to create within this sub-organization Human-readable name for a User. The user's email address. A list of API Key parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an API Key. The public component of a cryptographic key pair used to sign messages and transactions. Optional window (in seconds) indicating how long the API Key should last. A list of Authenticator parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an Authenticator. Challenge presented for authentication purposes. attestation field The cbor encoded then base64 url encoded id of the credential. A base64 url encoded payload containing metadata about the signing context and the challenge. A base64 url encoded payload containing authenticator data and any attestation the webauthn provider chooses. The type of authenticator transports. item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` The threshold of unique approvals to reach root quorum. This value must be less than or equal to the number of root users A list of Private Keys. Human-readable name for a Private Key. curve field Enum options: `CURVE_SECP256K1`, `CURVE_ED25519`, `CURVE_P256` A list of Private Key Tag IDs. This field, if not needed, should be an empty array in your request body. item field Cryptocurrency-specific formats for a derived address (e.g., Ethereum). item field Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` createWalletIntent field Human-readable name for a Wallet. A list of wallet Accounts. This field, if not needed, should be an empty array in your request body. curve field Enum options: `CURVE_SECP256K1`, `CURVE_ED25519`, `CURVE_P256` pathFormat field Enum options: `PATH_FORMAT_BIP32` Path used to generate a wallet Account. addressFormat field Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` Optional human-readable name for the account. Length of mnemonic to generate the Wallet seed. Defaults to 12. Accepted values: 12, 15, 18, 21, 24. createWalletAccountsIntent field Unique identifier for a given Wallet. A list of wallet Accounts. curve field Enum options: `CURVE_SECP256K1`, `CURVE_ED25519`, `CURVE_P256` pathFormat field Enum options: `PATH_FORMAT_BIP32` Path used to generate a wallet Account. addressFormat field Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` Optional human-readable name for the account. Indicates if the wallet accounts should be persisted. This is helpful if you'd like to see the addresses of different derivation paths without actually creating the accounts. Defaults to true. initUserEmailRecoveryIntent field Email of the user starting recovery Client-side public key generated by the user, to which the recovery bundle will be encrypted. Expiration window (in seconds) indicating how long the recovery credential is valid for. If not provided, a default of 15 minutes will be used. emailCustomization field The name of the application. A URL pointing to a logo in PNG format. Note this logo will be resized to fit into 340px x 124px. A template for the URL to be used in a magic link button, e.g. `https://dapp.xyz/%s`. The auth bundle will be interpolated into the `%s`. JSON object containing key/value pairs to be used with custom templates. Unique identifier for a given Email Template. If not specified, the default is the most recent Email Template. Optional custom email address from which to send the OTP email Optional custom sender name for use with sendFromEmailAddress; if left empty, will default to 'Notifications' Optional custom email address to use as reply-to recoverUserIntent field authenticator field Human-readable name for an Authenticator. Challenge presented for authentication purposes. attestation field The cbor encoded then base64 url encoded id of the credential. A base64 url encoded payload containing metadata about the signing context and the challenge. A base64 url encoded payload containing authenticator data and any attestation the webauthn provider chooses. The type of authenticator transports. item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` Unique identifier for the user performing recovery. setOrganizationFeatureIntent field name field Enum options: `FEATURE_NAME_ROOT_USER_EMAIL_RECOVERY`, `FEATURE_NAME_WEBAUTHN_ORIGINS`, `FEATURE_NAME_EMAIL_AUTH`, `FEATURE_NAME_EMAIL_RECOVERY`, `FEATURE_NAME_WEBHOOK`, `FEATURE_NAME_SMS_AUTH`, `FEATURE_NAME_OTP_EMAIL_AUTH`, `FEATURE_NAME_AUTH_PROXY`, `FEATURE_NAME_SOLANA_RENT_PREFUND_ENABLED` Optional value for the feature. Will override existing values if feature is already set. removeOrganizationFeatureIntent field name field Enum options: `FEATURE_NAME_ROOT_USER_EMAIL_RECOVERY`, `FEATURE_NAME_WEBAUTHN_ORIGINS`, `FEATURE_NAME_EMAIL_AUTH`, `FEATURE_NAME_EMAIL_RECOVERY`, `FEATURE_NAME_WEBHOOK`, `FEATURE_NAME_SMS_AUTH`, `FEATURE_NAME_OTP_EMAIL_AUTH`, `FEATURE_NAME_AUTH_PROXY`, `FEATURE_NAME_SOLANA_RENT_PREFUND_ENABLED` signRawPayloadIntentV2 field A Wallet account address, Private Key address, or Private Key identifier. Raw unsigned payload to be signed. encoding field Enum options: `PAYLOAD_ENCODING_HEXADECIMAL`, `PAYLOAD_ENCODING_TEXT_UTF8`, `PAYLOAD_ENCODING_EIP712`, `PAYLOAD_ENCODING_EIP7702_AUTHORIZATION` hashFunction field Enum options: `HASH_FUNCTION_NO_OP`, `HASH_FUNCTION_SHA256`, `HASH_FUNCTION_KECCAK256`, `HASH_FUNCTION_NOT_APPLICABLE` signTransactionIntentV2 field A Wallet account address, Private Key address, or Private Key identifier. Raw unsigned transaction to be signed type field Enum options: `TRANSACTION_TYPE_ETHEREUM`, `TRANSACTION_TYPE_SOLANA`, `TRANSACTION_TYPE_TRON`, `TRANSACTION_TYPE_BITCOIN`, `TRANSACTION_TYPE_TEMPO` exportPrivateKeyIntent field Unique identifier for a given Private Key. Client-side public key generated by the user, to which the export bundle will be encrypted. exportWalletIntent field Unique identifier for a given Wallet. Client-side public key generated by the user, to which the export bundle will be encrypted. language field Enum options: `MNEMONIC_LANGUAGE_ENGLISH`, `MNEMONIC_LANGUAGE_SIMPLIFIED_CHINESE`, `MNEMONIC_LANGUAGE_TRADITIONAL_CHINESE`, `MNEMONIC_LANGUAGE_CZECH`, `MNEMONIC_LANGUAGE_FRENCH`, `MNEMONIC_LANGUAGE_ITALIAN`, `MNEMONIC_LANGUAGE_JAPANESE`, `MNEMONIC_LANGUAGE_KOREAN`, `MNEMONIC_LANGUAGE_SPANISH` createSubOrganizationIntentV4 field Name for this sub-organization Root users to create within this sub-organization Human-readable name for a User. The user's email address. A list of API Key parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an API Key. The public component of a cryptographic key pair used to sign messages and transactions. Optional window (in seconds) indicating how long the API Key should last. A list of Authenticator parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an Authenticator. Challenge presented for authentication purposes. attestation field The cbor encoded then base64 url encoded id of the credential. A base64 url encoded payload containing metadata about the signing context and the challenge. A base64 url encoded payload containing authenticator data and any attestation the webauthn provider chooses. The type of authenticator transports. item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` The threshold of unique approvals to reach root quorum. This value must be less than or equal to the number of root users wallet field Human-readable name for a Wallet. A list of wallet Accounts. This field, if not needed, should be an empty array in your request body. curve field Enum options: `CURVE_SECP256K1`, `CURVE_ED25519`, `CURVE_P256` pathFormat field Enum options: `PATH_FORMAT_BIP32` Path used to generate a wallet Account. addressFormat field Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` Optional human-readable name for the account. Length of mnemonic to generate the Wallet seed. Defaults to 12. Accepted values: 12, 15, 18, 21, 24. Disable email recovery for the sub-organization Disable email auth for the sub-organization emailAuthIntent field Email of the authenticating user. Client-side public key generated by the user, to which the email auth bundle (credentials) will be encrypted. Optional human-readable name for an API Key. If none provided, default to Email Auth - \ Expiration window (in seconds) indicating how long the API key is valid for. If not provided, a default of 15 minutes will be used. emailCustomization field The name of the application. A URL pointing to a logo in PNG format. Note this logo will be resized to fit into 340px x 124px. A template for the URL to be used in a magic link button, e.g. `https://dapp.xyz/%s`. The auth bundle will be interpolated into the `%s`. JSON object containing key/value pairs to be used with custom templates. Unique identifier for a given Email Template. If not specified, the default is the most recent Email Template. Invalidate all other previously generated Email Auth API keys Optional custom email address from which to send the email Optional custom sender name for use with sendFromEmailAddress; if left empty, will default to 'Notifications' Optional custom email address to use as reply-to exportWalletAccountIntent field Address to identify Wallet Account. Client-side public key generated by the user, to which the export bundle will be encrypted. initImportWalletIntent field The ID of the User importing a Wallet. importWalletIntent field The ID of the User importing a Wallet. Human-readable name for a Wallet. Bundle containing a wallet mnemonic encrypted to the enclave's target public key. A list of wallet Accounts. curve field Enum options: `CURVE_SECP256K1`, `CURVE_ED25519`, `CURVE_P256` pathFormat field Enum options: `PATH_FORMAT_BIP32` Path used to generate a wallet Account. addressFormat field Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` Optional human-readable name for the account. initImportPrivateKeyIntent field The ID of the User importing a Private Key. importPrivateKeyIntent field The ID of the User importing a Private Key. Human-readable name for a Private Key. Bundle containing a raw private key encrypted to the enclave's target public key. curve field Enum options: `CURVE_SECP256K1`, `CURVE_ED25519`, `CURVE_P256` Cryptocurrency-specific formats for a derived address (e.g., Ethereum). item field Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` createPoliciesIntent field An array of policy intents to be created. Human-readable name for a Policy. effect field Enum options: `EFFECT_ALLOW`, `EFFECT_DENY` The condition expression that triggers the Effect The consensus expression that triggers the Effect Notes for a Policy. signRawPayloadsIntent field A Wallet account address, Private Key address, or Private Key identifier. An array of raw unsigned payloads to be signed. item field encoding field Enum options: `PAYLOAD_ENCODING_HEXADECIMAL`, `PAYLOAD_ENCODING_TEXT_UTF8`, `PAYLOAD_ENCODING_EIP712`, `PAYLOAD_ENCODING_EIP7702_AUTHORIZATION` hashFunction field Enum options: `HASH_FUNCTION_NO_OP`, `HASH_FUNCTION_SHA256`, `HASH_FUNCTION_KECCAK256`, `HASH_FUNCTION_NOT_APPLICABLE` createReadOnlySessionIntent field createOauthProvidersIntent field The ID of the User to add an Oauth provider to A list of Oauth providers. Human-readable name to identify a Provider. Base64 encoded OIDC token deleteOauthProvidersIntent field The ID of the User to remove an Oauth provider from Unique identifier for a given Provider. item field createSubOrganizationIntentV5 field Name for this sub-organization Root users to create within this sub-organization Human-readable name for a User. The user's email address. A list of API Key parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an API Key. The public component of a cryptographic key pair used to sign messages and transactions. Optional window (in seconds) indicating how long the API Key should last. A list of Authenticator parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an Authenticator. Challenge presented for authentication purposes. attestation field The cbor encoded then base64 url encoded id of the credential. A base64 url encoded payload containing metadata about the signing context and the challenge. A base64 url encoded payload containing authenticator data and any attestation the webauthn provider chooses. The type of authenticator transports. item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` A list of Oauth providers. This field, if not needed, should be an empty array in your request body. Human-readable name to identify a Provider. Base64 encoded OIDC token The threshold of unique approvals to reach root quorum. This value must be less than or equal to the number of root users wallet field Human-readable name for a Wallet. A list of wallet Accounts. This field, if not needed, should be an empty array in your request body. curve field Enum options: `CURVE_SECP256K1`, `CURVE_ED25519`, `CURVE_P256` pathFormat field Enum options: `PATH_FORMAT_BIP32` Path used to generate a wallet Account. addressFormat field Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` Optional human-readable name for the account. Length of mnemonic to generate the Wallet seed. Defaults to 12. Accepted values: 12, 15, 18, 21, 24. Disable email recovery for the sub-organization Disable email auth for the sub-organization oauthIntent field Base64 encoded OIDC token Client-side public key generated by the user, to which the oauth bundle (credentials) will be encrypted. Optional human-readable name for an API Key. If none provided, default to Oauth - \ Expiration window (in seconds) indicating how long the API key is valid for. If not provided, a default of 15 minutes will be used. Invalidate all other previously generated Oauth API keys createApiKeysIntentV2 field A list of API Keys. Human-readable name for an API Key. The public component of a cryptographic key pair used to sign messages and transactions. curveType field Enum options: `API_KEY_CURVE_P256`, `API_KEY_CURVE_SECP256K1`, `API_KEY_CURVE_ED25519` Optional window (in seconds) indicating how long the API Key should last. Unique identifier for a given User. createReadWriteSessionIntent field Client-side public key generated by the user, to which the read write session bundle (credentials) will be encrypted. Email of the user to create a read write session for Optional human-readable name for an API Key. If none provided, default to Read Write Session - \ Expiration window (in seconds) indicating how long the API key is valid for. If not provided, a default of 15 minutes will be used. emailAuthIntentV2 field Email of the authenticating user. Client-side public key generated by the user, to which the email auth bundle (credentials) will be encrypted. Optional human-readable name for an API Key. If none provided, default to Email Auth - \ Expiration window (in seconds) indicating how long the API key is valid for. If not provided, a default of 15 minutes will be used. emailCustomization field The name of the application. A URL pointing to a logo in PNG format. Note this logo will be resized to fit into 340px x 124px. A template for the URL to be used in a magic link button, e.g. `https://dapp.xyz/%s`. The auth bundle will be interpolated into the `%s`. JSON object containing key/value pairs to be used with custom templates. Unique identifier for a given Email Template. If not specified, the default is the most recent Email Template. Invalidate all other previously generated Email Auth API keys Optional custom email address from which to send the email Optional custom sender name for use with sendFromEmailAddress; if left empty, will default to 'Notifications' Optional custom email address to use as reply-to createSubOrganizationIntentV6 field Name for this sub-organization Root users to create within this sub-organization Human-readable name for a User. The user's email address. A list of API Key parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an API Key. The public component of a cryptographic key pair used to sign messages and transactions. curveType field Enum options: `API_KEY_CURVE_P256`, `API_KEY_CURVE_SECP256K1`, `API_KEY_CURVE_ED25519` Optional window (in seconds) indicating how long the API Key should last. A list of Authenticator parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an Authenticator. Challenge presented for authentication purposes. attestation field The cbor encoded then base64 url encoded id of the credential. A base64 url encoded payload containing metadata about the signing context and the challenge. A base64 url encoded payload containing authenticator data and any attestation the webauthn provider chooses. The type of authenticator transports. item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` A list of Oauth providers. This field, if not needed, should be an empty array in your request body. Human-readable name to identify a Provider. Base64 encoded OIDC token The threshold of unique approvals to reach root quorum. This value must be less than or equal to the number of root users wallet field Human-readable name for a Wallet. A list of wallet Accounts. This field, if not needed, should be an empty array in your request body. curve field Enum options: `CURVE_SECP256K1`, `CURVE_ED25519`, `CURVE_P256` pathFormat field Enum options: `PATH_FORMAT_BIP32` Path used to generate a wallet Account. addressFormat field Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` Optional human-readable name for the account. Length of mnemonic to generate the Wallet seed. Defaults to 12. Accepted values: 12, 15, 18, 21, 24. Disable email recovery for the sub-organization Disable email auth for the sub-organization deletePrivateKeysIntent field List of unique identifiers for private keys within an organization item field Optional parameter for deleting the private keys, even if any have not been previously exported. If they have been exported, this field is ignored. deleteWalletsIntent field List of unique identifiers for wallets within an organization item field Optional parameter for deleting the wallets, even if any have not been previously exported. If they have been exported, this field is ignored. createReadWriteSessionIntentV2 field Client-side public key generated by the user, to which the read write session bundle (credentials) will be encrypted. Optional unique identifier for a given User. If none provided, the read write session will be created for the user who is making the request. Optional human-readable name for an API Key. If none provided, default to Read Write Session - \ Expiration window (in seconds) indicating how long the API key is valid for. If not provided, a default of 15 minutes will be used. Invalidate all other previously generated ReadWriteSession API keys deleteSubOrganizationIntent field Sub-organization deletion, by default, requires associated wallets and private keys to be exported for security reasons. Set this boolean to true to force sub-organization deletion even if some wallets or private keys within it have not been exported yet. Default: false. initOtpAuthIntent field Enum to specify whether to send OTP via SMS or email Email or phone number to send the OTP code to emailCustomization field The name of the application. A URL pointing to a logo in PNG format. Note this logo will be resized to fit into 340px x 124px. A template for the URL to be used in a magic link button, e.g. `https://dapp.xyz/%s`. The auth bundle will be interpolated into the `%s`. JSON object containing key/value pairs to be used with custom templates. Unique identifier for a given Email Template. If not specified, the default is the most recent Email Template. smsCustomization field Template containing references to .OtpCode i.e Your OTP is \{\{.OtpCode}} Optional client-generated user identifier to enable per-user rate limiting for SMS auth. We recommend using a hash of the client-side IP address. Optional custom email address from which to send the OTP email Optional custom sender name for use with sendFromEmailAddress; if left empty, will default to 'Notifications' Optional custom email address to use as reply-to otpAuthIntent field ID representing the result of an init OTP activity. OTP sent out to a user's contact (email or SMS) Client-side public key generated by the user, to which the OTP bundle (credentials) will be encrypted. Optional human-readable name for an API Key. If none provided, default to OTP Auth - \ Expiration window (in seconds) indicating how long the API key is valid for. If not provided, a default of 15 minutes will be used. Invalidate all other previously generated OTP Auth API keys createSubOrganizationIntentV7 field Name for this sub-organization Root users to create within this sub-organization Human-readable name for a User. The user's email address. The user's phone number in E.164 format e.g. +13214567890 A list of API Key parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an API Key. The public component of a cryptographic key pair used to sign messages and transactions. curveType field Enum options: `API_KEY_CURVE_P256`, `API_KEY_CURVE_SECP256K1`, `API_KEY_CURVE_ED25519` Optional window (in seconds) indicating how long the API Key should last. A list of Authenticator parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an Authenticator. Challenge presented for authentication purposes. attestation field The cbor encoded then base64 url encoded id of the credential. A base64 url encoded payload containing metadata about the signing context and the challenge. A base64 url encoded payload containing authenticator data and any attestation the webauthn provider chooses. The type of authenticator transports. item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` A list of Oauth providers. This field, if not needed, should be an empty array in your request body. Human-readable name to identify a Provider. Base64 encoded OIDC token The threshold of unique approvals to reach root quorum. This value must be less than or equal to the number of root users wallet field Human-readable name for a Wallet. A list of wallet Accounts. This field, if not needed, should be an empty array in your request body. curve field Enum options: `CURVE_SECP256K1`, `CURVE_ED25519`, `CURVE_P256` pathFormat field Enum options: `PATH_FORMAT_BIP32` Path used to generate a wallet Account. addressFormat field Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` Optional human-readable name for the account. Length of mnemonic to generate the Wallet seed. Defaults to 12. Accepted values: 12, 15, 18, 21, 24. Disable email recovery for the sub-organization Disable email auth for the sub-organization Disable OTP SMS auth for the sub-organization Disable OTP email auth for the sub-organization Signed JWT containing a unique id, expiry, verification type, contact clientSignature field The public component of a cryptographic key pair used to create the signature. scheme field Enum options: `CLIENT_SIGNATURE_SCHEME_API_P256` The message that was signed. The cryptographic signature over the message. updateWalletIntent field Unique identifier for a given Wallet. Human-readable name for a Wallet. updatePolicyIntentV2 field Unique identifier for a given Policy. Human-readable name for a Policy. policyEffect field Enum options: `EFFECT_ALLOW`, `EFFECT_DENY` The condition expression that triggers the Effect (optional). The consensus expression that triggers the Effect (optional). Accompanying notes for a Policy (optional). createUsersIntentV3 field A list of Users. Human-readable name for a User. The user's email address. The user's phone number in E.164 format e.g. +13214567890 A list of API Key parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an API Key. The public component of a cryptographic key pair used to sign messages and transactions. curveType field Enum options: `API_KEY_CURVE_P256`, `API_KEY_CURVE_SECP256K1`, `API_KEY_CURVE_ED25519` Optional window (in seconds) indicating how long the API Key should last. A list of Authenticator parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an Authenticator. Challenge presented for authentication purposes. attestation field The cbor encoded then base64 url encoded id of the credential. A base64 url encoded payload containing metadata about the signing context and the challenge. A base64 url encoded payload containing authenticator data and any attestation the webauthn provider chooses. The type of authenticator transports. item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` A list of Oauth providers. This field, if not needed, should be an empty array in your request body. Human-readable name to identify a Provider. Base64 encoded OIDC token A list of User Tag IDs. This field, if not needed, should be an empty array in your request body. item field initOtpAuthIntentV2 field Enum to specify whether to send OTP via SMS or email Email or phone number to send the OTP code to Optional length of the OTP code. Default = 9 emailCustomization field The name of the application. A URL pointing to a logo in PNG format. Note this logo will be resized to fit into 340px x 124px. A template for the URL to be used in a magic link button, e.g. `https://dapp.xyz/%s`. The auth bundle will be interpolated into the `%s`. JSON object containing key/value pairs to be used with custom templates. Unique identifier for a given Email Template. If not specified, the default is the most recent Email Template. smsCustomization field Template containing references to .OtpCode i.e Your OTP is \{\{.OtpCode}} Optional client-generated user identifier to enable per-user rate limiting for SMS auth. We recommend using a hash of the client-side IP address. Optional custom email address from which to send the OTP email Optional flag to specify if the OTP code should be alphanumeric (Crockford’s Base32). Default = true Optional custom sender name for use with sendFromEmailAddress; if left empty, will default to 'Notifications' Optional custom email address to use as reply-to initOtpIntent field Whether to send OTP via SMS or email. Possible values: OTP\_TYPE\_SMS, OTP\_TYPE\_EMAIL Email or phone number to send the OTP code to Optional length of the OTP code. Default = 9 emailCustomization field The name of the application. A URL pointing to a logo in PNG format. Note this logo will be resized to fit into 340px x 124px. A template for the URL to be used in a magic link button, e.g. `https://dapp.xyz/%s`. The auth bundle will be interpolated into the `%s`. JSON object containing key/value pairs to be used with custom templates. Unique identifier for a given Email Template. If not specified, the default is the most recent Email Template. smsCustomization field Template containing references to .OtpCode i.e Your OTP is \{\{.OtpCode}} Optional client-generated user identifier to enable per-user rate limiting for SMS auth. We recommend using a hash of the client-side IP address. Optional custom email address from which to send the OTP email Optional flag to specify if the OTP code should be alphanumeric (Crockford’s Base32). Default = true Optional custom sender name for use with sendFromEmailAddress; if left empty, will default to 'Notifications' Expiration window (in seconds) indicating how long the OTP is valid for. If not provided, a default of 5 minutes will be used. Maximum value is 600 seconds (10 minutes) Optional custom email address to use as reply-to verifyOtpIntent field ID representing the result of an init OTP activity. OTP sent out to a user's contact (email or SMS) Expiration window (in seconds) indicating how long the verification token is valid for. If not provided, a default of 1 hour will be used. Maximum value is 86400 seconds (24 hours) Client-side public key generated by the user, which will be added to the JWT response and verified in subsequent requests via a client proof signature otpLoginIntent field Signed JWT containing a unique id, expiry, verification type, contact Client-side public key generated by the user, which will be conditionally added to org data based on the validity of the verification token Expiration window (in seconds) indicating how long the Session is valid for. If not provided, a default of 15 minutes will be used. Invalidate all other previously generated Login API keys clientSignature field The public component of a cryptographic key pair used to create the signature. scheme field Enum options: `CLIENT_SIGNATURE_SCHEME_API_P256` The message that was signed. The cryptographic signature over the message. Optional session profile ID to specify which Session Profile to use for this login. If not provided, the default read/write session will be used. stampLoginIntent field Client-side public key generated by the user, which will be conditionally added to org data based on the passkey stamp associated with this request Expiration window (in seconds) indicating how long the Session is valid for. If not provided, a default of 15 minutes will be used. Invalidate all other previously generated Login API keys Optional session profile ID to specify which Session Profile to use for this login. If not provided, the default read/write session will be used. oauthLoginIntent field Base64 encoded OIDC token Client-side public key generated by the user, which will be conditionally added to org data based on the validity of the oidc token associated with this request Expiration window (in seconds) indicating how long the Session is valid for. If not provided, a default of 15 minutes will be used. Invalidate all other previously generated Login API keys Optional session profile ID to specify which Session Profile to use for this login. If not provided, the default read/write session will be used. updateUserNameIntent field Unique identifier for a given User. Human-readable name for a User. updateUserEmailIntent field Unique identifier for a given User. The user's email address. Setting this to an empty string will remove the user's email. Signed JWT containing a unique id, expiry, verification type, contact updateUserPhoneNumberIntent field Unique identifier for a given User. The user's phone number in E.164 format e.g. +13214567890. Setting this to an empty string will remove the user's phone number. Signed JWT containing a unique id, expiry, verification type, contact initFiatOnRampIntent field onrampProvider field Enum options: `FIAT_ON_RAMP_PROVIDER_COINBASE`, `FIAT_ON_RAMP_PROVIDER_MOONPAY` Destination wallet address for the buy transaction. network field Enum options: `FIAT_ON_RAMP_BLOCKCHAIN_NETWORK_BITCOIN`, `FIAT_ON_RAMP_BLOCKCHAIN_NETWORK_ETHEREUM`, `FIAT_ON_RAMP_BLOCKCHAIN_NETWORK_SOLANA`, `FIAT_ON_RAMP_BLOCKCHAIN_NETWORK_BASE` cryptoCurrencyCode field Enum options: `FIAT_ON_RAMP_CRYPTO_CURRENCY_BTC`, `FIAT_ON_RAMP_CRYPTO_CURRENCY_ETH`, `FIAT_ON_RAMP_CRYPTO_CURRENCY_SOL`, `FIAT_ON_RAMP_CRYPTO_CURRENCY_USDC` fiatCurrencyCode field Enum options: `FIAT_ON_RAMP_CURRENCY_AUD`, `FIAT_ON_RAMP_CURRENCY_BGN`, `FIAT_ON_RAMP_CURRENCY_BRL`, `FIAT_ON_RAMP_CURRENCY_CAD`, `FIAT_ON_RAMP_CURRENCY_CHF`, `FIAT_ON_RAMP_CURRENCY_COP`, `FIAT_ON_RAMP_CURRENCY_CZK`, `FIAT_ON_RAMP_CURRENCY_DKK`, `FIAT_ON_RAMP_CURRENCY_DOP`, `FIAT_ON_RAMP_CURRENCY_EGP`, `FIAT_ON_RAMP_CURRENCY_EUR`, `FIAT_ON_RAMP_CURRENCY_GBP`, `FIAT_ON_RAMP_CURRENCY_HKD`, `FIAT_ON_RAMP_CURRENCY_IDR`, `FIAT_ON_RAMP_CURRENCY_ILS`, `FIAT_ON_RAMP_CURRENCY_JOD`, `FIAT_ON_RAMP_CURRENCY_KES`, `FIAT_ON_RAMP_CURRENCY_KWD`, `FIAT_ON_RAMP_CURRENCY_LKR`, `FIAT_ON_RAMP_CURRENCY_MXN`, `FIAT_ON_RAMP_CURRENCY_NGN`, `FIAT_ON_RAMP_CURRENCY_NOK`, `FIAT_ON_RAMP_CURRENCY_NZD`, `FIAT_ON_RAMP_CURRENCY_OMR`, `FIAT_ON_RAMP_CURRENCY_PEN`, `FIAT_ON_RAMP_CURRENCY_PLN`, `FIAT_ON_RAMP_CURRENCY_RON`, `FIAT_ON_RAMP_CURRENCY_SEK`, `FIAT_ON_RAMP_CURRENCY_THB`, `FIAT_ON_RAMP_CURRENCY_TRY`, `FIAT_ON_RAMP_CURRENCY_TWD`, `FIAT_ON_RAMP_CURRENCY_USD`, `FIAT_ON_RAMP_CURRENCY_VND`, `FIAT_ON_RAMP_CURRENCY_ZAR` Specifies a preset fiat amount for the transaction, e.g., '100'. Must be greater than '20'. If not provided, the user will be prompted to enter an amount. paymentMethod field Enum options: `FIAT_ON_RAMP_PAYMENT_METHOD_CREDIT_DEBIT_CARD`, `FIAT_ON_RAMP_PAYMENT_METHOD_APPLE_PAY`, `FIAT_ON_RAMP_PAYMENT_METHOD_GBP_BANK_TRANSFER`, `FIAT_ON_RAMP_PAYMENT_METHOD_GBP_OPEN_BANKING_PAYMENT`, `FIAT_ON_RAMP_PAYMENT_METHOD_GOOGLE_PAY`, `FIAT_ON_RAMP_PAYMENT_METHOD_SEPA_BANK_TRANSFER`, `FIAT_ON_RAMP_PAYMENT_METHOD_PIX_INSTANT_PAYMENT`, `FIAT_ON_RAMP_PAYMENT_METHOD_PAYPAL`, `FIAT_ON_RAMP_PAYMENT_METHOD_VENMO`, `FIAT_ON_RAMP_PAYMENT_METHOD_MOONPAY_BALANCE`, `FIAT_ON_RAMP_PAYMENT_METHOD_CRYPTO_ACCOUNT`, `FIAT_ON_RAMP_PAYMENT_METHOD_FIAT_WALLET`, `FIAT_ON_RAMP_PAYMENT_METHOD_ACH_BANK_ACCOUNT` ISO 3166-1 two-digit country code for Coinbase representing the purchasing user’s country of residence, e.g., US, GB. ISO 3166-2 two-digit country subdivision code for Coinbase representing the purchasing user’s subdivision of residence within their country, e.g. NY. Required if country\_code=US. Optional flag to indicate whether to use the sandbox mode to simulate transactions for the on-ramp provider. Default is false. Optional MoonPay Widget URL to sign when using MoonPay client SDKs with URL Signing enabled. createSmartContractInterfaceIntent field Corresponding contract address or program ID ABI/IDL as a JSON string. Limited to 400kb type field Enum options: `SMART_CONTRACT_INTERFACE_TYPE_ETHEREUM`, `SMART_CONTRACT_INTERFACE_TYPE_SOLANA` Human-readable name for a Smart Contract Interface. Notes for a Smart Contract Interface. deleteSmartContractInterfaceIntent field The ID of a Smart Contract Interface intended for deletion. enableAuthProxyIntent field disableAuthProxyIntent field updateAuthProxyConfigIntent field Updated list of allowed origins for CORS. item field Updated list of allowed proxy authentication methods. item field Custom 'from' address for auth-related emails. Custom reply-to address for auth-related emails. Template ID for email-auth messages. Template ID for OTP SMS messages. emailCustomizationParams field The name of the application. A URL pointing to a logo in PNG format. Note this logo will be resized to fit into 340px x 124px. A template for the URL to be used in a magic link button, e.g. `https://dapp.xyz/%s`. The auth bundle will be interpolated into the `%s`. JSON object containing key/value pairs to be used with custom templates. Unique identifier for a given Email Template. If not specified, the default is the most recent Email Template. smsCustomizationParams field Template containing references to .OtpCode i.e Your OTP is \{\{.OtpCode}} walletKitSettings field List of enabled social login providers (e.g., 'apple', 'google', 'facebook') item field Mapping of social login providers to their Oauth client IDs. Oauth redirect URL to be used for social login flows. OTP code lifetime in seconds. Verification-token lifetime in seconds. Session lifetime in seconds. Enable alphanumeric OTP codes. Desired OTP code length (6–9). Custom 'from' email sender for auth-related emails. Verification token required for get account with PII (email/phone number). Default false. Whitelisted OAuth client IDs for social account linking. When a user authenticates via a social provider with an email matching an existing account, the accounts will be linked if the client ID is in this list and the issuer is considered a trusted provider. item field createOauth2CredentialIntent field provider field Enum options: `OAUTH2_PROVIDER_X`, `OAUTH2_PROVIDER_DISCORD` The Client ID issued by the OAuth 2.0 provider The client secret issued by the OAuth 2.0 provider encrypted to the TLS Fetcher quorum key updateOauth2CredentialIntent field The ID of the OAuth 2.0 credential to update provider field Enum options: `OAUTH2_PROVIDER_X`, `OAUTH2_PROVIDER_DISCORD` The Client ID issued by the OAuth 2.0 provider The client secret issued by the OAuth 2.0 provider encrypted to the TLS Fetcher quorum key deleteOauth2CredentialIntent field The ID of the OAuth 2.0 credential to delete oauth2AuthenticateIntent field The OAuth 2.0 credential id whose client\_id and client\_secret will be used in the OAuth 2.0 flow The auth\_code provided by the OAuth 2.0 provider to the end user to be exchanged for a Bearer token in the OAuth 2.0 flow The URI the user is redirected to after they have authenticated with the OAuth 2.0 provider The code verifier used by OAuth 2.0 PKCE providers A nonce value set to sha256(publicKey), used to bind the OIDC token to a specific public key An optional P256 public key to which, if provided, the bearer token will be encrypted and returned via the `encrypted_bearer_token` claim of the OIDC Token deleteWalletAccountsIntent field List of unique identifiers for wallet accounts within an organization item field Optional parameter for deleting the wallet accounts, even if any have not been previously exported. If they have been exported, this field is ignored. deletePoliciesIntent field List of unique identifiers for policies within an organization item field ethSendRawTransactionIntent field The raw, signed transaction to be sent. CAIP-2 chain ID (e.g., 'eip155:1' for Ethereum mainnet). Enum options: `eip155:1`, `eip155:11155111`, `eip155:8453`, `eip155:84532`, `eip155:137`, `eip155:80002`, `eip155:56`, `eip155:97` ethSendTransactionIntent field A wallet or private key address to sign with. This does not support private key IDs. Whether to sponsor this transaction via Gas Station. CAIP-2 chain ID (e.g., 'eip155:1' for Ethereum mainnet). Enum options: `eip155:1`, `eip155:11155111`, `eip155:8453`, `eip155:84532`, `eip155:137`, `eip155:80002`, `eip155:56`, `eip155:97` Recipient address as a hex string with 0x prefix. Amount of native asset to send in wei. Hex-encoded call data for contract interactions. Transaction nonce, for EIP-1559 and Turnkey Gas Station authorizations. Maximum amount of gas to use for this transaction, for EIP-1559 transactions. Maximum total fee per gas unit (base fee + priority fee) in wei. Required for non-sponsored (EIP-1559) transactions. Not used for sponsored transactions. Maximum priority fee (tip) per gas unit in wei. Required for non-sponsored (EIP-1559) transactions. Not used for sponsored transactions. Unix timestamp in seconds for EIP-712 execution deadline. Only used when sponsor=true. The gas station delegate contract nonce. Only used when sponsor=true. Include this if you want maximal security posture. createFiatOnRampCredentialIntent field onrampProvider field Enum options: `FIAT_ON_RAMP_PROVIDER_COINBASE`, `FIAT_ON_RAMP_PROVIDER_MOONPAY` Project ID for the on-ramp provider. Some providers, like Coinbase, require this additional identifier Publishable API key for the on-ramp provider Secret API key for the on-ramp provider encrypted to our on-ramp encryption public key Private API key for the on-ramp provider encrypted to our on-ramp encryption public key. Some providers, like Coinbase, require this additional key. If the on-ramp credential is a sandbox credential updateFiatOnRampCredentialIntent field The ID of the fiat on-ramp credential to update onrampProvider field Enum options: `FIAT_ON_RAMP_PROVIDER_COINBASE`, `FIAT_ON_RAMP_PROVIDER_MOONPAY` Project ID for the on-ramp provider. Some providers, like Coinbase, require this additional identifier. Publishable API key for the on-ramp provider Secret API key for the on-ramp provider encrypted to our on-ramp encryption public key Private API key for the on-ramp provider encrypted to our on-ramp encryption public key. Some providers, like Coinbase, require this additional key. deleteFiatOnRampCredentialIntent field The ID of the fiat on-ramp credential to delete emailAuthIntentV3 field Email of the authenticating user. Client-side public key generated by the user, to which the email auth bundle (credentials) will be encrypted. Optional human-readable name for an API Key. If none provided, default to Email Auth - \ Expiration window (in seconds) indicating how long the API key is valid for. If not provided, a default of 15 minutes will be used. emailCustomization field The name of the application. This field is required and will be used in email notifications if an email template is not provided. A URL pointing to a logo in PNG format. Note this logo will be resized to fit into 340px x 124px. A template for the URL to be used in a magic link button, e.g. `https://dapp.xyz/%s`. The auth bundle will be interpolated into the `%s`. JSON object containing key/value pairs to be used with custom templates. Unique identifier for a given Email Template. If not specified, the default is the most recent Email Template. Invalidate all other previously generated Email Auth API keys Optional custom email address from which to send the email Optional custom sender name for use with sendFromEmailAddress; if left empty, will default to 'Notifications' Optional custom email address to use as reply-to initUserEmailRecoveryIntentV2 field Email of the user starting recovery Client-side public key generated by the user, to which the recovery bundle will be encrypted. Expiration window (in seconds) indicating how long the recovery credential is valid for. If not provided, a default of 15 minutes will be used. emailCustomization field The name of the application. This field is required and will be used in email notifications if an email template is not provided. A URL pointing to a logo in PNG format. Note this logo will be resized to fit into 340px x 124px. A template for the URL to be used in a magic link button, e.g. `https://dapp.xyz/%s`. The auth bundle will be interpolated into the `%s`. JSON object containing key/value pairs to be used with custom templates. Unique identifier for a given Email Template. If not specified, the default is the most recent Email Template. Optional custom email address from which to send the OTP email Optional custom sender name for use with sendFromEmailAddress; if left empty, will default to 'Notifications' Optional custom email address to use as reply-to initOtpIntentV2 field Whether to send OTP via SMS or email. Possible values: OTP\_TYPE\_SMS, OTP\_TYPE\_EMAIL Email or phone number to send the OTP code to Optional length of the OTP code. Default = 9 The name of the application. This field is required and will be used in email notifications if an email template is not provided. emailCustomization field A URL pointing to a logo in PNG format. Note this logo will be resized to fit into 340px x 124px. A template for the URL to be used in a magic link button, e.g. `https://dapp.xyz/%s`. The auth bundle will be interpolated into the `%s`. JSON object containing key/value pairs to be used with custom templates. Unique identifier for a given Email Template. If not specified, the default is the most recent Email Template. smsCustomization field Template containing references to .OtpCode i.e Your OTP is \{\{.OtpCode}} Optional client-generated user identifier to enable per-user rate limiting for SMS auth. We recommend using a hash of the client-side IP address. Optional custom email address from which to send the OTP email Optional flag to specify if the OTP code should be alphanumeric (Crockford’s Base32). Default = true Optional custom sender name for use with sendFromEmailAddress; if left empty, will default to 'Notifications' Expiration window (in seconds) indicating how long the OTP is valid for. If not provided, a default of 5 minutes will be used. Maximum value is 600 seconds (10 minutes) Optional custom email address to use as reply-to initOtpAuthIntentV3 field Whether to send OTP via SMS or email. Possible values: OTP\_TYPE\_SMS, OTP\_TYPE\_EMAIL Email or phone number to send the OTP code to Optional length of the OTP code. Default = 9 The name of the application. This field is required and will be used in email notifications if an email template is not provided. emailCustomization field A URL pointing to a logo in PNG format. Note this logo will be resized to fit into 340px x 124px. A template for the URL to be used in a magic link button, e.g. `https://dapp.xyz/%s`. The auth bundle will be interpolated into the `%s`. JSON object containing key/value pairs to be used with custom templates. Unique identifier for a given Email Template. If not specified, the default is the most recent Email Template. smsCustomization field Template containing references to .OtpCode i.e Your OTP is \{\{.OtpCode}} Optional client-generated user identifier to enable per-user rate limiting for SMS auth. We recommend using a hash of the client-side IP address. Optional custom email address from which to send the OTP email Optional flag to specify if the OTP code should be alphanumeric (Crockford’s Base32). Default = true Optional custom sender name for use with sendFromEmailAddress; if left empty, will default to 'Notifications' Expiration window (in seconds) indicating how long the OTP is valid for. If not provided, a default of 5 minutes will be used. Maximum value is 600 seconds (10 minutes) Optional custom email address to use as reply-to upsertGasUsageConfigIntent field Gas sponsorship USD limit for the billing organization window. Gas sponsorship USD limit for sub-organizations under the billing organization. Rolling sponsorship window duration, expressed in minutes. This value can't exceed 30 days (43200 minutes). Whether gas sponsorship is enabled for the organization. solanaConfig field Whether Solana rent prefunding is enabled for the organization. When omitted, the existing rent-prefund state is left unchanged. createTvcAppIntent field The name of the new TVC application Quorum public key to use for this application Unique identifier for an existing TVC operator set to use as the Manifest Set for this TVC application. If left empty, a new Manifest Set configuration is required manifestSetParams field Short description for this new operator set Operators to create as part of this new operator set The name for this new operator Public key for this operator Existing operators to use as part of this new operator set item field The threshold of operators needed to reach consensus in this new Operator Set Unique identifier for an existing TVC operator set to use as the Share Set for this TVC application. If left empty, a new Share Set configuration is required shareSetParams field Short description for this new operator set Operators to create as part of this new operator set The name for this new operator Public key for this operator Existing operators to use as part of this new operator set item field The threshold of operators needed to reach consensus in this new Operator Set Enables network egress for this TVC app. Default if not provided: false. When true, this app may create deployments in debug-mode. Debug-mode deployments expose logs and emit zero'd attestation PCRs, so remote attestation cannot succeed. Cannot be changed after app creation. Setting this true means the app's quorum key is considered permanently insecure, and a new app with a fresh quorum key must be created. Default if not provided: false. createTvcDeploymentIntent field The unique identifier of the to-be-deployed TVC application The QuorumOS version to use to deploy this application URL of the container containing the pivot binary Location of the binary in the pivot container Arguments to pass to the pivot binary at startup. Encoded as a list of strings, for example \["--foo", "bar"] item field Digest of the pivot binary in the pivot container. This value will be inserted in the QOS manifest to ensure application integrity. Optional nonce to ensure uniqueness of the deployment manifest. If not provided, it defaults to the current Unix timestamp in seconds. Optional encrypted pull secret to authorize Turnkey to pull the pivot container image. If your image is public, leave this empty. Optional flag to indicate whether to deploy the TVC app in debug mode, which includes additional logging and debugging tools. Default is false. healthCheckType field Enum options: `TVC_HEALTH_CHECK_TYPE_HTTP`, `TVC_HEALTH_CHECK_TYPE_GRPC` Port to use for health checks. Port to use for public ingress. createTvcManifestApprovalsIntent field Unique identifier of the TVC deployment to approve List of manifest approvals Unique identifier of the operator providing this approval Signature from the operator approving the manifest solSendTransactionIntent field Base64-encoded serialized unsigned Solana transaction A wallet or private key address to sign with. This does not support private key IDs. Whether to sponsor this transaction via Gas Station. CAIP-2 chain ID (e.g., 'solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp' for Solana mainnet). Human-readable Solana aliases ('solana:mainnet', 'solana:devnet') are also accepted and normalized to canonical CAIP-2 values. Enum options: `solana:mainnet`, `solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp`, `solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdpKuc147dw2N9d`, `solana:devnet`, `solana:EtWTRABZaYq6iMfeYKouRu166VU2xqa1`, `solana:EtWTRABZaYq6iMfeYKouRu166VU2xqa1wcaWoxPkrZBG` user-provided blockhash for replay protection / deadline control. If omitted and sponsor=true, we fetch a fresh blockhash during execution initOtpIntentV3 field Whether to send OTP via SMS or email. Possible values: OTP\_TYPE\_SMS, OTP\_TYPE\_EMAIL Email or phone number to send the OTP code to The name of the application. Optional length of the OTP code. Default = 9 emailCustomization field A URL pointing to a logo in PNG format. Note this logo will be resized to fit into 340px x 124px. A template for the URL to be used in a magic link button, e.g. `https://dapp.xyz/%s`. The auth bundle will be interpolated into the `%s`. JSON object containing key/value pairs to be used with custom templates. Unique identifier for a given Email Template. If not specified, the default is the most recent Email Template. smsCustomization field Template containing references to .OtpCode i.e Your OTP is \{\{.OtpCode}} Optional client-generated user identifier to enable per-user rate limiting for SMS auth. We recommend using a hash of the client-side IP address. Optional custom email address from which to send the OTP email Optional flag to specify if the OTP code should be alphanumeric (Crockford’s Base32). If set to false, OTP code will only be numeric. Default = true Optional custom sender name for use with sendFromEmailAddress; if left empty, will default to 'Notifications' Expiration window (in seconds) indicating how long the OTP is valid for. If not provided, a default of 5 minutes will be used. Maximum value is 600 seconds (10 minutes) Optional custom email address to use as reply-to verifyOtpIntentV2 field UUID representing an OTP flow. A new UUID is created for each init OTP activity. Encrypted bundle containing the OTP code and a client-generated public key. Turnkey's secure enclaves will decrypt this bundle, verify the OTP code, and issue a new Verification Token. Encrypted using the target encryption key provided in the INIT\_OTP activity result. Expiration window (in seconds) indicating how long the verification token is valid for. If not provided, a default of 1 hour will be used. Maximum value is 86400 seconds (24 hours) otpLoginIntentV2 field Signed Verification Token containing a unique id, expiry, verification type, contact Client-side public key generated by the user, used as the session public key upon successful login clientSignature field The public component of a cryptographic key pair used to create the signature. scheme field Enum options: `CLIENT_SIGNATURE_SCHEME_API_P256` The message that was signed. The cryptographic signature over the message. Expiration window (in seconds) indicating how long the Session is valid for. If not provided, a default of 15 minutes will be used. Invalidate all other previously generated Login sessions Optional session profile ID to specify which Session Profile to use for this login. If not provided, the default read/write session will be used. updateOrganizationNameIntent field New name for the Organization. createSubOrganizationIntentV8 field Name for this sub-organization Root users to create within this sub-organization Human-readable name for a User. The user's email address. The user's phone number in E.164 format e.g. +13214567890 A list of API Key parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an API Key. The public component of a cryptographic key pair used to sign messages and transactions. curveType field Enum options: `API_KEY_CURVE_P256`, `API_KEY_CURVE_SECP256K1`, `API_KEY_CURVE_ED25519` Optional window (in seconds) indicating how long the API Key should last. A list of Authenticator parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an Authenticator. Challenge presented for authentication purposes. attestation field The cbor encoded then base64 url encoded id of the credential. A base64 url encoded payload containing metadata about the signing context and the challenge. A base64 url encoded payload containing authenticator data and any attestation the webauthn provider chooses. The type of authenticator transports. item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` A list of Oauth providers. This field, if not needed, should be an empty array in your request body. Human-readable name to identify a Provider. Base64 encoded OIDC token oidcClaims field The issuer identifier from the OIDC token (iss claim) The subject identifier from the OIDC token (sub claim) The audience from the OIDC token (aud claim) The threshold of unique approvals to reach root quorum. This value must be less than or equal to the number of root users wallet field Human-readable name for a Wallet. A list of wallet Accounts. This field, if not needed, should be an empty array in your request body. curve field Enum options: `CURVE_SECP256K1`, `CURVE_ED25519`, `CURVE_P256` pathFormat field Enum options: `PATH_FORMAT_BIP32` Path used to generate a wallet Account. addressFormat field Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` Optional human-readable name for the account. Length of mnemonic to generate the Wallet seed. Defaults to 12. Accepted values: 12, 15, 18, 21, 24. Disable email recovery for the sub-organization Disable email auth for the sub-organization Disable OTP SMS auth for the sub-organization Disable OTP email auth for the sub-organization Signed JWT containing a unique id, expiry, verification type, contact clientSignature field The public component of a cryptographic key pair used to create the signature. scheme field Enum options: `CLIENT_SIGNATURE_SCHEME_API_P256` The message that was signed. The cryptographic signature over the message. createOauthProvidersIntentV2 field The ID of the User to add an Oauth provider to A list of Oauth providers. Human-readable name to identify a Provider. Base64 encoded OIDC token oidcClaims field The issuer identifier from the OIDC token (iss claim) The subject identifier from the OIDC token (sub claim) The audience from the OIDC token (aud claim) createUsersIntentV4 field A list of Users. Human-readable name for a User. The user's email address. The user's phone number in E.164 format e.g. +13214567890 A list of API Key parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an API Key. The public component of a cryptographic key pair used to sign messages and transactions. curveType field Enum options: `API_KEY_CURVE_P256`, `API_KEY_CURVE_SECP256K1`, `API_KEY_CURVE_ED25519` Optional window (in seconds) indicating how long the API Key should last. A list of Authenticator parameters. This field, if not needed, should be an empty array in your request body. Human-readable name for an Authenticator. Challenge presented for authentication purposes. attestation field The cbor encoded then base64 url encoded id of the credential. A base64 url encoded payload containing metadata about the signing context and the challenge. A base64 url encoded payload containing authenticator data and any attestation the webauthn provider chooses. The type of authenticator transports. item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` A list of Oauth providers. This field, if not needed, should be an empty array in your request body. Human-readable name to identify a Provider. Base64 encoded OIDC token oidcClaims field The issuer identifier from the OIDC token (iss claim) The subject identifier from the OIDC token (sub claim) The audience from the OIDC token (aud claim) A list of User Tag IDs. This field, if not needed, should be an empty array in your request body. item field createWebhookEndpointIntent field The destination URL for webhook delivery. Human-readable name for this webhook endpoint. Event subscriptions to create for this endpoint. The event type to subscribe to (for example, ACTIVITY\_UPDATES, BALANCE\_CONFIRMED\_UPDATES, or BALANCE\_FINALIZED\_UPDATES). JSON-encoded filter criteria for this subscription. Whether this subscription is active. updateWebhookEndpointIntent field Unique identifier of the webhook endpoint to update. Updated destination URL for webhook delivery. Updated human-readable name for this webhook endpoint. Whether this webhook endpoint is active. deleteWebhookEndpointIntent field Unique identifier of the webhook endpoint to delete. setIpAllowlistIntent field The public component of an API key. If null, the IP allowlist applies at the organization level. If set, it applies only to this specific API key. Whether the IP allowlist is enabled. Only meaningful for organization-level allowlists. Omit for API key-level allowlists. List of IP allowlist rules with CIDR blocks and optional labels. CIDR block (e.g., '192.168.1.0/24', '2001:db8::/32'). Optional human-readable label for this rule (e.g., 'Office VPN'). Behavior when an error occurs during IP allowlist evaluation. Valid values: ALLOW, DENY. Defaults to DENY. removeIpAllowlistIntent field The public component of an API key. If null, removes the organization-level IP allowlist. If set, removes the IP allowlist for this specific API key. updateTvcAppLiveDeploymentIntent field The unique identifier of the TVC deployment to set as live for the app. deleteTvcDeploymentIntent field The unique identifier of the TVC deployment to delete. deleteTvcAppAndDeploymentsIntent field The unique identifier of the TVC app to delete. The app and all associated deployments will be removed. restoreTvcDeploymentIntent field The unique identifier of the TVC deployment to restore. sparkSignFrostIntent field A Spark wallet account address identifying the wallet to sign with. Batched sign requests. Each produces a partial signature plus Turnkey's public commitments. derivation field identity field signingLeaf field Unique identifier for the Spark signing leaf. deposit field staticDeposit field Index used to derive the static deposit key. htlcPreimage field Hex-encoded 32-byte sighash to sign. Aggregate group verifying key (hex-encoded compressed secp256k1 point), computed as P\_ops + P\_user. Bound into the nonce HMAC. Commitments for every non-Turnkey participant. MUST NOT include an entry under Turnkey's identifier. Bound into the nonce HMAC. FROST participant identifier, hex-encoded (32-byte scalar). Hiding commitment D, hex-encoded compressed secp256k1 point. Binding commitment E, hex-encoded compressed secp256k1 point. Optional adaptor point T (hex-encoded 33-byte compressed secp256k1 pubkey). When set, Turnkey produces a Schnorr adaptor pre-signature with the FROST challenge bound to `R+T` (where `R` is the aggregate group nonce commitment from FROST). The party holding the discrete log `t` completes the pre-sig to a valid BIP-340 signature by adding `t` (or `-t`, for parity) to the signature scalar `s`. This is primarily used by Spark leaves-swap and other adaptor-bound flows; absent or empty leads to plain FROST signing (the typical case). sparkPrepareTransferIntent field A Spark wallet account address identifying the wallet. transfer field Spark transfer identifier (UUID). Leaves being transferred. Leaf identifier (UUID). oldLeafDerivation field identity field signingLeaf field Unique identifier for the Spark signing leaf. deposit field staticDeposit field Index used to derive the static deposit key. htlcPreimage field newLeafDerivation field identity field signingLeaf field Unique identifier for the Spark signing leaf. deposit field staticDeposit field Index used to derive the static deposit key. htlcPreimage field Client-produced CPFP refund signature (hex-encoded), passed through verbatim into the per-operator SendLeafKeyTweak. Empty omits the field from the operator package. Client-produced direct refund signature (hex-encoded). Passed through verbatim. Client-produced direct-from-CPFP refund signature (hex-encoded). Passed through verbatim. Feldman VSS threshold for reconstructing the per-leaf tweak scalar. Operators that will receive Feldman shares of the per-leaf tweak. Order must match the operators' numeric IDs in the Spark operator config - share index is the 1-based position in this list. Spark operator identifier (UUID). Operator's ECIES encryption pubkey (hex-encoded compressed secp256k1 point). Recipient's identity pubkey (hex-encoded compressed secp256k1 point). Each leaf's new\_priv is ECIES-encrypted to this key and embedded in the per-operator package for claim-time delivery. sparkClaimTransferIntent field A Spark wallet account address identifying the wallet. claim field Leaves being claimed. Leaf identifier (UUID). ECIES ciphertext (hex-encoded) containing the inbound transfer secret. Decrypted inside the enclave using the wallet's Identity key. Hex-encoded 64-byte compact ECDSA signature binding (leaf\_id, transfer\_id, ciphertext) to the sender's identity key. Verified inside the enclave before decryption. Shamir threshold for reconstructing the per-leaf claim secret. Operators that will receive Shamir shares. Spark operator identifier (UUID). Operator's ECIES encryption pubkey (hex-encoded compressed secp256k1 point). Spark transfer identifier (UUID). Used together with each leaf's sender\_signature to verify the sender bound this ciphertext to this transfer. Sender's compressed secp256k1 identity public key (hex-encoded, 33 bytes). Used to verify the per-leaf sender\_signature fields. sparkPrepareLightningReceiveIntent field A Spark wallet account address identifying the wallet. lightningReceive field Feldman VSS threshold for reconstructing the preimage. Operators that will receive Feldman shares of the preimage. Order must match the operators' numeric IDs in the Spark operator config - share index is the 1-based position in this list. Spark operator identifier (UUID). Operator's ECIES encryption pubkey (hex-encoded compressed secp256k1 point). postTvcQuorumKeyShareIntent field Unique identifier of the TVC deployment receiving quorum key share Hex-encoded ephemeral public key used to encrypt the quorum key share shareApprovalBundle field Unique identifier of the operator providing this quorum key share Hex-encoded re-encrypted quorum key share Signature from the share set operator approving the manifest ethSendTransactionIntentV2 field A wallet or private key address to sign with. This does not support private key IDs. CAIP-2 chain ID (e.g., 'eip155:1' for Ethereum mainnet). Enum options: `eip155:1`, `eip155:11155111`, `eip155:8453`, `eip155:84532`, `eip155:137`, `eip155:80002`, `eip155:56`, `eip155:97` Whether to sponsor this transaction via Gas Station. If false or unset, the EOA pays gas. A single call uses EIP-1559; multiple calls use EIP-7702 batch execution via Gas Station. Outer transaction nonce. Omit to auto-fetch. Maximum amount of gas for the outer transaction. Omit to auto-estimate. Maximum total fee per gas unit (base fee + priority fee) in wei. Omit to auto-estimate. Maximum priority fee (tip) per gas unit in wei. Omit to auto-estimate. Unix timestamp in seconds for EIP-712 execution deadline. Only used when sponsor=true. The gas station delegate contract nonce. Only used when sponsor=true. Omit to auto-fetch. Ordered list of calls to execute. Must contain between 1 and 50 entries. A single entry with sponsor=false uses EIP-1559; multiple entries use EIP-7702 batch execution via Gas Station. Recipient address as a hex string with 0x prefix. Amount of native asset to send in wei. Hex-encoded call data for contract interactions. createMfaPolicyIntent field The ID of the User to add the MFA Policy to. Human-readable name for a Policy. A condition expression that evaluates to true or false, determining when this MFA policy applies. An ordered list of authentication requirements. Each requirement must be satisfied sequentially to complete MFA. A list of authentication methods for this MFA step. If only one method is provided, it is required. If multiple are provided, the user must satisfy ANY one of them. type field Enum options: `AUTHENTICATION_TYPE_EMAIL_OTP`, `AUTHENTICATION_TYPE_SMS_OTP`, `AUTHENTICATION_TYPE_PASSKEY`, `AUTHENTICATION_TYPE_API_KEY`, `AUTHENTICATION_TYPE_OAUTH`, `AUTHENTICATION_TYPE_SESSION` Optional specific authenticator ID required (e.g., UUID of a passkey authenticator). If not provided, any authenticator of the specified type can be used. The order in which this MFA policy is evaluated, starting from 0, relative to other MFA policies. Lower order values are evaluated first. Notes for an MFA Policy. updateMfaPolicyIntent field The ID of the User to update the MFA Policy for. Unique identifier for a given MFA Policy. Human-readable name for a Policy. A condition expression that evaluates to true or false, determining when this MFA policy applies. An ordered list of authentication requirements. Each requirement must be satisfied sequentially to complete MFA. A list of authentication methods for this MFA step. If only one method is provided, it is required. If multiple are provided, the user must satisfy ANY one of them. type field Enum options: `AUTHENTICATION_TYPE_EMAIL_OTP`, `AUTHENTICATION_TYPE_SMS_OTP`, `AUTHENTICATION_TYPE_PASSKEY`, `AUTHENTICATION_TYPE_API_KEY`, `AUTHENTICATION_TYPE_OAUTH`, `AUTHENTICATION_TYPE_SESSION` Optional specific authenticator ID required (e.g., UUID of a passkey authenticator). If not provided, any authenticator of the specified type can be used. The order in which this MFA policy is evaluated, starting from 0, relative to other MFA policies. Lower order values are evaluated first. Notes for an MFA Policy. deleteMfaPolicyIntent field The ID of the User to delete the MFA Policy from. Unique identifier for a given MFA Policy. createSessionProfileIntent field Human-readable name for a Session Profile. The scope string that defines the permissions for this Session Profile. The duration in seconds for which sessions created with this Session Profile are valid. If not set, expiration will be determined by the value passed in to the intent of login activities. Notes for a Session Profile. result field createOrganizationResult field Unique identifier for a given Organization. createAuthenticatorsResult field A list of Authenticator IDs. item field createUsersResult field A list of User IDs. item field createPrivateKeysResult field A list of Private Key IDs. item field createInvitationsResult field A list of Invitation IDs item field acceptInvitationResult field Unique identifier for a given Invitation. Unique identifier for a given User. signRawPayloadResult field Component of an ECSDA signature. Component of an ECSDA signature. Component of an ECSDA signature. createPolicyResult field Unique identifier for a given Policy. disablePrivateKeyResult field Unique identifier for a given Private Key. deleteUsersResult field A list of User IDs. item field deleteAuthenticatorsResult field Unique identifier for a given Authenticator. item field deleteInvitationResult field Unique identifier for a given Invitation. deleteOrganizationResult field Unique identifier for a given Organization. deletePolicyResult field Unique identifier for a given Policy. createUserTagResult field Unique identifier for a given User Tag. A list of User IDs. item field deleteUserTagsResult field A list of User Tag IDs. item field A list of User IDs. item field signTransactionResult field signedTransaction field deleteApiKeysResult field A list of API Key IDs. item field createApiKeysResult field A list of API Key IDs. item field createPrivateKeyTagResult field Unique identifier for a given Private Key Tag. A list of Private Key IDs. item field deletePrivateKeyTagsResult field A list of Private Key Tag IDs. item field A list of Private Key IDs. item field setPaymentMethodResult field The last four digits of the credit card added. The name associated with the payment method. The email address associated with the payment method. activateBillingTierResult field The id of the product being subscribed to. deletePaymentMethodResult field The payment method that was removed. createApiOnlyUsersResult field A list of API-only User IDs. item field updateRootQuorumResult field updateUserTagResult field Unique identifier for a given User Tag. updatePrivateKeyTagResult field Unique identifier for a given Private Key Tag. createSubOrganizationResult field subOrganizationId field rootUserIds field item field updateAllowedOriginsResult field createPrivateKeysResultV2 field A list of Private Key IDs and addresses. privateKeyId field addresses field format field Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` address field updateUserResult field A User ID. updatePolicyResult field Unique identifier for a given Policy. createSubOrganizationResultV3 field subOrganizationId field A list of Private Key IDs and addresses. privateKeyId field addresses field format field Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` address field rootUserIds field item field createWalletResult field Unique identifier for a Wallet. A list of account addresses. item field createWalletAccountsResult field A list of derived addresses. item field initUserEmailRecoveryResult field Unique identifier for the user being recovered. recoverUserResult field ID of the authenticator created. item field setOrganizationFeatureResult field Resulting list of organization features. name field Enum options: `FEATURE_NAME_ROOT_USER_EMAIL_RECOVERY`, `FEATURE_NAME_WEBAUTHN_ORIGINS`, `FEATURE_NAME_EMAIL_AUTH`, `FEATURE_NAME_EMAIL_RECOVERY`, `FEATURE_NAME_WEBHOOK`, `FEATURE_NAME_SMS_AUTH`, `FEATURE_NAME_OTP_EMAIL_AUTH`, `FEATURE_NAME_AUTH_PROXY`, `FEATURE_NAME_SOLANA_RENT_PREFUND_ENABLED` value field removeOrganizationFeatureResult field Resulting list of organization features. name field Enum options: `FEATURE_NAME_ROOT_USER_EMAIL_RECOVERY`, `FEATURE_NAME_WEBAUTHN_ORIGINS`, `FEATURE_NAME_EMAIL_AUTH`, `FEATURE_NAME_EMAIL_RECOVERY`, `FEATURE_NAME_WEBHOOK`, `FEATURE_NAME_SMS_AUTH`, `FEATURE_NAME_OTP_EMAIL_AUTH`, `FEATURE_NAME_AUTH_PROXY`, `FEATURE_NAME_SOLANA_RENT_PREFUND_ENABLED` value field exportPrivateKeyResult field Unique identifier for a given Private Key. Export bundle containing a private key encrypted to the client's target public key. exportWalletResult field Unique identifier for a given Wallet. Export bundle containing a wallet mnemonic + optional newline passphrase encrypted by the client's target public key. createSubOrganizationResultV4 field subOrganizationId field wallet field walletId field A list of account addresses. item field rootUserIds field item field emailAuthResult field Unique identifier for the authenticating User. Unique identifier for the created API key. exportWalletAccountResult field Address to identify Wallet Account. Export bundle containing a private key encrypted by the client's target public key. initImportWalletResult field Import bundle containing a public key and signature to use for importing client data. importWalletResult field Unique identifier for a Wallet. A list of account addresses. item field initImportPrivateKeyResult field Import bundle containing a public key and signature to use for importing client data. importPrivateKeyResult field Unique identifier for a Private Key. A list of addresses. format field Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` address field createPoliciesResult field A list of unique identifiers for the created policies. item field signRawPayloadsResult field signatures field Component of an ECSDA signature. Component of an ECSDA signature. Component of an ECSDA signature. createReadOnlySessionResult field Unique identifier for a given Organization. If the request is being made by a user and their Sub-Organization ID is unknown, this can be the Parent Organization ID. However, using the Sub-Organization ID is preferred due to performance reasons. Human-readable name for an Organization. Unique identifier for a given User. Human-readable name for a User. String representing a read only session UTC timestamp in seconds representing the expiry time for the read only session. createOauthProvidersResult field A list of unique identifiers for Oauth Providers item field deleteOauthProvidersResult field A list of unique identifiers for Oauth Providers item field createSubOrganizationResultV5 field subOrganizationId field wallet field walletId field A list of account addresses. item field rootUserIds field item field oauthResult field Unique identifier for the authenticating User. Unique identifier for the created API key. HPKE encrypted credential bundle createReadWriteSessionResult field Unique identifier for a given Organization. If the request is being made by a user and their Sub-Organization ID is unknown, this can be the Parent Organization ID. However, using the Sub-Organization ID is preferred due to performance reasons. Human-readable name for an Organization. Unique identifier for a given User. Human-readable name for a User. Unique identifier for the created API key. HPKE encrypted credential bundle createSubOrganizationResultV6 field subOrganizationId field wallet field walletId field A list of account addresses. item field rootUserIds field item field deletePrivateKeysResult field A list of private key unique identifiers that were removed item field deleteWalletsResult field A list of wallet unique identifiers that were removed item field createReadWriteSessionResultV2 field Unique identifier for a given Organization. If the request is being made by a user and their Sub-Organization ID is unknown, this can be the Parent Organization ID. However, using the Sub-Organization ID is preferred due to performance reasons. Human-readable name for an Organization. Unique identifier for a given User. Human-readable name for a User. Unique identifier for the created API key. HPKE encrypted credential bundle deleteSubOrganizationResult field Unique identifier of the sub organization that was removed initOtpAuthResult field Unique identifier for an OTP authentication otpAuthResult field Unique identifier for the authenticating User. Unique identifier for the created API key. HPKE encrypted credential bundle createSubOrganizationResultV7 field subOrganizationId field wallet field walletId field A list of account addresses. item field rootUserIds field item field updateWalletResult field A Wallet ID. updatePolicyResultV2 field Unique identifier for a given Policy. initOtpAuthResultV2 field Unique identifier for an OTP authentication initOtpResult field Unique identifier for an OTP authentication verifyOtpResult field Signed JWT containing a unique id, expiry, verification type, contact. Verification status of a user is updated when the token is consumed (in OTP\_LOGIN requests) otpLoginResult field Signed JWT containing an expiry, public key, session type, user id, and organization id stampLoginResult field Signed JWT containing an expiry, public key, session type, user id, and organization id oauthLoginResult field Signed JWT containing an expiry, public key, session type, user id, and organization id updateUserNameResult field Unique identifier of the User whose name was updated. updateUserEmailResult field Unique identifier of the User whose email was updated. updateUserPhoneNumberResult field Unique identifier of the User whose phone number was updated. initFiatOnRampResult field Unique URL for a given fiat on-ramp flow. Unique identifier used to retrieve transaction statuses for a given fiat on-ramp flow. Optional signature of the MoonPay Widget URL. The signature is generated if the Init Fiat On Ramp intent includes the urlForSignature field. The signature can be used to initialize the MoonPay SDKs when URL signing is enabled for your project. createSmartContractInterfaceResult field The ID of the created Smart Contract Interface. deleteSmartContractInterfaceResult field The ID of the deleted Smart Contract Interface. enableAuthProxyResult field A User ID with permission to initiate authentication. disableAuthProxyResult field updateAuthProxyConfigResult field Unique identifier for a given User. (representing the turnkey signer user id) createOauth2CredentialResult field Unique identifier of the OAuth 2.0 credential that was created updateOauth2CredentialResult field Unique identifier of the OAuth 2.0 credential that was updated deleteOauth2CredentialResult field Unique identifier of the OAuth 2.0 credential that was deleted oauth2AuthenticateResult field Base64 encoded OIDC token issued by Turnkey to be used with the LoginWithOAuth activity deleteWalletAccountsResult field A list of wallet account unique identifiers that were removed item field deletePoliciesResult field A list of unique identifiers for the deleted policies. item field ethSendRawTransactionResult field The transaction hash of the sent transaction createFiatOnRampCredentialResult field Unique identifier of the Fiat On-Ramp credential that was created updateFiatOnRampCredentialResult field Unique identifier of the Fiat On-Ramp credential that was updated deleteFiatOnRampCredentialResult field Unique identifier of the Fiat On-Ramp credential that was deleted ethSendTransactionResult field The send\_transaction\_status ID associated with the transaction submission upsertGasUsageConfigResult field Unique identifier for the gas usage configuration that was created or updated. createTvcAppResult field The unique identifier for the TVC application The unique identifier for the TVC manifest set The unique identifier(s) of the manifest set operators item field The required number of approvals for the manifest set createTvcDeploymentResult field The unique identifier for the TVC deployment The unique identifier for the TVC manifest createTvcManifestApprovalsResult field The unique identifier(s) for the manifest approvals item field solSendTransactionResult field The send\_transaction\_status ID associated with the transaction submission initOtpResultV2 field Unique identifier for an OTP flow Signed bundle containing a target encryption key to use when submitting OTP codes. updateOrganizationNameResult field Unique identifier for the Organization. The updated organization name. createSubOrganizationResultV8 field subOrganizationId field wallet field walletId field A list of account addresses. item field rootUserIds field item field createOauthProvidersResultV2 field A list of unique identifiers for Oauth Providers item field createWebhookEndpointResult field Unique identifier of the created webhook endpoint. webhookEndpoint field Unique identifier of the webhook endpoint. Unique identifier for a given Organization. The destination URL for webhook delivery. Human-readable name for this webhook endpoint. Whether this webhook endpoint is active. Current subscriptions attached to this endpoint. The event type to subscribe to (for example, ACTIVITY\_UPDATES, BALANCE\_CONFIRMED\_UPDATES, or BALANCE\_FINALIZED\_UPDATES). JSON-encoded filter criteria for this subscription. Whether this subscription is active. updateWebhookEndpointResult field Unique identifier of the updated webhook endpoint. webhookEndpoint field Unique identifier of the webhook endpoint. Unique identifier for a given Organization. The destination URL for webhook delivery. Human-readable name for this webhook endpoint. Whether this webhook endpoint is active. Current subscriptions attached to this endpoint. The event type to subscribe to (for example, ACTIVITY\_UPDATES, BALANCE\_CONFIRMED\_UPDATES, or BALANCE\_FINALIZED\_UPDATES). JSON-encoded filter criteria for this subscription. Whether this subscription is active. deleteWebhookEndpointResult field Unique identifier of the deleted webhook endpoint. setIpAllowlistResult field removeIpAllowlistResult field updateTvcAppLiveDeploymentResult field deleteTvcDeploymentResult field The unique identifier of the deleted TVC deployment. deleteTvcAppAndDeploymentsResult field The unique identifier of the deleted TVC app. restoreTvcDeploymentResult field The unique identifier of the restored TVC deployment. sparkSignFrostResult field Partial signatures plus Turnkey commitments, one per request, in order. Hex-encoded FROST partial signature. Turnkey's hiding commitment D (hex-encoded compressed secp256k1 point). Forward to the Spark Operator. Turnkey's binding commitment E (hex-encoded compressed secp256k1 point). Forward to the Spark Operator. sparkPrepareTransferResult field Per-operator ECIES-encrypted packages. Spark operator identifier (UUID). ECIES ciphertext (hex-encoded) opaque to Turnkey after emission. Hex-encoded ECDSA-DER signature of the TransferPackage signing payload, signed with the wallet's IDENTITY key. Newly-derived SigningLeaf public keys, one per leaf, in input order. The Spark leaf\_id this public key was derived for. Hex-encoded compressed secp256k1 point (33 bytes) for the SigningLeaf derivation at leaf\_id. sparkClaimTransferResult field Per-operator ECIES-encrypted packages. Spark operator identifier (UUID). ECIES ciphertext (hex-encoded) opaque to Turnkey after emission. Newly-derived SigningLeaf public keys, one per leaf, in input order. The Spark leaf\_id this public key was derived for. Hex-encoded compressed secp256k1 point (33 bytes) for the SigningLeaf derivation at leaf\_id. sparkPrepareLightningReceiveResult field Per-operator ECIES-encrypted Feldman share packages. Spark operator identifier (UUID). ECIES ciphertext (hex-encoded) opaque to Turnkey after emission. Hex-encoded SHA256(preimage). Forward to the Lightning node. postTvcQuorumKeyShareResult field The unique identifier for the provisioning quorum key share ethSendTransactionResultV2 field The send\_transaction\_status ID associated with the transaction submission createMfaPolicyResult field Unique identifier for a given MFA Policy. updateMfaPolicyResult field Unique identifier for a given MFA Policy. deleteMfaPolicyResult field Unique identifier for a given MFA Policy. createSessionProfileResult field Unique identifier for a given Session Profile. A list of objects representing a particular User's approval or rejection of a Consensus request, including all relevant metadata. Unique identifier for a given Vote object. Unique identifier for a given User. user field Unique identifier for a given User. Human-readable name for a User. The user's email address. The user's phone number in E.164 format e.g. +13214567890 A list of Authenticator parameters. Types of transports that may be used by an Authenticator (e.g., USB, NFC, BLE). item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` attestationType field Identifier indicating the type of the Security Key. Unique identifier for a WebAuthn credential. The type of Authenticator device. credential field The public component of a cryptographic key pair used to sign messages and transactions. type field Enum options: `CREDENTIAL_TYPE_WEBAUTHN_AUTHENTICATOR`, `CREDENTIAL_TYPE_API_KEY_P256`, `CREDENTIAL_TYPE_RECOVER_USER_KEY_P256`, `CREDENTIAL_TYPE_API_KEY_SECP256K1`, `CREDENTIAL_TYPE_EMAIL_AUTH_KEY_P256`, `CREDENTIAL_TYPE_API_KEY_ED25519`, `CREDENTIAL_TYPE_OTP_AUTH_KEY_P256`, `CREDENTIAL_TYPE_READ_WRITE_SESSION_KEY_P256`, `CREDENTIAL_TYPE_OAUTH_KEY_P256`, `CREDENTIAL_TYPE_LOGIN` The session profile associated with this credential, if any. This field is only applicable for credentials of type CREDENTIAL\_TYPE\_LOGIN. Unique identifier for a given Authenticator. Human-readable name for an Authenticator. createdAt field seconds field nanos field updatedAt field seconds field nanos field A list of API Key parameters. This field, if not needed, should be an empty array in your request body. credential field The public component of a cryptographic key pair used to sign messages and transactions. type field Enum options: `CREDENTIAL_TYPE_WEBAUTHN_AUTHENTICATOR`, `CREDENTIAL_TYPE_API_KEY_P256`, `CREDENTIAL_TYPE_RECOVER_USER_KEY_P256`, `CREDENTIAL_TYPE_API_KEY_SECP256K1`, `CREDENTIAL_TYPE_EMAIL_AUTH_KEY_P256`, `CREDENTIAL_TYPE_API_KEY_ED25519`, `CREDENTIAL_TYPE_OTP_AUTH_KEY_P256`, `CREDENTIAL_TYPE_READ_WRITE_SESSION_KEY_P256`, `CREDENTIAL_TYPE_OAUTH_KEY_P256`, `CREDENTIAL_TYPE_LOGIN` The session profile associated with this credential, if any. This field is only applicable for credentials of type CREDENTIAL\_TYPE\_LOGIN. Unique identifier for a given API Key. Human-readable name for an API Key. createdAt field seconds field nanos field updatedAt field seconds field nanos field Optional window (in seconds) indicating how long the API Key should last. A list of User Tag IDs. item field A list of Oauth Providers. Unique identifier for an OAuth Provider Human-readable name to identify a Provider. The issuer of the token, typically a URL indicating the authentication server, e.g [https://accounts.google.com](https://accounts.google.com) Expected audience ('aud' attribute of the signed token) which represents the app ID Expected subject ('sub' attribute of the signed token) which represents the user ID createdAt field seconds field nanos field updatedAt field seconds field nanos field createdAt field seconds field nanos field updatedAt field seconds field nanos field A list of MFA Policies that define multi-factor authentication requirements for this user. Unique identifier for a given MFA Policy. Human-readable name for an MFA Policy. A condition expression that evaluates to true or false, determining when this MFA policy applies. An ordered list of authentication requirements. Each requirement must be satisfied sequentially to complete MFA. A list of authentication methods for this MFA step. If only one method is provided, it is required. If multiple are provided, the user must satisfy ANY one of them. type field Enum options: `AUTHENTICATION_TYPE_EMAIL_OTP`, `AUTHENTICATION_TYPE_SMS_OTP`, `AUTHENTICATION_TYPE_PASSKEY`, `AUTHENTICATION_TYPE_API_KEY`, `AUTHENTICATION_TYPE_OAUTH`, `AUTHENTICATION_TYPE_SESSION` Optional specific authenticator ID required (e.g., for requiring a specific session profile id) The order in which this policy is evaluated relative to other MFA policies. Optional human-readable notes added by a User to describe a particular MFA policy. createdAt field seconds field nanos field updatedAt field seconds field nanos field Unique identifier for a given Activity object. selection field Enum options: `VOTE_SELECTION_APPROVED`, `VOTE_SELECTION_REJECTED` The raw message being signed within a Vote. The public component of a cryptographic key pair used to sign messages and transactions. The signature applied to a particular vote. Method used to produce a signature. createdAt field seconds field nanos field A list of App Proofs generated by enclaves during activity execution, providing verifiable attestations of performed operations. scheme field Enum options: `SIGNATURE_SCHEME_EPHEMERAL_KEY_P256` Ephemeral public key. JSON serialized AppProofPayload. Signature over hashed proof\_payload. An artifact verifying a User's action. canApprove field canReject field createdAt field seconds field nanos field updatedAt field seconds field nanos field failure field code field message field details field @type field ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/list_activities \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "", "filterByStatus": [ "" ], "paginationOptions": { "limit": "", "before": "", "after": "" }, "filterByType": [ "" ] }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getActivities({ organizationId: " (Unique identifier for a given organization.)", filterByStatus: "" // Array of activity statuses filtering which activities will be listed in the response., paginationOptions: { // paginationOptions field, limit: " (A limit of the number of object to be returned, between 1 and 100. Defaults to 10.)", before: " (A pagination cursor. This is an object ID that enables you to fetch all objects before this ID.)", after: " (A pagination cursor. This is an object ID that enables you to fetch all objects after this ID.)", }, filterByType: "" // Array of activity types filtering which activities will be listed in the response. }); ``` ```json 200 theme={"system"} { "activities": [ { "id": "", "organizationId": "", "status": "", "type": "", "intent": { "createOrganizationIntent": { "organizationName": "", "rootEmail": "", "rootAuthenticator": { "authenticatorName": "", "userId": "", "attestation": { "id": "", "type": "", "rawId": "", "authenticatorAttachment": "", "response": { "clientDataJson": "", "attestationObject": "", "transports": [ "" ], "authenticatorAttachment": "" }, "clientExtensionResults": { "appid": "", "appidExclude": "", "credProps": { "rk": "" } } }, "challenge": "" }, "rootUserId": "" }, "createAuthenticatorsIntent": { "authenticators": [ { "authenticatorName": "", "userId": "", "attestation": { "id": "", "type": "", "rawId": "", "authenticatorAttachment": "", "response": { "clientDataJson": "", "attestationObject": "", "transports": [ "" ], "authenticatorAttachment": "" }, "clientExtensionResults": { "appid": "", "appidExclude": "", "credProps": { "rk": "" } } }, "challenge": "" } ], "userId": "" }, "createUsersIntent": { "users": [ { "userName": "", "userEmail": "", "accessType": "", "apiKeys": [ { "apiKeyName": "", "publicKey": "", "expirationSeconds": "" } ], "authenticators": [ { "authenticatorName": "", "userId": "", "attestation": { "id": "", "type": "", "rawId": "", "authenticatorAttachment": "", "response": { "clientDataJson": "", "attestationObject": "", "transports": [ "" ], "authenticatorAttachment": "" }, "clientExtensionResults": { "appid": "", "appidExclude": "", "credProps": { "rk": "" } } }, "challenge": "" } ], "userTags": [ "" ] } ] }, "createPrivateKeysIntent": { "privateKeys": [ { "privateKeyName": "", "curve": "", "privateKeyTags": [ "" ], "addressFormats": [ "" ] } ] }, "signRawPayloadIntent": { "privateKeyId": "", "payload": "", "encoding": "", "hashFunction": "" }, "createInvitationsIntent": { "invitations": [ { "receiverUserName": "", "receiverUserEmail": "", "receiverUserTags": [ "" ], "accessType": "", "senderUserId": "" } ] }, "acceptInvitationIntent": { "invitationId": "", "userId": "", "authenticator": { "authenticatorName": "", "userId": "", "attestation": { "id": "", "type": "", "rawId": "", "authenticatorAttachment": "", "response": { "clientDataJson": "", "attestationObject": "", "transports": [ "" ], "authenticatorAttachment": "" }, "clientExtensionResults": { "appid": "", "appidExclude": "", "credProps": { "rk": "" } } }, "challenge": "" } }, "createPolicyIntent": { "policyName": "", "selectors": [ { "subject": "", "operator": "", "target": "" } ], "effect": "", "notes": "" }, "disablePrivateKeyIntent": { "privateKeyId": "" }, "deleteUsersIntent": { "userIds": [ "" ] }, "deleteAuthenticatorsIntent": { "userId": "", "authenticatorIds": [ "" ] }, "deleteInvitationIntent": { "invitationId": "" }, "deleteOrganizationIntent": { "organizationId": "" }, "deletePolicyIntent": { "policyId": "" }, "createUserTagIntent": { "userTagName": "", "userIds": [ "" ] }, "deleteUserTagsIntent": { "userTagIds": [ "" ] }, "signTransactionIntent": { "privateKeyId": "", "unsignedTransaction": "", "type": "" }, "createApiKeysIntent": { "apiKeys": [ { "apiKeyName": "", "publicKey": "", "expirationSeconds": "" } ], "userId": "" }, "deleteApiKeysIntent": { "userId": "", "apiKeyIds": [ "" ] }, "approveActivityIntent": { "fingerprint": "" }, "rejectActivityIntent": { "fingerprint": "" }, "createPrivateKeyTagIntent": { "privateKeyTagName": "", "privateKeyIds": [ "" ] }, "deletePrivateKeyTagsIntent": { "privateKeyTagIds": [ "" ] }, "createPolicyIntentV2": { "policyName": "", "selectors": [ { "subject": "", "operator": "", "targets": [ "" ] } ], "effect": "", "notes": "" }, "setPaymentMethodIntent": { "number": "", "cvv": "", "expiryMonth": "", "expiryYear": "", "cardHolderEmail": "", "cardHolderName": "" }, "activateBillingTierIntent": { "productId": "", "orbPlanId": "" }, "deletePaymentMethodIntent": { "paymentMethodId": "" }, "createPolicyIntentV3": { "policyName": "", "effect": "", "condition": "", "consensus": "", "notes": "" }, "createApiOnlyUsersIntent": { "apiOnlyUsers": [ { "userName": "", "userEmail": "", "userTags": [ "" ], "apiKeys": [ { "apiKeyName": "", "publicKey": "", "expirationSeconds": "" } ] } ] }, "updateRootQuorumIntent": { "threshold": "", "userIds": [ "" ] }, "updateUserTagIntent": { "userTagId": "", "newUserTagName": "", "addUserIds": [ "" ], "removeUserIds": [ "" ] }, "updatePrivateKeyTagIntent": { "privateKeyTagId": "", "newPrivateKeyTagName": "", "addPrivateKeyIds": [ "" ], "removePrivateKeyIds": [ "" ] }, "createAuthenticatorsIntentV2": { "authenticators": [ { "authenticatorName": "", "challenge": "", "attestation": { "credentialId": "", "clientDataJson": "", "attestationObject": "", "transports": [ "" ] } } ], "userId": "" }, "acceptInvitationIntentV2": { "invitationId": "", "userId": "", "authenticator": { "authenticatorName": "", "challenge": "", "attestation": { "credentialId": "", "clientDataJson": "", "attestationObject": "", "transports": [ "" ] } } }, "createOrganizationIntentV2": { "organizationName": "", "rootEmail": "", "rootAuthenticator": { "authenticatorName": "", "challenge": "", "attestation": { "credentialId": "", "clientDataJson": "", "attestationObject": "", "transports": [ "" ] } }, "rootUserId": "" }, "createUsersIntentV2": { "users": [ { "userName": "", "userEmail": "", "apiKeys": [ { "apiKeyName": "", "publicKey": "", "expirationSeconds": "" } ], "authenticators": [ { "authenticatorName": "", "challenge": "", "attestation": { "credentialId": "", "clientDataJson": "", "attestationObject": "", "transports": [ "" ] } } ], "userTags": [ "" ] } ] }, "createSubOrganizationIntent": { "name": "", "rootAuthenticator": { "authenticatorName": "", "challenge": "", "attestation": { "credentialId": "", "clientDataJson": "", "attestationObject": "", "transports": [ "" ] } } }, "createSubOrganizationIntentV2": { "subOrganizationName": "", "rootUsers": [ { "userName": "", "userEmail": "", "apiKeys": [ { "apiKeyName": "", "publicKey": "", "expirationSeconds": "" } ], "authenticators": [ { "authenticatorName": "", "challenge": "", "attestation": { "credentialId": "", "clientDataJson": "", "attestationObject": "", "transports": [ "" ] } } ] } ], "rootQuorumThreshold": "" }, "updateAllowedOriginsIntent": { "allowedOrigins": [ "" ] }, "createPrivateKeysIntentV2": { "privateKeys": [ { "privateKeyName": "", "curve": "", "privateKeyTags": [ "" ], "addressFormats": [ "" ] } ] }, "updateUserIntent": { "userId": "", "userName": "", "userEmail": "", "userTagIds": [ "" ], "userPhoneNumber": "" }, "updatePolicyIntent": { "policyId": "", "policyName": "", "policyEffect": "", "policyCondition": "", "policyConsensus": "", "policyNotes": "" }, "setPaymentMethodIntentV2": { "paymentMethodId": "", "cardHolderEmail": "", "cardHolderName": "" }, "createSubOrganizationIntentV3": { "subOrganizationName": "", "rootUsers": [ { "userName": "", "userEmail": "", "apiKeys": [ { "apiKeyName": "", "publicKey": "", "expirationSeconds": "" } ], "authenticators": [ { "authenticatorName": "", "challenge": "", "attestation": { "credentialId": "", "clientDataJson": "", "attestationObject": "", "transports": [ "" ] } } ] } ], "rootQuorumThreshold": "", "privateKeys": [ { "privateKeyName": "", "curve": "", "privateKeyTags": [ "" ], "addressFormats": [ "" ] } ] }, "createWalletIntent": { "walletName": "", "accounts": [ { "curve": "", "pathFormat": "", "path": "", "addressFormat": "", "name": "" } ], "mnemonicLength": "" }, "createWalletAccountsIntent": { "walletId": "", "accounts": [ { "curve": "", "pathFormat": "", "path": "", "addressFormat": "", "name": "" } ], "persist": "" }, "initUserEmailRecoveryIntent": { "email": "", "targetPublicKey": "", "expirationSeconds": "", "emailCustomization": { "appName": "", "logoUrl": "", "magicLinkTemplate": "", "templateVariables": "", "templateId": "" }, "sendFromEmailAddress": "", "sendFromEmailSenderName": "", "replyToEmailAddress": "" }, "recoverUserIntent": { "authenticator": { "authenticatorName": "", "challenge": "", "attestation": { "credentialId": "", "clientDataJson": "", "attestationObject": "", "transports": [ "" ] } }, "userId": "" }, "setOrganizationFeatureIntent": { "name": "", "value": "" }, "removeOrganizationFeatureIntent": { "name": "" }, "signRawPayloadIntentV2": { "signWith": "", "payload": "", "encoding": "", "hashFunction": "" }, "signTransactionIntentV2": { "signWith": "", "unsignedTransaction": "", "type": "" }, "exportPrivateKeyIntent": { "privateKeyId": "", "targetPublicKey": "" }, "exportWalletIntent": { "walletId": "", "targetPublicKey": "", "language": "" }, "createSubOrganizationIntentV4": { "subOrganizationName": "", "rootUsers": [ { "userName": "", "userEmail": "", "apiKeys": [ { "apiKeyName": "", "publicKey": "", "expirationSeconds": "" } ], "authenticators": [ { "authenticatorName": "", "challenge": "", "attestation": { "credentialId": "", "clientDataJson": "", "attestationObject": "", "transports": [ "" ] } } ] } ], "rootQuorumThreshold": "", "wallet": { "walletName": "", "accounts": [ { "curve": "", "pathFormat": "", "path": "", "addressFormat": "", "name": "" } ], "mnemonicLength": "" }, "disableEmailRecovery": "", "disableEmailAuth": "" }, "emailAuthIntent": { "email": "", "targetPublicKey": "", "apiKeyName": "", "expirationSeconds": "", "emailCustomization": { "appName": "", "logoUrl": "", "magicLinkTemplate": "", "templateVariables": "", "templateId": "" }, "invalidateExisting": "", "sendFromEmailAddress": "", "sendFromEmailSenderName": "", "replyToEmailAddress": "" }, "exportWalletAccountIntent": { "address": "", "targetPublicKey": "" }, "initImportWalletIntent": { "userId": "" }, "importWalletIntent": { "userId": "", "walletName": "", "encryptedBundle": "", "accounts": [ { "curve": "", "pathFormat": "", "path": "", "addressFormat": "", "name": "" } ] }, "initImportPrivateKeyIntent": { "userId": "" }, "importPrivateKeyIntent": { "userId": "", "privateKeyName": "", "encryptedBundle": "", "curve": "", "addressFormats": [ "" ] }, "createPoliciesIntent": { "policies": [ { "policyName": "", "effect": "", "condition": "", "consensus": "", "notes": "" } ] }, "signRawPayloadsIntent": { "signWith": "", "payloads": [ "" ], "encoding": "", "hashFunction": "" }, "createReadOnlySessionIntent": "", "createOauthProvidersIntent": { "userId": "", "oauthProviders": [ { "providerName": "", "oidcToken": "" } ] }, "deleteOauthProvidersIntent": { "userId": "", "providerIds": [ "" ] }, "createSubOrganizationIntentV5": { "subOrganizationName": "", "rootUsers": [ { "userName": "", "userEmail": "", "apiKeys": [ { "apiKeyName": "", "publicKey": "", "expirationSeconds": "" } ], "authenticators": [ { "authenticatorName": "", "challenge": "", "attestation": { "credentialId": "", "clientDataJson": "", "attestationObject": "", "transports": [ "" ] } } ], "oauthProviders": [ { "providerName": "", "oidcToken": "" } ] } ], "rootQuorumThreshold": "", "wallet": { "walletName": "", "accounts": [ { "curve": "", "pathFormat": "", "path": "", "addressFormat": "", "name": "" } ], "mnemonicLength": "" }, "disableEmailRecovery": "", "disableEmailAuth": "" }, "oauthIntent": { "oidcToken": "", "targetPublicKey": "", "apiKeyName": "", "expirationSeconds": "", "invalidateExisting": "" }, "createApiKeysIntentV2": { "apiKeys": [ { "apiKeyName": "", "publicKey": "", "curveType": "", "expirationSeconds": "" } ], "userId": "" }, "createReadWriteSessionIntent": { "targetPublicKey": "", "email": "", "apiKeyName": "", "expirationSeconds": "" }, "emailAuthIntentV2": { "email": "", "targetPublicKey": "", "apiKeyName": "", "expirationSeconds": "", "emailCustomization": { "appName": "", "logoUrl": "", "magicLinkTemplate": "", "templateVariables": "", "templateId": "" }, "invalidateExisting": "", "sendFromEmailAddress": "", "sendFromEmailSenderName": "", "replyToEmailAddress": "" }, "createSubOrganizationIntentV6": { "subOrganizationName": "", "rootUsers": [ { "userName": "", "userEmail": "", "apiKeys": [ { "apiKeyName": "", "publicKey": "", "curveType": "", "expirationSeconds": "" } ], "authenticators": [ { "authenticatorName": "", "challenge": "", "attestation": { "credentialId": "", "clientDataJson": "", "attestationObject": "", "transports": [ "" ] } } ], "oauthProviders": [ { "providerName": "", "oidcToken": "" } ] } ], "rootQuorumThreshold": "", "wallet": { "walletName": "", "accounts": [ { "curve": "", "pathFormat": "", "path": "", "addressFormat": "", "name": "" } ], "mnemonicLength": "" }, "disableEmailRecovery": "", "disableEmailAuth": "" }, "deletePrivateKeysIntent": { "privateKeyIds": [ "" ], "deleteWithoutExport": "" }, "deleteWalletsIntent": { "walletIds": [ "" ], "deleteWithoutExport": "" }, "createReadWriteSessionIntentV2": { "targetPublicKey": "", "userId": "", "apiKeyName": "", "expirationSeconds": "", "invalidateExisting": "" }, "deleteSubOrganizationIntent": { "deleteWithoutExport": "" }, "initOtpAuthIntent": { "otpType": "", "contact": "", "emailCustomization": { "appName": "", "logoUrl": "", "magicLinkTemplate": "", "templateVariables": "", "templateId": "" }, "smsCustomization": { "template": "" }, "userIdentifier": "", "sendFromEmailAddress": "", "sendFromEmailSenderName": "", "replyToEmailAddress": "" }, "otpAuthIntent": { "otpId": "", "otpCode": "", "targetPublicKey": "", "apiKeyName": "", "expirationSeconds": "", "invalidateExisting": "" }, "createSubOrganizationIntentV7": { "subOrganizationName": "", "rootUsers": [ { "userName": "", "userEmail": "", "userPhoneNumber": "", "apiKeys": [ { "apiKeyName": "", "publicKey": "", "curveType": "", "expirationSeconds": "" } ], "authenticators": [ { "authenticatorName": "", "challenge": "", "attestation": { "credentialId": "", "clientDataJson": "", "attestationObject": "", "transports": [ "" ] } } ], "oauthProviders": [ { "providerName": "", "oidcToken": "" } ] } ], "rootQuorumThreshold": "", "wallet": { "walletName": "", "accounts": [ { "curve": "", "pathFormat": "", "path": "", "addressFormat": "", "name": "" } ], "mnemonicLength": "" }, "disableEmailRecovery": "", "disableEmailAuth": "", "disableSmsAuth": "", "disableOtpEmailAuth": "", "verificationToken": "", "clientSignature": { "publicKey": "", "scheme": "", "message": "", "signature": "" } }, "updateWalletIntent": { "walletId": "", "walletName": "" }, "updatePolicyIntentV2": { "policyId": "", "policyName": "", "policyEffect": "", "policyCondition": "", "policyConsensus": "", "policyNotes": "" }, "createUsersIntentV3": { "users": [ { "userName": "", "userEmail": "", "userPhoneNumber": "", "apiKeys": [ { "apiKeyName": "", "publicKey": "", "curveType": "", "expirationSeconds": "" } ], "authenticators": [ { "authenticatorName": "", "challenge": "", "attestation": { "credentialId": "", "clientDataJson": "", "attestationObject": "", "transports": [ "" ] } } ], "oauthProviders": [ { "providerName": "", "oidcToken": "" } ], "userTags": [ "" ] } ] }, "initOtpAuthIntentV2": { "otpType": "", "contact": "", "otpLength": "", "emailCustomization": { "appName": "", "logoUrl": "", "magicLinkTemplate": "", "templateVariables": "", "templateId": "" }, "smsCustomization": { "template": "" }, "userIdentifier": "", "sendFromEmailAddress": "", "alphanumeric": "", "sendFromEmailSenderName": "", "replyToEmailAddress": "" }, "initOtpIntent": { "otpType": "", "contact": "", "otpLength": "", "emailCustomization": { "appName": "", "logoUrl": "", "magicLinkTemplate": "", "templateVariables": "", "templateId": "" }, "smsCustomization": { "template": "" }, "userIdentifier": "", "sendFromEmailAddress": "", "alphanumeric": "", "sendFromEmailSenderName": "", "expirationSeconds": "", "replyToEmailAddress": "" }, "verifyOtpIntent": { "otpId": "", "otpCode": "", "expirationSeconds": "", "publicKey": "" }, "otpLoginIntent": { "verificationToken": "", "publicKey": "", "expirationSeconds": "", "invalidateExisting": "", "clientSignature": { "publicKey": "", "scheme": "", "message": "", "signature": "" }, "sessionProfileId": "" }, "stampLoginIntent": { "publicKey": "", "expirationSeconds": "", "invalidateExisting": "", "sessionProfileId": "" }, "oauthLoginIntent": { "oidcToken": "", "publicKey": "", "expirationSeconds": "", "invalidateExisting": "", "sessionProfileId": "" }, "updateUserNameIntent": { "userId": "", "userName": "" }, "updateUserEmailIntent": { "userId": "", "userEmail": "", "verificationToken": "" }, "updateUserPhoneNumberIntent": { "userId": "", "userPhoneNumber": "", "verificationToken": "" }, "initFiatOnRampIntent": { "onrampProvider": "", "walletAddress": "", "network": "", "cryptoCurrencyCode": "", "fiatCurrencyCode": "", "fiatCurrencyAmount": "", "paymentMethod": "", "countryCode": "", "countrySubdivisionCode": "", "sandboxMode": "", "urlForSignature": "" }, "createSmartContractInterfaceIntent": { "smartContractAddress": "", "smartContractInterface": "", "type": "", "label": "", "notes": "" }, "deleteSmartContractInterfaceIntent": { "smartContractInterfaceId": "" }, "enableAuthProxyIntent": "", "disableAuthProxyIntent": "", "updateAuthProxyConfigIntent": { "allowedOrigins": [ "" ], "allowedAuthMethods": [ "" ], "sendFromEmailAddress": "", "replyToEmailAddress": "", "emailAuthTemplateId": "", "otpTemplateId": "", "emailCustomizationParams": { "appName": "", "logoUrl": "", "magicLinkTemplate": "", "templateVariables": "", "templateId": "" }, "smsCustomizationParams": { "template": "" }, "walletKitSettings": { "enabledSocialProviders": [ "" ], "oauthClientIds": "", "oauthRedirectUrl": "" }, "otpExpirationSeconds": "", "verificationTokenExpirationSeconds": "", "sessionExpirationSeconds": "", "otpAlphanumeric": "", "otpLength": "", "sendFromEmailSenderName": "", "verificationTokenRequiredForGetAccountPii": "", "socialLinkingClientIds": [ "" ] }, "createOauth2CredentialIntent": { "provider": "", "clientId": "", "encryptedClientSecret": "" }, "updateOauth2CredentialIntent": { "oauth2CredentialId": "", "provider": "", "clientId": "", "encryptedClientSecret": "" }, "deleteOauth2CredentialIntent": { "oauth2CredentialId": "" }, "oauth2AuthenticateIntent": { "oauth2CredentialId": "", "authCode": "", "redirectUri": "", "codeVerifier": "", "nonce": "", "bearerTokenTargetPublicKey": "" }, "deleteWalletAccountsIntent": { "walletAccountIds": [ "" ], "deleteWithoutExport": "" }, "deletePoliciesIntent": { "policyIds": [ "" ] }, "ethSendRawTransactionIntent": { "signedTransaction": "", "caip2": "" }, "ethSendTransactionIntent": { "from": "", "sponsor": "", "caip2": "", "to": "", "value": "", "data": "", "nonce": "", "gasLimit": "", "maxFeePerGas": "", "maxPriorityFeePerGas": "", "deadline": "", "gasStationNonce": "" }, "createFiatOnRampCredentialIntent": { "onrampProvider": "", "projectId": "", "publishableApiKey": "", "encryptedSecretApiKey": "", "encryptedPrivateApiKey": "", "sandboxMode": "" }, "updateFiatOnRampCredentialIntent": { "fiatOnrampCredentialId": "", "onrampProvider": "", "projectId": "", "publishableApiKey": "", "encryptedSecretApiKey": "", "encryptedPrivateApiKey": "" }, "deleteFiatOnRampCredentialIntent": { "fiatOnrampCredentialId": "" }, "emailAuthIntentV3": { "email": "", "targetPublicKey": "", "apiKeyName": "", "expirationSeconds": "", "emailCustomization": { "appName": "", "logoUrl": "", "magicLinkTemplate": "", "templateVariables": "", "templateId": "" }, "invalidateExisting": "", "sendFromEmailAddress": "", "sendFromEmailSenderName": "", "replyToEmailAddress": "" }, "initUserEmailRecoveryIntentV2": { "email": "", "targetPublicKey": "", "expirationSeconds": "", "emailCustomization": { "appName": "", "logoUrl": "", "magicLinkTemplate": "", "templateVariables": "", "templateId": "" }, "sendFromEmailAddress": "", "sendFromEmailSenderName": "", "replyToEmailAddress": "" }, "initOtpIntentV2": { "otpType": "", "contact": "", "otpLength": "", "appName": "", "emailCustomization": { "logoUrl": "", "magicLinkTemplate": "", "templateVariables": "", "templateId": "" }, "smsCustomization": { "template": "" }, "userIdentifier": "", "sendFromEmailAddress": "", "alphanumeric": "", "sendFromEmailSenderName": "", "expirationSeconds": "", "replyToEmailAddress": "" }, "initOtpAuthIntentV3": { "otpType": "", "contact": "", "otpLength": "", "appName": "", "emailCustomization": { "logoUrl": "", "magicLinkTemplate": "", "templateVariables": "", "templateId": "" }, "smsCustomization": { "template": "" }, "userIdentifier": "", "sendFromEmailAddress": "", "alphanumeric": "", "sendFromEmailSenderName": "", "expirationSeconds": "", "replyToEmailAddress": "" }, "upsertGasUsageConfigIntent": { "orgWindowLimitUsd": "", "subOrgWindowLimitUsd": "", "windowDurationMinutes": "", "enabled": "", "solanaConfig": { "rentPrefundEnabled": "" } }, "createTvcAppIntent": { "name": "", "quorumPublicKey": "", "manifestSetId": "", "manifestSetParams": { "name": "", "newOperators": [ { "name": "", "publicKey": "" } ], "existingOperatorIds": [ "" ], "threshold": "" }, "shareSetId": "", "shareSetParams": { "name": "", "newOperators": [ { "name": "", "publicKey": "" } ], "existingOperatorIds": [ "" ], "threshold": "" }, "enableEgress": "", "enableDebugModeDeployments": "" }, "createTvcDeploymentIntent": { "appId": "", "qosVersion": "", "pivotContainerImageUrl": "", "pivotPath": "", "pivotArgs": [ "" ], "expectedPivotDigest": "", "nonce": "", "pivotContainerEncryptedPullSecret": "", "debugMode": "", "healthCheckType": "", "healthCheckPort": "", "publicIngressPort": "" }, "createTvcManifestApprovalsIntent": { "manifestId": "", "approvals": [ { "operatorId": "", "signature": "" } ] }, "solSendTransactionIntent": { "unsignedTransaction": "", "signWith": "", "sponsor": "", "caip2": "", "recentBlockhash": "" }, "initOtpIntentV3": { "otpType": "", "contact": "", "appName": "", "otpLength": "", "emailCustomization": { "logoUrl": "", "magicLinkTemplate": "", "templateVariables": "", "templateId": "" }, "smsCustomization": { "template": "" }, "userIdentifier": "", "sendFromEmailAddress": "", "alphanumeric": "", "sendFromEmailSenderName": "", "expirationSeconds": "", "replyToEmailAddress": "" }, "verifyOtpIntentV2": { "otpId": "", "encryptedOtpBundle": "", "expirationSeconds": "" }, "otpLoginIntentV2": { "verificationToken": "", "publicKey": "", "clientSignature": { "publicKey": "", "scheme": "", "message": "", "signature": "" }, "expirationSeconds": "", "invalidateExisting": "", "sessionProfileId": "" }, "updateOrganizationNameIntent": { "organizationName": "" }, "createSubOrganizationIntentV8": { "subOrganizationName": "", "rootUsers": [ { "userName": "", "userEmail": "", "userPhoneNumber": "", "apiKeys": [ { "apiKeyName": "", "publicKey": "", "curveType": "", "expirationSeconds": "" } ], "authenticators": [ { "authenticatorName": "", "challenge": "", "attestation": { "credentialId": "", "clientDataJson": "", "attestationObject": "", "transports": [ "" ] } } ], "oauthProviders": [ { "providerName": "", "oidcToken": "", "oidcClaims": { "iss": "", "sub": "", "aud": "" } } ] } ], "rootQuorumThreshold": "", "wallet": { "walletName": "", "accounts": [ { "curve": "", "pathFormat": "", "path": "", "addressFormat": "", "name": "" } ], "mnemonicLength": "" }, "disableEmailRecovery": "", "disableEmailAuth": "", "disableSmsAuth": "", "disableOtpEmailAuth": "", "verificationToken": "", "clientSignature": { "publicKey": "", "scheme": "", "message": "", "signature": "" } }, "createOauthProvidersIntentV2": { "userId": "", "oauthProviders": [ { "providerName": "", "oidcToken": "", "oidcClaims": { "iss": "", "sub": "", "aud": "" } } ] }, "createUsersIntentV4": { "users": [ { "userName": "", "userEmail": "", "userPhoneNumber": "", "apiKeys": [ { "apiKeyName": "", "publicKey": "", "curveType": "", "expirationSeconds": "" } ], "authenticators": [ { "authenticatorName": "", "challenge": "", "attestation": { "credentialId": "", "clientDataJson": "", "attestationObject": "", "transports": [ "" ] } } ], "oauthProviders": [ { "providerName": "", "oidcToken": "", "oidcClaims": { "iss": "", "sub": "", "aud": "" } } ], "userTags": [ "" ] } ] }, "createWebhookEndpointIntent": { "url": "", "name": "", "subscriptions": [ { "eventType": "", "filtersJson": "", "isActive": "" } ] }, "updateWebhookEndpointIntent": { "endpointId": "", "url": "", "name": "", "isActive": "" }, "deleteWebhookEndpointIntent": { "endpointId": "" }, "setIpAllowlistIntent": { "publicKey": "", "enabled": "", "rules": [ { "cidr": "", "label": "" } ], "onEvaluationError": "" }, "removeIpAllowlistIntent": { "publicKey": "" }, "updateTvcAppLiveDeploymentIntent": { "deploymentId": "" }, "deleteTvcDeploymentIntent": { "deploymentId": "" }, "deleteTvcAppAndDeploymentsIntent": { "appId": "" }, "restoreTvcDeploymentIntent": { "deploymentId": "" }, "sparkSignFrostIntent": { "signWith": "", "signatures": [ { "derivation": { "identity": "", "signingLeaf": { "leafId": "" }, "deposit": "", "staticDeposit": { "index": "" }, "htlcPreimage": "" }, "message": "", "verifyingKey": "", "operatorCommitments": [ { "id": "", "hiding": "", "binding": "" } ], "adaptorPublicKey": "" } ] }, "sparkPrepareTransferIntent": { "signWith": "", "transfer": { "transferId": "", "leaves": [ { "leafId": "", "oldLeafDerivation": { "identity": "", "signingLeaf": { "leafId": "" }, "deposit": "", "staticDeposit": { "index": "" }, "htlcPreimage": "" }, "newLeafDerivation": { "identity": "", "signingLeaf": { "leafId": "" }, "deposit": "", "staticDeposit": { "index": "" }, "htlcPreimage": "" }, "refundSignature": "", "directRefundSignature": "", "directFromCpfpRefundSignature": "" } ], "threshold": "", "operatorRecipients": [ { "operatorId": "", "encryptionPublicKey": "" } ], "receiverPublicKey": "" } }, "sparkClaimTransferIntent": { "signWith": "", "claim": { "leaves": [ { "leafId": "", "ciphertext": "", "senderSignature": "" } ], "threshold": "", "operatorRecipients": [ { "operatorId": "", "encryptionPublicKey": "" } ], "transferId": "", "senderIdentityPublicKey": "" } }, "sparkPrepareLightningReceiveIntent": { "signWith": "", "lightningReceive": { "threshold": "", "operatorRecipients": [ { "operatorId": "", "encryptionPublicKey": "" } ] } }, "postTvcQuorumKeyShareIntent": { "deploymentId": "", "ephemeralPublicKeyHex": "", "shareApprovalBundle": { "operatorId": "", "reEncryptedShareHex": "", "signature": "" } }, "ethSendTransactionIntentV2": { "from": "", "caip2": "", "sponsor": "", "nonce": "", "gasLimit": "", "maxFeePerGas": "", "maxPriorityFeePerGas": "", "deadline": "", "gasStationNonce": "", "calls": [ { "to": "", "value": "", "data": "" } ] }, "createMfaPolicyIntent": { "userId": "", "mfaPolicyName": "", "condition": "", "requiredAuthenticationMethods": [ { "any": [ { "type": "", "id": "" } ] } ], "order": "", "notes": "" }, "updateMfaPolicyIntent": { "userId": "", "mfaPolicyId": "", "mfaPolicyName": "", "condition": "", "requiredAuthenticationMethods": [ { "any": [ { "type": "", "id": "" } ] } ], "order": "", "notes": "" }, "deleteMfaPolicyIntent": { "userId": "", "mfaPolicyId": "" }, "createSessionProfileIntent": { "sessionProfileName": "", "scope": "", "expirationSeconds": "", "notes": "" } }, "result": { "createOrganizationResult": { "organizationId": "" }, "createAuthenticatorsResult": { "authenticatorIds": [ "" ] }, "createUsersResult": { "userIds": [ "" ] }, "createPrivateKeysResult": { "privateKeyIds": [ "" ] }, "createInvitationsResult": { "invitationIds": [ "" ] }, "acceptInvitationResult": { "invitationId": "", "userId": "" }, "signRawPayloadResult": { "r": "", "s": "", "v": "" }, "createPolicyResult": { "policyId": "" }, "disablePrivateKeyResult": { "privateKeyId": "" }, "deleteUsersResult": { "userIds": [ "" ] }, "deleteAuthenticatorsResult": { "authenticatorIds": [ "" ] }, "deleteInvitationResult": { "invitationId": "" }, "deleteOrganizationResult": { "organizationId": "" }, "deletePolicyResult": { "policyId": "" }, "createUserTagResult": { "userTagId": "", "userIds": [ "" ] }, "deleteUserTagsResult": { "userTagIds": [ "" ], "userIds": [ "" ] }, "signTransactionResult": { "signedTransaction": "" }, "deleteApiKeysResult": { "apiKeyIds": [ "" ] }, "createApiKeysResult": { "apiKeyIds": [ "" ] }, "createPrivateKeyTagResult": { "privateKeyTagId": "", "privateKeyIds": [ "" ] }, "deletePrivateKeyTagsResult": { "privateKeyTagIds": [ "" ], "privateKeyIds": [ "" ] }, "setPaymentMethodResult": { "lastFour": "", "cardHolderName": "", "cardHolderEmail": "" }, "activateBillingTierResult": { "productId": "" }, "deletePaymentMethodResult": { "paymentMethodId": "" }, "createApiOnlyUsersResult": { "userIds": [ "" ] }, "updateRootQuorumResult": "", "updateUserTagResult": { "userTagId": "" }, "updatePrivateKeyTagResult": { "privateKeyTagId": "" }, "createSubOrganizationResult": { "subOrganizationId": "", "rootUserIds": [ "" ] }, "updateAllowedOriginsResult": "", "createPrivateKeysResultV2": { "privateKeys": [ { "privateKeyId": "", "addresses": [ { "format": "", "address": "" } ] } ] }, "updateUserResult": { "userId": "" }, "updatePolicyResult": { "policyId": "" }, "createSubOrganizationResultV3": { "subOrganizationId": "", "privateKeys": [ { "privateKeyId": "", "addresses": [ { "format": "", "address": "" } ] } ], "rootUserIds": [ "" ] }, "createWalletResult": { "walletId": "", "addresses": [ "" ] }, "createWalletAccountsResult": { "addresses": [ "" ] }, "initUserEmailRecoveryResult": { "userId": "" }, "recoverUserResult": { "authenticatorId": [ "" ] }, "setOrganizationFeatureResult": { "features": [ { "name": "", "value": "" } ] }, "removeOrganizationFeatureResult": { "features": [ { "name": "", "value": "" } ] }, "exportPrivateKeyResult": { "privateKeyId": "", "exportBundle": "" }, "exportWalletResult": { "walletId": "", "exportBundle": "" }, "createSubOrganizationResultV4": { "subOrganizationId": "", "wallet": { "walletId": "", "addresses": [ "" ] }, "rootUserIds": [ "" ] }, "emailAuthResult": { "userId": "", "apiKeyId": "" }, "exportWalletAccountResult": { "address": "", "exportBundle": "" }, "initImportWalletResult": { "importBundle": "" }, "importWalletResult": { "walletId": "", "addresses": [ "" ] }, "initImportPrivateKeyResult": { "importBundle": "" }, "importPrivateKeyResult": { "privateKeyId": "", "addresses": [ { "format": "", "address": "" } ] }, "createPoliciesResult": { "policyIds": [ "" ] }, "signRawPayloadsResult": { "signatures": [ { "r": "", "s": "", "v": "" } ] }, "createReadOnlySessionResult": { "organizationId": "", "organizationName": "", "userId": "", "username": "", "session": "", "sessionExpiry": "" }, "createOauthProvidersResult": { "providerIds": [ "" ] }, "deleteOauthProvidersResult": { "providerIds": [ "" ] }, "createSubOrganizationResultV5": { "subOrganizationId": "", "wallet": { "walletId": "", "addresses": [ "" ] }, "rootUserIds": [ "" ] }, "oauthResult": { "userId": "", "apiKeyId": "", "credentialBundle": "" }, "createReadWriteSessionResult": { "organizationId": "", "organizationName": "", "userId": "", "username": "", "apiKeyId": "", "credentialBundle": "" }, "createSubOrganizationResultV6": { "subOrganizationId": "", "wallet": { "walletId": "", "addresses": [ "" ] }, "rootUserIds": [ "" ] }, "deletePrivateKeysResult": { "privateKeyIds": [ "" ] }, "deleteWalletsResult": { "walletIds": [ "" ] }, "createReadWriteSessionResultV2": { "organizationId": "", "organizationName": "", "userId": "", "username": "", "apiKeyId": "", "credentialBundle": "" }, "deleteSubOrganizationResult": { "subOrganizationUuid": "" }, "initOtpAuthResult": { "otpId": "" }, "otpAuthResult": { "userId": "", "apiKeyId": "", "credentialBundle": "" }, "createSubOrganizationResultV7": { "subOrganizationId": "", "wallet": { "walletId": "", "addresses": [ "" ] }, "rootUserIds": [ "" ] }, "updateWalletResult": { "walletId": "" }, "updatePolicyResultV2": { "policyId": "" }, "initOtpAuthResultV2": { "otpId": "" }, "initOtpResult": { "otpId": "" }, "verifyOtpResult": { "verificationToken": "" }, "otpLoginResult": { "session": "" }, "stampLoginResult": { "session": "" }, "oauthLoginResult": { "session": "" }, "updateUserNameResult": { "userId": "" }, "updateUserEmailResult": { "userId": "" }, "updateUserPhoneNumberResult": { "userId": "" }, "initFiatOnRampResult": { "onRampUrl": "", "onRampTransactionId": "", "onRampUrlSignature": "" }, "createSmartContractInterfaceResult": { "smartContractInterfaceId": "" }, "deleteSmartContractInterfaceResult": { "smartContractInterfaceId": "" }, "enableAuthProxyResult": { "userId": "" }, "disableAuthProxyResult": "", "updateAuthProxyConfigResult": { "configId": "" }, "createOauth2CredentialResult": { "oauth2CredentialId": "" }, "updateOauth2CredentialResult": { "oauth2CredentialId": "" }, "deleteOauth2CredentialResult": { "oauth2CredentialId": "" }, "oauth2AuthenticateResult": { "oidcToken": "" }, "deleteWalletAccountsResult": { "walletAccountIds": [ "" ] }, "deletePoliciesResult": { "policyIds": [ "" ] }, "ethSendRawTransactionResult": { "transactionHash": "" }, "createFiatOnRampCredentialResult": { "fiatOnRampCredentialId": "" }, "updateFiatOnRampCredentialResult": { "fiatOnRampCredentialId": "" }, "deleteFiatOnRampCredentialResult": { "fiatOnRampCredentialId": "" }, "ethSendTransactionResult": { "sendTransactionStatusId": "" }, "upsertGasUsageConfigResult": { "gasUsageConfigId": "" }, "createTvcAppResult": { "appId": "", "manifestSetId": "", "manifestSetOperatorIds": [ "" ], "manifestSetThreshold": "" }, "createTvcDeploymentResult": { "deploymentId": "", "manifestId": "" }, "createTvcManifestApprovalsResult": { "approvalIds": [ "" ] }, "solSendTransactionResult": { "sendTransactionStatusId": "" }, "initOtpResultV2": { "otpId": "", "otpEncryptionTargetBundle": "" }, "updateOrganizationNameResult": { "organizationId": "", "organizationName": "" }, "createSubOrganizationResultV8": { "subOrganizationId": "", "wallet": { "walletId": "", "addresses": [ "" ] }, "rootUserIds": [ "" ] }, "createOauthProvidersResultV2": { "providerIds": [ "" ] }, "createWebhookEndpointResult": { "endpointId": "", "webhookEndpoint": { "endpointId": "", "organizationId": "", "url": "", "name": "", "isActive": "", "subscriptions": [ { "eventType": "", "filtersJson": "", "isActive": "" } ] } }, "updateWebhookEndpointResult": { "endpointId": "", "webhookEndpoint": { "endpointId": "", "organizationId": "", "url": "", "name": "", "isActive": "", "subscriptions": [ { "eventType": "", "filtersJson": "", "isActive": "" } ] } }, "deleteWebhookEndpointResult": { "endpointId": "" }, "setIpAllowlistResult": "", "removeIpAllowlistResult": "", "updateTvcAppLiveDeploymentResult": "", "deleteTvcDeploymentResult": { "deploymentId": "" }, "deleteTvcAppAndDeploymentsResult": { "appId": "" }, "restoreTvcDeploymentResult": { "deploymentId": "" }, "sparkSignFrostResult": { "signatures": [ { "signatureShare": "", "hiding": "", "binding": "" } ] }, "sparkPrepareTransferResult": { "operatorPackages": [ { "operatorId": "", "encryptedPackage": "" } ], "transferUserSignature": "", "newLeafPublicKeys": [ { "leafId": "", "publicKey": "" } ] }, "sparkClaimTransferResult": { "operatorPackages": [ { "operatorId": "", "encryptedPackage": "" } ], "newLeafPublicKeys": [ { "leafId": "", "publicKey": "" } ] }, "sparkPrepareLightningReceiveResult": { "operatorPackages": [ { "operatorId": "", "encryptedPackage": "" } ], "paymentHash": "" }, "postTvcQuorumKeyShareResult": { "provisioningShareId": "" }, "ethSendTransactionResultV2": { "sendTransactionStatusId": "" }, "createMfaPolicyResult": { "mfaPolicyId": "" }, "updateMfaPolicyResult": { "mfaPolicyId": "" }, "deleteMfaPolicyResult": { "mfaPolicyId": "" }, "createSessionProfileResult": { "sessionProfileId": "" } }, "votes": [ { "id": "", "userId": "", "user": { "userId": "", "userName": "", "userEmail": "", "userPhoneNumber": "", "authenticators": [ { "transports": [ "" ], "attestationType": "", "aaguid": "", "credentialId": "", "model": "", "credential": { "publicKey": "", "type": "", "sessionProfileId": "" }, "authenticatorId": "", "authenticatorName": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } } ], "apiKeys": [ { "credential": { "publicKey": "", "type": "", "sessionProfileId": "" }, "apiKeyId": "", "apiKeyName": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" }, "expirationSeconds": "" } ], "userTags": [ "" ], "oauthProviders": [ { "providerId": "", "providerName": "", "issuer": "", "audience": "", "subject": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } } ], "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" }, "mfaPolicies": [ { "mfaPolicyId": "", "mfaPolicyName": "", "condition": "", "requiredAuthenticationMethods": [ { "any": [ { "type": "", "id": "" } ] } ], "order": "", "notes": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } } ] }, "activityId": "", "selection": "", "message": "", "publicKey": "", "signature": "", "scheme": "", "createdAt": { "seconds": "", "nanos": "" } } ], "appProofs": [ { "scheme": "", "publicKey": "", "proofPayload": "", "signature": "" } ], "fingerprint": "", "canApprove": "", "canReject": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" }, "failure": { "code": "", "message": "", "details": [ { "@type": "" } ] } } ] } ``` # List App Proofs for an activity Source: https://docs.turnkey.com/api-reference/queries/list-app-proofs-for-an-activity List the App Proofs for the given activity. Unique identifier for a given Organization. Unique identifier for a given activity. A successful response returns the following fields: appProofs field scheme field Enum options: `SIGNATURE_SCHEME_EPHEMERAL_KEY_P256` Ephemeral public key. JSON serialized AppProofPayload. Signature over hashed proof\_payload. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/list_app_proofs \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "", "activityId": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getAppProofs({ organizationId: " (Unique identifier for a given Organization.)", activityId: " (Unique identifier for a given activity.)" }); ``` ```json 200 theme={"system"} { "appProofs": [ { "scheme": "", "publicKey": "", "proofPayload": "", "signature": "" } ] } ``` # List Fiat On Ramp Credentials Source: https://docs.turnkey.com/api-reference/queries/list-fiat-on-ramp-credentials List all fiat on ramp provider credentials within an organization. Unique identifier for a given Organization. A successful response returns the following fields: fiatOnRampCredentials field Unique identifier for a given Fiat On-Ramp Credential. Unique identifier for an Organization. onrampProvider field Enum options: `FIAT_ON_RAMP_PROVIDER_COINBASE`, `FIAT_ON_RAMP_PROVIDER_MOONPAY` Project ID for the on-ramp provider. Some providers, like Coinbase, require this additional identifier. Publishable API key for the on-ramp provider. Secret API key for the on-ramp provider encrypted to our on-ramp encryption public key. Private API key for the on-ramp provider encrypted to our on-ramp encryption public key. Some providers, like Coinbase, require this additional key. If the on-ramp credential is a sandbox credential. createdAt field seconds field nanos field updatedAt field seconds field nanos field ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/list_fiat_on_ramp_credentials \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().listFiatOnRampCredentials({ organizationId: " (Unique identifier for a given Organization.)" }); ``` ```json 200 theme={"system"} { "fiatOnRampCredentials": [ { "fiatOnrampCredentialId": "", "organizationId": "", "onrampProvider": "", "projectId": "", "publishableApiKey": "", "encryptedSecretApiKey": "", "encryptedPrivateApiKey": "", "sandboxMode": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } } ] } ``` # List OAuth 2.0 Credentials Source: https://docs.turnkey.com/api-reference/queries/list-oauth-20-credentials List all OAuth 2.0 credentials within an organization. Unique identifier for a given Organization. A successful response returns the following fields: oauth2Credentials field Unique identifier for a given OAuth 2.0 Credential. Unique identifier for an Organization. provider field Enum options: `OAUTH2_PROVIDER_X`, `OAUTH2_PROVIDER_DISCORD` The client id for a given OAuth 2.0 Credential. The encrypted client secret for a given OAuth 2.0 Credential encrypted to the TLS Fetcher quorum key. createdAt field seconds field nanos field updatedAt field seconds field nanos field ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/list_oauth2_credentials \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().listOauth2Credentials({ organizationId: " (Unique identifier for a given Organization.)" }); ``` ```json 200 theme={"system"} { "oauth2Credentials": [ { "oauth2CredentialId": "", "organizationId": "", "provider": "", "clientId": "", "encryptedClientSecret": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } } ] } ``` # List policies Source: https://docs.turnkey.com/api-reference/queries/list-policies List all policies within an organization. Unique identifier for a given organization. A successful response returns the following fields: A list of policies. Unique identifier for a given Policy. Human-readable name for a Policy. effect field Enum options: `EFFECT_ALLOW`, `EFFECT_DENY` createdAt field seconds field nanos field updatedAt field seconds field nanos field Human-readable notes added by a User to describe a particular policy. A consensus expression that evalutes to true or false. A condition expression that evalutes to true or false. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/list_policies \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getPolicies({ organizationId: " (Unique identifier for a given organization.)" }); ``` ```json 200 theme={"system"} { "policies": [ { "policyId": "", "policyName": "", "effect": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" }, "notes": "", "consensus": "", "condition": "" } ] } ``` # List private key tags Source: https://docs.turnkey.com/api-reference/queries/list-private-key-tags List all private key tags within an organization. Unique identifier for a given organization. A successful response returns the following fields: A list of private key tags. Unique identifier for a given Tag. Human-readable name for a Tag. tagType field Enum options: `TAG_TYPE_USER`, `TAG_TYPE_PRIVATE_KEY` createdAt field seconds field nanos field updatedAt field seconds field nanos field ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/list_private_key_tags \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().listPrivateKeyTags({ organizationId: " (Unique identifier for a given organization.)" }); ``` ```json 200 theme={"system"} { "privateKeyTags": [ { "tagId": "", "tagName": "", "tagType": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } } ] } ``` # List private keys Source: https://docs.turnkey.com/api-reference/queries/list-private-keys List all private keys within an organization. Unique identifier for a given organization. A successful response returns the following fields: A list of private keys. Unique identifier for a given Private Key. The public component of a cryptographic key pair used to sign messages and transactions. Human-readable name for a Private Key. curve field Enum options: `CURVE_SECP256K1`, `CURVE_ED25519`, `CURVE_P256` Derived cryptocurrency addresses for a given Private Key. format field Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` address field A list of Private Key Tag IDs. item field createdAt field seconds field nanos field updatedAt field seconds field nanos field True when a given Private Key is exported, false otherwise. True when a given Private Key is imported, false otherwise. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/list_private_keys \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getPrivateKeys({ organizationId: " (Unique identifier for a given organization.)" }); ``` ```json 200 theme={"system"} { "privateKeys": [ { "privateKeyId": "", "publicKey": "", "privateKeyName": "", "curve": "", "addresses": [ { "format": "", "address": "" } ], "privateKeyTags": [ "" ], "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" }, "exported": "", "imported": "" } ] } ``` # List smart contract interfaces Source: https://docs.turnkey.com/api-reference/queries/list-smart-contract-interfaces List all smart contract interfaces within an organization. Unique identifier for a given organization. A successful response returns the following fields: A list of smart contract interfaces. The Organization the Smart Contract Interface belongs to. Unique identifier for a given Smart Contract Interface (ABI or IDL). The address corresponding to the Smart Contract or Program. The JSON corresponding to the Smart Contract Interface (ABI or IDL). The type corresponding to the Smart Contract Interface (either ETHEREUM or SOLANA). The label corresponding to the Smart Contract Interface (either ETHEREUM or SOLANA). The notes corresponding to the Smart Contract Interface (either ETHEREUM or SOLANA). createdAt field seconds field nanos field updatedAt field seconds field nanos field ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/list_smart_contract_interfaces \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getSmartContractInterfaces({ organizationId: " (Unique identifier for a given organization.)" }); ``` ```json 200 theme={"system"} { "smartContractInterfaces": [ { "organizationId": "", "smartContractInterfaceId": "", "smartContractAddress": "", "smartContractInterface": "", "type": "", "label": "", "notes": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } } ] } ``` # List supported assets Source: https://docs.turnkey.com/api-reference/queries/list-supported-assets List supported assets for the specified network. Unique identifier for a given organization. Enum options: `eip155:1`, `eip155:11155111`, `eip155:8453`, `eip155:84532`, `eip155:137`, `eip155:80002`, `eip155:42161`, `eip155:4217`, `eip155:42431`, `eip155:421614`, `eip155:56`, `eip155:97`, `solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp`, `solana:EtWTRABZaYq6iMfeYKouRu166VU2xqa1` A successful response returns the following fields: List of asset metadata The caip-19 asset identifier The asset symbol The number of decimals this asset uses The url of the asset logo The asset name ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/list_supported_assets \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "", "caip2": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().listSupportedAssets({ organizationId: " (Unique identifier for a given organization.)", caip2: "" // CAIP-2 chain ID (e.g., 'eip155:1' for Ethereum mainnet or 'solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp' for Solana mainnet). Human-readable Solana aliases ('solana:mainnet', 'solana:devnet') are also accepted and normalized to canonical CAIP-2 values. }); ``` ```json 200 theme={"system"} { "assets": [ { "caip19": "", "symbol": "", "decimals": "", "logoUrl": "", "name": "" } ] } ``` # List TVC Apps Source: https://docs.turnkey.com/api-reference/queries/list-tvc-apps List all TVC Apps within an organization. Unique identifier for a given organization. A successful response returns the following fields: A list of TVC Apps. Unique Identifier for this TVC App. Unique Identifier of the Organization for this TVC App Name for this TVC App. Public key for the Quorum Key associated with this TVC App manifestSet field Unique Identifier for this TVC Operator Set. Name of this TVC Operator Set. Unique Identifier of the Organization for this TVC Operator Set List of TVC Operators in this set Unique Identifier for this TVC Operator. Name of this TVC Operator. Public key for this TVC Operator. createdAt field seconds field nanos field updatedAt field seconds field nanos field Threshold number of operators required for quorum. createdAt field seconds field nanos field updatedAt field seconds field nanos field shareSet field Unique Identifier for this TVC Operator Set. Name of this TVC Operator Set. Unique Identifier of the Organization for this TVC Operator Set List of TVC Operators in this set Unique Identifier for this TVC Operator. Name of this TVC Operator. Public key for this TVC Operator. createdAt field seconds field nanos field updatedAt field seconds field nanos field Threshold number of operators required for quorum. createdAt field seconds field nanos field updatedAt field seconds field nanos field Whether or not this TVC App has network egress enabled. createdAt field seconds field nanos field updatedAt field seconds field nanos field The deployment currently designated to receive traffic. Null if no deployment for this app is deployed. The public domain for ingress to this TVC App (in the format "app-\.turnkey.cloud"). Whether this app permits debug-mode deployments. Set at app creation via CreateTvcAppIntent.enable\_debug\_mode\_deployments and never updated thereafter. Debug-mode deployments expose logs and emit zero'd attestation PCRs, so remote attestation cannot succeed. The app's quorum key is therefore considered permanently insecure once enabled — a new app with a fresh quorum key must be created to return to a secure posture. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/list_tvc_apps \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getTvcApps({ organizationId: " (Unique identifier for a given organization.)" }); ``` ```json 200 theme={"system"} { "tvcApps": [ { "id": "", "organizationId": "", "name": "", "quorumPublicKey": "", "manifestSet": { "id": "", "name": "", "organizationId": "", "operators": [ { "id": "", "name": "", "publicKey": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } } ], "threshold": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } }, "shareSet": { "id": "", "name": "", "organizationId": "", "operators": [ { "id": "", "name": "", "publicKey": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } } ], "threshold": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } }, "enableEgress": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" }, "liveDeploymentId": "", "publicDomain": "", "enableDebugModeDeployments": "" } ] } ``` # List TVC Deployments Source: https://docs.turnkey.com/api-reference/queries/list-tvc-deployments List all deployments for a given TVC App Unique identifier for a given organization. Unique identifier for a given TVC App. A successful response returns the following fields: List of deployments for this TVC App Unique Identifier for this TVC Deployment. Unique Identifier of the Organization for this TVC Deployment Unique Identifier of the TVC App for this deployment manifestSet field Unique Identifier for this TVC Operator Set. Name of this TVC Operator Set. Unique Identifier of the Organization for this TVC Operator Set List of TVC Operators in this set Unique Identifier for this TVC Operator. Name of this TVC Operator. Public key for this TVC Operator. createdAt field seconds field nanos field updatedAt field seconds field nanos field Threshold number of operators required for quorum. createdAt field seconds field nanos field updatedAt field seconds field nanos field shareSet field Unique Identifier for this TVC Operator Set. Name of this TVC Operator Set. Unique Identifier of the Organization for this TVC Operator Set List of TVC Operators in this set Unique Identifier for this TVC Operator. Name of this TVC Operator. Public key for this TVC Operator. createdAt field seconds field nanos field updatedAt field seconds field nanos field Threshold number of operators required for quorum. createdAt field seconds field nanos field updatedAt field seconds field nanos field manifest field Unique Identifier for this TVC Manifest. The manifest content (raw UTF-8 JSON bytes) createdAt field seconds field nanos field updatedAt field seconds field nanos field List of operator approvals for this manifest Unique ID for this approval Unique Identifier of the TVC Manifest being approved operator field Unique Identifier for this TVC Operator. Name of this TVC Operator. Public key for this TVC Operator. createdAt field seconds field nanos field updatedAt field seconds field nanos field Signature of the operator over the deployment manifest createdAt field seconds field nanos field updatedAt field seconds field nanos field QOS Version used for this deployment pivotContainer field The URL for this container image. The path (in-container) to the executable binary. The arguments to pass to the executable. item field Whether or not this container requires a pull secret to access. healthCheckType field Enum options: `TVC_HEALTH_CHECK_TYPE_HTTP`, `TVC_HEALTH_CHECK_TYPE_GRPC` The port to use for health checks against this executable. The port to use for public ingress to this executable. createdAt field seconds field nanos field updatedAt field seconds field nanos field Whether or not the user wants this deployment deleted from the cluster. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/list_tvc_app_deployments \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "", "appId": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getTvcAppDeployments({ organizationId: " (Unique identifier for a given organization.)", appId: " (Unique identifier for a given TVC App.)" }); ``` ```json 200 theme={"system"} { "tvcDeployments": [ { "id": "", "organizationId": "", "appId": "", "manifestSet": { "id": "", "name": "", "organizationId": "", "operators": [ { "id": "", "name": "", "publicKey": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } } ], "threshold": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } }, "shareSet": { "id": "", "name": "", "organizationId": "", "operators": [ { "id": "", "name": "", "publicKey": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } } ], "threshold": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } }, "manifest": { "id": "", "manifest": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } }, "manifestApprovals": [ { "id": "", "manifestId": "", "operator": { "id": "", "name": "", "publicKey": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } }, "approval": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } } ], "qosVersion": "", "pivotContainer": { "containerUrl": "", "path": "", "args": [ "" ], "hasPullSecret": "", "healthCheckType": "", "healthCheckPort": "", "publicIngressPort": "" }, "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" }, "delete": "" } ] } ``` # List user tags Source: https://docs.turnkey.com/api-reference/queries/list-user-tags List all user tags within an organization. Unique identifier for a given organization. A successful response returns the following fields: A list of user tags. Unique identifier for a given Tag. Human-readable name for a Tag. tagType field Enum options: `TAG_TYPE_USER`, `TAG_TYPE_PRIVATE_KEY` createdAt field seconds field nanos field updatedAt field seconds field nanos field ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/list_user_tags \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().listUserTags({ organizationId: " (Unique identifier for a given organization.)" }); ``` ```json 200 theme={"system"} { "userTags": [ { "tagId": "", "tagName": "", "tagType": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } } ] } ``` # List users Source: https://docs.turnkey.com/api-reference/queries/list-users List all users within an organization. Unique identifier for a given organization. A successful response returns the following fields: A list of users. Unique identifier for a given User. Human-readable name for a User. The user's email address. The user's phone number in E.164 format e.g. +13214567890 A list of Authenticator parameters. Types of transports that may be used by an Authenticator (e.g., USB, NFC, BLE). item field Enum options: `AUTHENTICATOR_TRANSPORT_BLE`, `AUTHENTICATOR_TRANSPORT_INTERNAL`, `AUTHENTICATOR_TRANSPORT_NFC`, `AUTHENTICATOR_TRANSPORT_USB`, `AUTHENTICATOR_TRANSPORT_HYBRID` attestationType field Identifier indicating the type of the Security Key. Unique identifier for a WebAuthn credential. The type of Authenticator device. credential field The public component of a cryptographic key pair used to sign messages and transactions. type field Enum options: `CREDENTIAL_TYPE_WEBAUTHN_AUTHENTICATOR`, `CREDENTIAL_TYPE_API_KEY_P256`, `CREDENTIAL_TYPE_RECOVER_USER_KEY_P256`, `CREDENTIAL_TYPE_API_KEY_SECP256K1`, `CREDENTIAL_TYPE_EMAIL_AUTH_KEY_P256`, `CREDENTIAL_TYPE_API_KEY_ED25519`, `CREDENTIAL_TYPE_OTP_AUTH_KEY_P256`, `CREDENTIAL_TYPE_READ_WRITE_SESSION_KEY_P256`, `CREDENTIAL_TYPE_OAUTH_KEY_P256`, `CREDENTIAL_TYPE_LOGIN` The session profile associated with this credential, if any. This field is only applicable for credentials of type CREDENTIAL\_TYPE\_LOGIN. Unique identifier for a given Authenticator. Human-readable name for an Authenticator. createdAt field seconds field nanos field updatedAt field seconds field nanos field A list of API Key parameters. This field, if not needed, should be an empty array in your request body. credential field The public component of a cryptographic key pair used to sign messages and transactions. type field Enum options: `CREDENTIAL_TYPE_WEBAUTHN_AUTHENTICATOR`, `CREDENTIAL_TYPE_API_KEY_P256`, `CREDENTIAL_TYPE_RECOVER_USER_KEY_P256`, `CREDENTIAL_TYPE_API_KEY_SECP256K1`, `CREDENTIAL_TYPE_EMAIL_AUTH_KEY_P256`, `CREDENTIAL_TYPE_API_KEY_ED25519`, `CREDENTIAL_TYPE_OTP_AUTH_KEY_P256`, `CREDENTIAL_TYPE_READ_WRITE_SESSION_KEY_P256`, `CREDENTIAL_TYPE_OAUTH_KEY_P256`, `CREDENTIAL_TYPE_LOGIN` The session profile associated with this credential, if any. This field is only applicable for credentials of type CREDENTIAL\_TYPE\_LOGIN. Unique identifier for a given API Key. Human-readable name for an API Key. createdAt field seconds field nanos field updatedAt field seconds field nanos field Optional window (in seconds) indicating how long the API Key should last. A list of User Tag IDs. item field A list of Oauth Providers. Unique identifier for an OAuth Provider Human-readable name to identify a Provider. The issuer of the token, typically a URL indicating the authentication server, e.g [https://accounts.google.com](https://accounts.google.com) Expected audience ('aud' attribute of the signed token) which represents the app ID Expected subject ('sub' attribute of the signed token) which represents the user ID createdAt field seconds field nanos field updatedAt field seconds field nanos field createdAt field seconds field nanos field updatedAt field seconds field nanos field A list of MFA Policies that define multi-factor authentication requirements for this user. Unique identifier for a given MFA Policy. Human-readable name for an MFA Policy. A condition expression that evaluates to true or false, determining when this MFA policy applies. An ordered list of authentication requirements. Each requirement must be satisfied sequentially to complete MFA. A list of authentication methods for this MFA step. If only one method is provided, it is required. If multiple are provided, the user must satisfy ANY one of them. type field Enum options: `AUTHENTICATION_TYPE_EMAIL_OTP`, `AUTHENTICATION_TYPE_SMS_OTP`, `AUTHENTICATION_TYPE_PASSKEY`, `AUTHENTICATION_TYPE_API_KEY`, `AUTHENTICATION_TYPE_OAUTH`, `AUTHENTICATION_TYPE_SESSION` Optional specific authenticator ID required (e.g., for requiring a specific session profile id) The order in which this policy is evaluated relative to other MFA policies. Optional human-readable notes added by a User to describe a particular MFA policy. createdAt field seconds field nanos field updatedAt field seconds field nanos field ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/list_users \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getUsers({ organizationId: " (Unique identifier for a given organization.)" }); ``` ```json 200 theme={"system"} { "users": [ { "userId": "", "userName": "", "userEmail": "", "userPhoneNumber": "", "authenticators": [ { "transports": [ "" ], "attestationType": "", "aaguid": "", "credentialId": "", "model": "", "credential": { "publicKey": "", "type": "", "sessionProfileId": "" }, "authenticatorId": "", "authenticatorName": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } } ], "apiKeys": [ { "credential": { "publicKey": "", "type": "", "sessionProfileId": "" }, "apiKeyId": "", "apiKeyName": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" }, "expirationSeconds": "" } ], "userTags": [ "" ], "oauthProviders": [ { "providerId": "", "providerName": "", "issuer": "", "audience": "", "subject": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } } ], "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" }, "mfaPolicies": [ { "mfaPolicyId": "", "mfaPolicyName": "", "condition": "", "requiredAuthenticationMethods": [ { "any": [ { "type": "", "id": "" } ] } ], "order": "", "notes": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" } } ] } ] } ``` # List wallets Source: https://docs.turnkey.com/api-reference/queries/list-wallets List all wallets within an organization. Unique identifier for a given organization. A successful response returns the following fields: A list of wallets. Unique identifier for a given Wallet. Human-readable name for a Wallet. createdAt field seconds field nanos field updatedAt field seconds field nanos field True when a given Wallet is exported, false otherwise. True when a given Wallet is imported, false otherwise. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/list_wallets \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getWallets({ organizationId: " (Unique identifier for a given organization.)" }); ``` ```json 200 theme={"system"} { "wallets": [ { "walletId": "", "walletName": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" }, "exported": "", "imported": "" } ] } ``` # List wallets accounts Source: https://docs.turnkey.com/api-reference/queries/list-wallets-accounts List all accounts within a wallet. Unique identifier for a given organization. Unique identifier for a given wallet. If not provided, all accounts for the organization will be returned. Optional flag to specify if the wallet details should be included in the response. Default = false.

paginationOptions field

A limit of the number of object to be returned, between 1 and 100. Defaults to 10. A pagination cursor. This is an object ID that enables you to fetch all objects before this ID. A pagination cursor. This is an object ID that enables you to fetch all objects after this ID. A successful response returns the following fields: A list of accounts generated from a wallet that share a common seed. Unique identifier for a given Wallet Account. The Organization the Account belongs to. The Wallet the Account was derived from. curve field Enum options: `CURVE_SECP256K1`, `CURVE_ED25519`, `CURVE_P256` pathFormat field Enum options: `PATH_FORMAT_BIP32` Path used to generate the Account. addressFormat field Enum options: `ADDRESS_FORMAT_UNCOMPRESSED`, `ADDRESS_FORMAT_COMPRESSED`, `ADDRESS_FORMAT_ETHEREUM`, `ADDRESS_FORMAT_SOLANA`, `ADDRESS_FORMAT_COSMOS`, `ADDRESS_FORMAT_TRON`, `ADDRESS_FORMAT_SUI`, `ADDRESS_FORMAT_APTOS`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_MAINNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2PKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2SH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2WSH`, `ADDRESS_FORMAT_BITCOIN_SIGNET_P2TR`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2PKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2SH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WPKH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2WSH`, `ADDRESS_FORMAT_BITCOIN_REGTEST_P2TR`, `ADDRESS_FORMAT_SEI`, `ADDRESS_FORMAT_XLM`, `ADDRESS_FORMAT_DOGE_MAINNET`, `ADDRESS_FORMAT_DOGE_TESTNET`, `ADDRESS_FORMAT_TON_V3R2`, `ADDRESS_FORMAT_TON_V4R2`, `ADDRESS_FORMAT_TON_V5R1`, `ADDRESS_FORMAT_XRP`, `ADDRESS_FORMAT_SPARK_MAINNET`, `ADDRESS_FORMAT_SPARK_REGTEST` Address generated using the Wallet seed and Account parameters. createdAt field seconds field nanos field updatedAt field seconds field nanos field The public component of this wallet account's underlying cryptographic key pair. walletDetails field Unique identifier for a given Wallet. Human-readable name for a Wallet. createdAt field seconds field nanos field updatedAt field seconds field nanos field True when a given Wallet is exported, false otherwise. True when a given Wallet is imported, false otherwise. Human-readable name for this Wallet Account, unique within the organization. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/list_wallet_accounts \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "", "walletId": "", "includeWalletDetails": "", "paginationOptions": { "limit": "", "before": "", "after": "" } }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getWalletAccounts({ organizationId: " (Unique identifier for a given organization.)", walletId: " (Unique identifier for a given wallet. If not provided, all accounts for the organization will be returned.)", includeWalletDetails: true // Optional flag to specify if the wallet details should be included in the response. Default = false., paginationOptions: { // paginationOptions field, limit: " (A limit of the number of object to be returned, between 1 and 100. Defaults to 10.)", before: " (A pagination cursor. This is an object ID that enables you to fetch all objects before this ID.)", after: " (A pagination cursor. This is an object ID that enables you to fetch all objects after this ID.)", } }); ``` ```json 200 theme={"system"} { "accounts": [ { "walletAccountId": "", "organizationId": "", "walletId": "", "curve": "", "pathFormat": "", "path": "", "addressFormat": "", "address": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" }, "publicKey": "", "walletDetails": { "walletId": "", "walletName": "", "createdAt": { "seconds": "", "nanos": "" }, "updatedAt": { "seconds": "", "nanos": "" }, "exported": "", "imported": "" }, "name": "" } ] } ``` # List webhook endpoints Source: https://docs.turnkey.com/api-reference/queries/list-webhook-endpoints List webhook endpoints within an organization. Unique identifier for a given Organization. A successful response returns the following fields: webhookEndpoints field Unique identifier of the webhook endpoint. Unique identifier for a given Organization. The destination URL for webhook delivery. Human-readable name for this webhook endpoint. Whether this webhook endpoint is active. Current subscriptions attached to this endpoint. The event type to subscribe to (for example, ACTIVITY\_UPDATES, BALANCE\_CONFIRMED\_UPDATES, or BALANCE\_FINALIZED\_UPDATES). JSON-encoded filter criteria for this subscription. Whether this subscription is active. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/list_webhook_endpoints \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().listWebhookEndpoints({ organizationId: " (Unique identifier for a given Organization.)" }); ``` ```json 200 theme={"system"} { "webhookEndpoints": [ { "endpointId": "", "organizationId": "", "url": "", "name": "", "isActive": "", "subscriptions": [ { "eventType": "", "filtersJson": "", "isActive": "" } ] } ] } ``` # Queries Source: https://docs.turnkey.com/api-reference/queries/overview Queries are read requests to Turnkey's API. They allow you to retrieve data about your organization and its resources. Queries are read-only operations that let you fetch information from Turnkey's API without modifying any resources. Query endpoints are always prefixed with `/public/v1/query`. * **No Policy Enforcement:** Queries are not subject to the policy engine, so any authenticated user in your organization can perform them. * **Organization-wide Access:** All users within an organization can read any data within the organization. Parent organizations can also query data for all of their sub-organizations. * **Use Cases:** Common use cases include listing users, retrieving organization details, and fetching activity logs. # Validate Container Image for TVC Source: https://docs.turnkey.com/api-reference/queries/validate-container-image-for-tvc Validate a container image URL and pull secret for TVC deployment Unique identifier for a given Organization. URL of the container image. HPKE-encrypted pull secret for private images. A successful response returns the following fields: resolvedImageDigest field ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/validate_tvc_image \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "", "pivotContainerImageUrl": "", "pivotContainerEncryptedPullSecret": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().validateTvcImage({ organizationId: " (Unique identifier for a given Organization.)", pivotContainerImageUrl: " (URL of the container image.)", pivotContainerEncryptedPullSecret: " (HPKE-encrypted pull secret for private images.)" }); ``` ```json 200 theme={"system"} { "resolvedImageDigest": "" } ``` # Who am I? Source: https://docs.turnkey.com/api-reference/queries/who-am-i Get basic information about your current API or WebAuthN user and their organization. Affords sub-organization look ups via parent organization for WebAuthN or API key users. Unique identifier for a given organization. If the request is being made by a WebAuthN user and their sub-organization ID is unknown, this can be the parent organization ID; using the sub-organization ID when possible is preferred due to performance reasons. A successful response returns the following fields: Unique identifier for a given organization. Human-readable name for an organization. Unique identifier for a given user. Human-readable name for a user. ```bash title="cURL" theme={"system"} curl --request POST \ --url https://api.turnkey.com/public/v1/query/whoami \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "X-Stamp: (see Authorizations)" \ --data '{ "organizationId": "" }' ``` ```javascript title="JavaScript" theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const response = await turnkeyClient.apiClient().getWhoami({ organizationId: " (Unique identifier for a given organization. If the request is being made by a WebAuthN user and their sub-organization ID is unknown, this can be the parent organization ID; using the sub-organization ID when possible is preferred due to performance reasons.)" }); ``` ```json 200 theme={"system"} { "organizationId": "", "organizationName": "", "userId": "", "username": "" } ``` # API changelog Source: https://docs.turnkey.com/changelogs/api-changelog/readme PLACEHOLDER -- Version history and breaking changes for the Turnkey API. # API changelog > **This is a placeholder page.** API changelog entries will be added in a future phase. # Api Key Stamper Source: https://docs.turnkey.com/changelogs/api-key-stamper/readme # @turnkey/api-key-stamper ## 0.6.3 ### Patch Changes * Updated dependencies \[]: * @turnkey/crypto\@2.8.12 ## 0.6.2 ### Patch Changes * Updated dependencies \[]: * @turnkey/crypto\@2.8.11 ## 0.6.1 ### Patch Changes * Updated dependencies \[]: * @turnkey/crypto\@2.8.10 ## 0.6.0 ### Minor Changes * [#1135](https://github.com/tkhq/sdk/pull/1135) [`91d6a9e`](https://github.com/tkhq/sdk/commit/91d6a9eb1b9ac9e21745749615ac7a7be66f5cf6) Author [@ethankonk](https://github.com/ethankonk) - Exposed a `sign` method from the stamper for signing arbitrary payloads * Accepts a string payload and returns a signature in either `RAW` or `DER` format. ### Patch Changes * Updated dependencies \[[`d0dba04`](https://github.com/tkhq/sdk/commit/d0dba0412fa7b0c7c9b135e73cc0ef6f55187314)]: * @turnkey/crypto\@2.8.9 ## 0.5.0 ### Minor Changes * Updated dependencies \[[`fc1d6e2`](https://github.com/tkhq/sdk/commit/fc1d6e2d26f4a53116633e9e8cccccd792267f4e), [`fc1d6e2`](https://github.com/tkhq/sdk/commit/fc1d6e2d26f4a53116633e9e8cccccd792267f4e), [`4880f26`](https://github.com/tkhq/sdk/commit/4880f26a4dd324c049bff7f35284098ccfc55823), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`06347ad`](https://github.com/tkhq/sdk/commit/06347adfa08fb0867c350e43821d0fed06c49624), [`6bfcbc5`](https://github.com/tkhq/sdk/commit/6bfcbc5c098e64ab1d115518733b87cfc1653e17)]: * @turnkey/encoding\@0.6.0 ## 0.5.0-beta.6 ### Patch Changes * Updated dependencies \[]: * @turnkey/encoding\@0.6.0-beta.6 ## 0.5.0-beta.5 ### Minor Changes * SDK beta release @turnkey/react-wallet-kit @turnkey/core ### Patch Changes * Updated dependencies \[]: * @turnkey/encoding\@0.6.0-beta.5 ## 0.4.8-beta.4 ### Patch Changes * Updated dependencies \[]: * @turnkey/encoding\@0.6.0-beta.4 ## 0.4.8-beta.3 ### Patch Changes * Updated dependencies \[]: * @turnkey/encoding\@0.6.0-beta.3 ## 0.4.8-beta.2 ### Patch Changes * Updated dependencies \[]: * @turnkey/encoding\@0.6.0-beta.2 ## 0.4.8-beta.1 ### Patch Changes * Updated dependencies \[]: * @turnkey/encoding\@0.6.0-beta.1 ## 0.4.8-beta.0 ### Patch Changes * Updated dependencies \[]: * @turnkey/encoding\@0.6.0-beta.0 ## 0.4.7 ### Patch Changes * [#698](https://github.com/tkhq/sdk/pull/698) [`7625df0`](https://github.com/tkhq/sdk/commit/7625df0538002c3455bd5862211210e38472e164) Author [@moeodeh3](https://github.com/moeodeh3) - Introduces an optional `runtimeOverride` parameter that allows the ability to explicitly specify the crypto environment: `"browser"`, `"node"`, or `"purejs"`. ## 0.4.6 ### Patch Changes * Updated dependencies \[[`40c4035`](https://github.com/tkhq/sdk/commit/40c40359ec7096d0bca39ffc93e89361b3b11a1a)]: * @turnkey/encoding\@0.5.0 ## 0.4.5 ### Patch Changes * 4d1d775: Better error message and docstring for API key import ## 0.4.4 ### Patch Changes * 2d5977b: Update error messaging around api key and target public key usage ## 0.4.3 ### Patch Changes * Updated dependencies \[e5c4fe9] * @turnkey/encoding\@0.4.0 ## 0.4.2 ### Patch Changes * Updated dependencies \[93666ff] * @turnkey/encoding\@0.3.0 ## 0.4.1 ### Patch Changes * Changes: Resolves bugs where byte arrays might not be sufficiently padded (32 bytes are expected for x, y, and d elements of a JWK) * Updated dependencies * @turnkey/encoding\@0.2.1 ## 0.4.0 ### Minor Changes * New PureJS implementation for \`@turnkey/api-key-stamper\`\` to support React Native * Introduce a dependency on `@turnkey/encoding` to consolidate utility functions ## 0.3.1 ### Patch Changes * Upgrade to Node v18 (#184) ## 0.3.0 ### Minor Changes * Use rollup to build ESM and CommonJS, fix ESM support (#174) ## 0.2.0 ### Minor Changes * Add ESM support (#154) ## 0.1.1 ### Patch Changes * Hint for web bundlers not to polyfill Node crypto ## 0.1.0 Initial release # Core Source: https://docs.turnkey.com/changelogs/core/readme # @turnkey/core ## 1.13.0 ### Minor Changes * [#1228](https://github.com/tkhq/sdk/pull/1228) [`1d108d6`](https://github.com/tkhq/sdk/commit/1d108d6496ad8266db0e997a27aecc81e46008fb) Thanks [@moe-dev](https://github.com/moe-dev)! - This branch adds first-class ERC20 transfer abstractions across `@turnkey/core`, `@turnkey/react-wallet-kit`, and `@turnkey/react-native-wallet-kit`. ### `@turnkey/core` * Added `Erc20Transfer` and `EthSendErc20TransferParams` method types. * Added `TurnkeyClient.ethSendErc20Transfer(...)` as a convenience wrapper that ABI-encodes `transfer(address,uint256)` and submits via `ethSendTransaction`. * Updated `ethSendTransaction` to stop prefetching nonces with `getNonces`; transaction fields are now forwarded directly to Turnkey's coordinator (including optional caller-provided `nonce` / `gasStationNonce`). ### `@turnkey/react-wallet-kit` * Added low-level `ethSendErc20Transfer(...)` passthrough in the client provider context. * Added `handleSendErc20Transfer(...)` modal flow that submits ERC20 transfers and polls transaction status to terminal state. * Added new public types/docs for `HandleSendErc20TransferParams` and `ClientContextType.handleSendErc20Transfer`. ### `@turnkey/react-native-wallet-kit` * Added low-level `ethSendErc20Transfer(...)` passthrough in `TurnkeyProvider` context to match `ClientContextType` and support ERC20 sends from React Native. ### Patch Changes * [#1235](https://github.com/tkhq/sdk/pull/1235) [`82dc76c`](https://github.com/tkhq/sdk/commit/82dc76c7ce51e5375570bbffab32eb739af90381) Author [@ethankonk](https://github.com/ethankonk) - Fix missing `return` statements on `withTurnkeyErrorHandling` in `storeSession`, `clearSession`, `clearAllSessions`, `logout`, and `clearUnusedKeyPairs`, ensuring errors are properly propagated and local storage write complete before returning * [#1241](https://github.com/tkhq/sdk/pull/1241) [`dfdd864`](https://github.com/tkhq/sdk/commit/dfdd8647266fdd0297aaea32046ee815ae8fc27c) Author [@ethankonk](https://github.com/ethankonk) - Patched solana chain filter in wallet connecting logic * Updated dependencies \[[`dfdd864`](https://github.com/tkhq/sdk/commit/dfdd8647266fdd0297aaea32046ee815ae8fc27c)]: * @turnkey/sdk-types\@0.12.1 * @turnkey/crypto\@2.8.12 * @turnkey/api-key-stamper\@0.6.3 * @turnkey/http\@3.17.1 * @turnkey/react-native-passkey-stamper\@1.2.11 ## 1.12.0 ### Minor Changes * [#1206](https://github.com/tkhq/sdk/pull/1206) [`58e04e5`](https://github.com/tkhq/sdk/commit/58e04e5856626d9d2593abb61d8ca32d8ccbb833) Author [@DeRauk](https://github.com/DeRauk) - Adds sdk methods for the GetWalletAddressBalances and ListSupportedAssets apis. ### Patch Changes * [#1209](https://github.com/tkhq/sdk/pull/1209) [`af6262f`](https://github.com/tkhq/sdk/commit/af6262f31e1abb3090fcda1eec5318056e6d51fe) Author [@moeodeh3](https://github.com/moeodeh3) - Bump `@walletconnect/sign-client` to `2.23.6` to address [https://github.com/advisories/GHSA-mp2g-9vg9-f4cg](https://github.com/advisories/GHSA-mp2g-9vg9-f4cg) * [#1201](https://github.com/tkhq/sdk/pull/1201) [`1f6e240`](https://github.com/tkhq/sdk/commit/1f6e2403fca1fd9cbca646f88c88dbc49ddb0c34) Author [@ethankonk](https://github.com/ethankonk) - Synced with Mono v2026.2.0 * [#1197](https://github.com/tkhq/sdk/pull/1197) [`7458b7c`](https://github.com/tkhq/sdk/commit/7458b7cd6fc64796b376e3374b7c2ed79467459c) Thanks [@moe-dev](https://github.com/moe-dev)! - Add support for SolSendTransaction and associated abstractions * Updated dependencies \[[`1f6e240`](https://github.com/tkhq/sdk/commit/1f6e2403fca1fd9cbca646f88c88dbc49ddb0c34), [`58e04e5`](https://github.com/tkhq/sdk/commit/58e04e5856626d9d2593abb61d8ca32d8ccbb833), [`7458b7c`](https://github.com/tkhq/sdk/commit/7458b7cd6fc64796b376e3374b7c2ed79467459c)]: * @turnkey/sdk-types\@0.12.0 * @turnkey/http\@3.17.0 * @turnkey/crypto\@2.8.11 * @turnkey/react-native-passkey-stamper\@1.2.10 * @turnkey/api-key-stamper\@0.6.2 ## 1.11.2 ### Patch Changes * [#1188](https://github.com/tkhq/sdk/pull/1188) [`d49ef7e`](https://github.com/tkhq/sdk/commit/d49ef7e9f0f78f16b1324a357f61cf0351198096) Author [@moeodeh3](https://github.com/moeodeh3) - Scope keychain storage to Turnkey keys by prefixing service names. This fixes an issue where `clearUnusedKeyPairs()` was deleting non-Turnkey keychain entries. * [#1194](https://github.com/tkhq/sdk/pull/1194) [`dced9db`](https://github.com/tkhq/sdk/commit/dced9dbbd8ea533442e19e45ce36e6a05a45a555) Author [@moeodeh3](https://github.com/moeodeh3) - Add `Content-Type: application/json` header to all Turnkey API requests. The missing header caused "Network request failed" errors on React Native, intermittent for some setups and consistent for others, where OkHttp-backed fetch can reject `POST` requests without an explicit `Content-Type`. See also: [https://github.com/JakeChampion/fetch/issues/823](https://github.com/JakeChampion/fetch/issues/823) Special thanks to @jrmykolyn and @niroshanS for helping identify and debug this issue * Updated dependencies \[[`dced9db`](https://github.com/tkhq/sdk/commit/dced9dbbd8ea533442e19e45ce36e6a05a45a555)]: * @turnkey/http\@3.16.3 * @turnkey/react-native-passkey-stamper\@1.2.9 ## 1.11.1 ### Patch Changes * [#1171](https://github.com/tkhq/sdk/pull/1171) [`2d19991`](https://github.com/tkhq/sdk/commit/2d19991bcf4e1c9704b73a48c54e870373b4bd95) Author [@moeodeh3](https://github.com/moeodeh3) - Fix mobile `setActiveSessionKey()` to JSON stringify session key. This fixes parsing errors in `getActiveSessionKey()` * [#1177](https://github.com/tkhq/sdk/pull/1177) [`89d4084`](https://github.com/tkhq/sdk/commit/89d40844d791b0bbb6d439da5e778b1fdeca4273) Author [@moeodeh3](https://github.com/moeodeh3) - Add a 1-second timeout to external wallet provider discovery. This prevents hanging providers from blocking `fetchUser()` and `fetchWallet()` * [#1174](https://github.com/tkhq/sdk/pull/1174) [`ba2521d`](https://github.com/tkhq/sdk/commit/ba2521d5d1c1f6baaa58ee65dce8cc4839f7dc7b) Author [@ethankonk](https://github.com/ethankonk) - Fixed bug preventing sub-orgs from adding Google social providers when the parsed email matches their user email * [#1185](https://github.com/tkhq/sdk/pull/1185) [`12ca083`](https://github.com/tkhq/sdk/commit/12ca083314310b05cf41ac29fa2d55eed627f229) Author [@moeodeh3](https://github.com/moeodeh3) - Remove leading whitespaces in wallet provider icon URLs * [#1179](https://github.com/tkhq/sdk/pull/1179) [`a85153c`](https://github.com/tkhq/sdk/commit/a85153c8ccc7454cd5aca974bc463fb47c7f8cd4) Author [@moeodeh3](https://github.com/moeodeh3) - - Fix `loginWithWallet()` returning the wrong address and sporadically failing * Deprecate `sendSignedRequest()` in favor of `httpClient.sendSignedRequest()`, which includes automatic activity polling and result extraction * Updated dependencies \[[`8e075b7`](https://github.com/tkhq/sdk/commit/8e075b7161ccc68cb446b10b54737856fa0c6d31)]: * @turnkey/sdk-types\@0.11.2 * @turnkey/crypto\@2.8.10 * @turnkey/api-key-stamper\@0.6.1 * @turnkey/http\@3.16.2 * @turnkey/react-native-passkey-stamper\@1.2.8 ## 1.11.0 ### Minor Changes * [#1135](https://github.com/tkhq/sdk/pull/1135) [`91d6a9e`](https://github.com/tkhq/sdk/commit/91d6a9eb1b9ac9e21745749615ac7a7be66f5cf6) Author [@ethankonk](https://github.com/ethankonk) - - Added client signature support for OTP authentication flows * Synced with `mono` v2025.12.2 ### Patch Changes * [#1117](https://github.com/tkhq/sdk/pull/1117) [`699fbd7`](https://github.com/tkhq/sdk/commit/699fbd75ef3f44f768ae641ab4f652e966b8e289) Author [@ethankonk](https://github.com/ethankonk) - Fixed broken OTP flow when "Verification Token Required for Account Lookups" was enabled in the Auth Proxy * Updated dependencies \[[`d0dba04`](https://github.com/tkhq/sdk/commit/d0dba0412fa7b0c7c9b135e73cc0ef6f55187314), [`91d6a9e`](https://github.com/tkhq/sdk/commit/91d6a9eb1b9ac9e21745749615ac7a7be66f5cf6), [`91d6a9e`](https://github.com/tkhq/sdk/commit/91d6a9eb1b9ac9e21745749615ac7a7be66f5cf6)]: * @turnkey/crypto\@2.8.9 * @turnkey/api-key-stamper\@0.6.0 * @turnkey/sdk-types\@0.11.1 * @turnkey/http\@3.16.1 * @turnkey/react-native-passkey-stamper\@1.2.7 ## 1.10.0 ### Minor Changes * [#1153](https://github.com/tkhq/sdk/pull/1153) [`78ec1d9`](https://github.com/tkhq/sdk/commit/78ec1d9afcafde3ca7107fc720323d486d6afaea) Thanks [@moe-dev](https://github.com/moe-dev)! - Update as per mono v2025.12.3. ### Behavioral Changes * `appName` is now **required**: * In `emailCustomization` for Email Auth activities * At the top-level intent for OTP activities * Auth proxy endpoints are **not affected** ### Activity Version Bumps The following activity types have been versioned: * `ACTIVITY_TYPE_INIT_OTP` → `ACTIVITY_TYPE_INIT_OTP_V2` * `ACTIVITY_TYPE_INIT_OTP_AUTH_V2` → `ACTIVITY_TYPE_INIT_OTP_V3` * `ACTIVITY_TYPE_EMAIL_AUTH_V2` → `ACTIVITY_TYPE_EMAIL_AUTH_V3` * `ACTIVITY_TYPE_INIT_USER_EMAIL_RECOVERY` -> `ACTIVITY_TYPE_INIT_USER_EMAIL_RECOVERY_V2` ### Patch Changes * [#1145](https://github.com/tkhq/sdk/pull/1145) [`6261eed`](https://github.com/tkhq/sdk/commit/6261eed95af8627bf1e95e7291b9760a2267e301) Author [@moeodeh3](https://github.com/moeodeh3) - Add session `organizationId` fallback to HTTP client stamp functions * Updated dependencies \[[`78ec1d9`](https://github.com/tkhq/sdk/commit/78ec1d9afcafde3ca7107fc720323d486d6afaea)]: * @turnkey/sdk-types\@0.11.0 * @turnkey/http\@3.16.0 * @turnkey/crypto\@2.8.8 * @turnkey/react-native-passkey-stamper\@1.2.6 ## 1.9.0 ### Minor Changes * [#1118](https://github.com/tkhq/sdk/pull/1118) [`29a42db`](https://github.com/tkhq/sdk/commit/29a42db8f5f3ef8b9c23c90cd00f4c21027aac2e) Thanks [@moe-dev](https://github.com/moe-dev)! - Add support for high-level Ethereum transaction utilities (**for embedded wallet use only**): * **`ethSendTransaction`** — new helper used as a dedicated method for submitting Ethereum transactions (sign and broadcast) via the Turnkey API. * **`pollTransactionStatus`** — new helper for polling Turnkey’s transaction status endpoint until the transaction reaches a terminal state. These methods enable a clean two-step flow: 1. Submit the transaction intent using `ethSendTransaction`, receiving a `sendTransactionStatusId`. 2. Poll for completion using `pollTransactionStatus` to retrieve the final on-chain transaction hash and execution status. ### Patch Changes * Updated dependencies \[[`29a42db`](https://github.com/tkhq/sdk/commit/29a42db8f5f3ef8b9c23c90cd00f4c21027aac2e)]: * @turnkey/sdk-types\@0.10.0 * @turnkey/crypto\@2.8.7 ## 1.8.3 ### Patch Changes * [#1136](https://github.com/tkhq/sdk/pull/1136) [`7185545`](https://github.com/tkhq/sdk/commit/7185545ea1fc05eb738af09de5a594455f2e08f3) Author [@moeodeh3](https://github.com/moeodeh3) - Fixed missing `X-Client-Version` header in `sendSignedRequest()` ## 1.8.2 ### Patch Changes * [#1127](https://github.com/tkhq/sdk/pull/1127) [`3c23fc2`](https://github.com/tkhq/sdk/commit/3c23fc27eda5325a90e79afff4cc3a16f682e1d9) Author [@moeodeh3](https://github.com/moeodeh3) - Fix duplicate providers returned by `fetchWalletProviders()` when external wallet providers announce multiple EIP-1193 providers (e.g., Backpack) ## 1.8.1 ### Patch Changes * [#1113](https://github.com/tkhq/sdk/pull/1113) [`d4768c7`](https://github.com/tkhq/sdk/commit/d4768c71b6796532c9800d546154116e5d36b255) Author [@moeodeh3](https://github.com/moeodeh3) - Prevented unnecessary permission prompts in non-Ethereum-native wallets (e.g., Cosmos-based wallets like Keplr) by avoiding chainId requests before accounts are connected ## 1.8.0 ### Minor Changes * [#1090](https://github.com/tkhq/sdk/pull/1090) [`e1bd68f`](https://github.com/tkhq/sdk/commit/e1bd68f963d6bbd9c797b1a8f077efadccdec421) Author [@moeodeh3](https://github.com/moeodeh3) - - Fixed `stamp*` methods for query endpoints in `httpClient` incorrectly formatting request body * Parallelized stamper and session initialization * Separated WalletConnect initialization from client init * Optimized `fetchWallet` by reducing redundant queries and running wallet/user fetches in parallel * Added optional `authenticatorAddresses` param to `fetchWalletAccounts()` * Updated to latest `@walletconnect/sign-client` for performance improvements ### Patch Changes * [#1096](https://github.com/tkhq/sdk/pull/1096) [`fd2e031`](https://github.com/tkhq/sdk/commit/fd2e0318079de922512b1f5adb404b11921f77b7) Author [@ethankonk](https://github.com/ethankonk) - Fixed legacy transactions not working in `signAndSendTransaction()` for **EVM connected wallet**. This does not affect Turnkey's embedded wallet flow, previously, connected wallet transactions were all formatted into EIP-1559 transactions, updated to respect legacy + future formats passed in. * Updated dependencies \[[`80ea306`](https://github.com/tkhq/sdk/commit/80ea306025a2161ff575a5e2b45794460eafdf1b)]: * @turnkey/sdk-types\@0.9.0 * @turnkey/crypto\@2.8.6 ## 1.7.0 ### Minor Changes * [#1072](https://github.com/tkhq/sdk/pull/1072) [`67b03a5`](https://github.com/tkhq/sdk/commit/67b03a5d9ab1b6eabfb0b41938ac91365b5dcd9b) Thanks [@moe-dev](https://github.com/moe-dev)! - Bump packages as per mono v2025.11.0 ### Patch Changes * [#1074](https://github.com/tkhq/sdk/pull/1074) [`beee465`](https://github.com/tkhq/sdk/commit/beee465a13f64abeb71c5c00519f7abab9942607) Author [@moeodeh3](https://github.com/moeodeh3) - - added optional `organizationId` to `loginWithOAuth()` * added optional `invalidateExisting` to `signUpWithOAuth()` * fixed `invalidateExisting` being ignored in `completeOAuth()` during signup * Updated dependencies \[[`5f829c6`](https://github.com/tkhq/sdk/commit/5f829c67af03bb85c3806acd202b2debf8274e78), [`084acce`](https://github.com/tkhq/sdk/commit/084acce85fe7c15513a025e77c1571012ac82e4b), [`67b03a5`](https://github.com/tkhq/sdk/commit/67b03a5d9ab1b6eabfb0b41938ac91365b5dcd9b)]: * @turnkey/crypto\@2.8.5 * @turnkey/sdk-types\@0.8.0 * @turnkey/http\@3.15.0 * @turnkey/react-native-passkey-stamper\@1.2.5 ## 1.6.0 ### Minor Changes * [#1058](https://github.com/tkhq/sdk/pull/1058) [`9fbd5c4`](https://github.com/tkhq/sdk/commit/9fbd5c459782dc3721dd0935d0a4458babce258b) Author [@moeodeh3](https://github.com/moeodeh3) - Update per mono release `v2025.10.10-hotfix.2` ### Patch Changes * Updated dependencies \[[`9fbd5c4`](https://github.com/tkhq/sdk/commit/9fbd5c459782dc3721dd0935d0a4458babce258b)]: * @turnkey/http\@3.14.0 * @turnkey/crypto\@2.8.4 * @turnkey/react-native-passkey-stamper\@1.2.4 ## 1.5.2 ### Patch Changes * Updated dependencies \[[`c745646`](https://github.com/tkhq/sdk/commit/c745646ae4b2a275e116abca07c6e108f89beb04)]: * @turnkey/crypto\@2.8.4 ## 1.5.1 ### Patch Changes * [#1031](https://github.com/tkhq/sdk/pull/1031) [`886f319`](https://github.com/tkhq/sdk/commit/886f319fab8b0ba560d040e34598436f3beceff0) Author [@ethankonk](https://github.com/ethankonk) - Fixed session token getting cleared when using loginWithWallet ## 1.5.0 ### Minor Changes * [#992](https://github.com/tkhq/sdk/pull/992) [`5c4495b`](https://github.com/tkhq/sdk/commit/5c4495bff1b0abfe3c427ead1b8e1a8d510c8186) Author [@amircheikh](https://github.com/amircheikh) - - Added `verifyAppProofs` function. Used alongside activities that return app proofs, this function will fetch the corresponding boot proof for a list of app proofs and securely verify them on the client. Learn more about Turnkey Verified [here](https://docs.turnkey.com/security/turnkey-verified) * All auth methods that make signup requests now optionally return a list of `appProofs` ### Patch Changes * [#1020](https://github.com/tkhq/sdk/pull/1020) [`001d822`](https://github.com/tkhq/sdk/commit/001d8225202500e53aa399d6aee0c8f48f6060e0) Author [@moeodeh3](https://github.com/moeodeh3) - Fixed an issue in `signAndSendTransaction` where Ethereum embedded wallet transactions failed during broadcast due to missing `0x` prefixes * Updated dependencies \[[`5c4495b`](https://github.com/tkhq/sdk/commit/5c4495bff1b0abfe3c427ead1b8e1a8d510c8186), [`5c4495b`](https://github.com/tkhq/sdk/commit/5c4495bff1b0abfe3c427ead1b8e1a8d510c8186)]: * @turnkey/crypto\@2.8.3 * @turnkey/sdk-types\@0.6.3 ## 1.4.2 ### Patch Changes * [#1016](https://github.com/tkhq/sdk/pull/1016) [`9df42ad`](https://github.com/tkhq/sdk/commit/9df42adc02c7ff77afba3b938536e79b57882ef1) Author [@amircheikh](https://github.com/amircheikh) - Synced API as per mono v2025.10.2 * Updated dependencies \[[`9df42ad`](https://github.com/tkhq/sdk/commit/9df42adc02c7ff77afba3b938536e79b57882ef1), [`429e4c4`](https://github.com/tkhq/sdk/commit/429e4c4b5d897a7233584d4ec429b21bba7a1f2b)]: * @turnkey/sdk-types\@0.6.2 * @turnkey/http\@3.13.1 * @turnkey/react-native-passkey-stamper\@1.2.3 * @turnkey/crypto\@2.8.2 ## 1.4.1 ### Patch Changes * [#1010](https://github.com/tkhq/sdk/pull/1010) [`e5b9c5c`](https://github.com/tkhq/sdk/commit/e5b9c5c5694b1f4d60c0b8606822bcd6d61da4a3) Author [@moeodeh3](https://github.com/moeodeh3) - - Fixed errors not being deserialized in `withTurnkeyErrorHandling()`, which previously caused them to stringify as `[object Object]` * Improved error messages surfaced by `connectWalletAccount()` ## 1.4.0 ### Minor Changes * [#986](https://github.com/tkhq/sdk/pull/986) [`6ceb06e`](https://github.com/tkhq/sdk/commit/6ceb06ebdbb11b017ed97e81a7e0dcb862813bfa) Author [@amircheikh](https://github.com/amircheikh) - - Added `defaultStamperType` param to the configuration. This will force the underlying `httpClient` to default to a specific stamper for all requests * Added `createHttpClient` function. This allows a duplicate instance of `TurnkeySDKClientBase` to be created and returned. Custom configuration can be passed in to create an entirely new client with a unique config. This is useful for creating different HTTP clients with different default stampers to be used in our helper packages (`@turnkey/viem`, `@turnkey/ethers`, etc) * [#993](https://github.com/tkhq/sdk/pull/993) [`68631c4`](https://github.com/tkhq/sdk/commit/68631c4008387f845dfe4f1a139981011727f6c9) Author [@moeodeh3](https://github.com/moeodeh3) - - Added `sendSignedRequest()` to execute any `TSignedRequest` returned by SDK stamping methods. * Added `buildWalletLoginRequest()` method, which prepares and signs a wallet login request without sending it to Turnkey, returning the `stampLogin` signed request alongside the wallet’s public key used for login. ### Patch Changes * Updated dependencies \[[`68631c4`](https://github.com/tkhq/sdk/commit/68631c4008387f845dfe4f1a139981011727f6c9)]: * @turnkey/sdk-types\@0.6.1 * @turnkey/crypto\@2.8.1 ## 1.3.0 ### Minor Changes * [#974](https://github.com/tkhq/sdk/pull/974) [`3997c0f`](https://github.com/tkhq/sdk/commit/3997c0fd08a8a85108acf904c0bf39d69f8dc79c) Author [@narimonf](https://github.com/narimonf) - Added `fetchBootProofForAppProof`, which fetches the boot proof for a given app proof. ### Patch Changes * [#982](https://github.com/tkhq/sdk/pull/982) [`4adbf9b`](https://github.com/tkhq/sdk/commit/4adbf9bbb6b93f84aa80e06a1eeabd61d1dbbb86) Author [@ethankonk](https://github.com/ethankonk) - - Fixed signing and broadcasting transactions with connected solana accounts * Fixed `fetchWallets` wallet account pagination issue * [#983](https://github.com/tkhq/sdk/pull/983) [`4ead6da`](https://github.com/tkhq/sdk/commit/4ead6da626468fde41daf85eae90faf18651d1c1) Author [@moeodeh3](https://github.com/moeodeh3) - WalletConnect initialization now has a 5-second timeout. If setup fails, it no longer blocks overall client initialization * Updated dependencies \[[`3997c0f`](https://github.com/tkhq/sdk/commit/3997c0fd08a8a85108acf904c0bf39d69f8dc79c), [`3997c0f`](https://github.com/tkhq/sdk/commit/3997c0fd08a8a85108acf904c0bf39d69f8dc79c)]: * @turnkey/crypto\@2.8.0 * @turnkey/sdk-types\@0.6.0 ## 1.2.0 ### Minor Changes * [#977](https://github.com/tkhq/sdk/pull/977) [`4567059`](https://github.com/tkhq/sdk/commit/45670598f102223925b87a5295edca15a6ce8241) Author [@besler613](https://github.com/besler613) - OAuth2Authenticate now supports returning the encrypted bearer token via the optional `bearerTokenTargetPublicKey` request parameter (mono release v2025.9.5) ### Patch Changes * [#972](https://github.com/tkhq/sdk/pull/972) [`010543c`](https://github.com/tkhq/sdk/commit/010543c3b1b56a18816ea92a1a1cbe028cf988e4) Author [@moeodeh3](https://github.com/moeodeh3) - Fix exported types * Updated dependencies \[[`4567059`](https://github.com/tkhq/sdk/commit/45670598f102223925b87a5295edca15a6ce8241)]: * @turnkey/sdk-types\@0.5.0 * @turnkey/http\@3.13.0 * @turnkey/crypto\@2.7.0 * @turnkey/react-native-passkey-stamper\@1.2.2 ## 1.1.0 ### Minor Changes * [#940](https://github.com/tkhq/sdk/pull/940) [`e4bc82f`](https://github.com/tkhq/sdk/commit/e4bc82fc51c692d742923ccfff72c2c862ee71a4) Author [@moeodeh3](https://github.com/moeodeh3) - - Added optional params for sessionless stamping (passkey/wallet only setups) ### Patch Changes * [#946](https://github.com/tkhq/sdk/pull/946) [`0080c4d`](https://github.com/tkhq/sdk/commit/0080c4d011a7f8d04b41d89b31863b75d1a816ef) Author [@moeodeh3](https://github.com/moeodeh3) - - Added `proposalExpired` event emission in WalletConnect provider * Added automatic URI regeneration when a WalletConnect URI expires * [#958](https://github.com/tkhq/sdk/pull/958) [`5a96fe8`](https://github.com/tkhq/sdk/commit/5a96fe80db4c4c45e09ad8c613695ee4c2b8e51f) Author [@amircheikh](https://github.com/amircheikh) - - Synced api with mono * [#960](https://github.com/tkhq/sdk/pull/960) [`c2a0bd7`](https://github.com/tkhq/sdk/commit/c2a0bd7ea8a53524cde16897f375f8a7088ba963) Author [@moeodeh3](https://github.com/moeodeh3) - - Removed requirement of session for external wallet usage * `connectExternalWalletAccount()` now returns the wallet address instead of `void` * `fetchWallets()` now supports an optional `connectedOnly` parameter to fetch only connected wallets * [#940](https://github.com/tkhq/sdk/pull/940) [`90841f9`](https://github.com/tkhq/sdk/commit/90841f95f3f738c47c04797096902d9d0a23afc7) Author [@moeodeh3](https://github.com/moeodeh3) - - Fixed signMessage() to respect the provided encoding override instead of silently ignoring it * Corrected Ethereum message prefixing for embedded wallets in `signMessage()` to fully align with EIP-191 standards * Updated dependencies \[[`2191a1b`](https://github.com/tkhq/sdk/commit/2191a1b201fb17dea4c79cf9e02b3a493b18f97a), [`5a96fe8`](https://github.com/tkhq/sdk/commit/5a96fe80db4c4c45e09ad8c613695ee4c2b8e51f)]: * @turnkey/crypto\@2.7.0 * @turnkey/sdk-types\@0.4.1 * @turnkey/http\@3.12.1 * @turnkey/react-native-passkey-stamper\@1.2.1 ## 1.0.0 ### Major Changes * Initial Stable Release: `@turnkey/core` 🎉\ Turnkey’s **core TypeScript client-side SDK** for Embedded Wallets is now generally available. * Provides a set of functions and utilities to interact with Turnkey’s APIs * Includes a powerful session management system * Comes with built-in stampers for signing flows * Exposes a raw HTTP client for advanced use cases * Designed to be the foundation for building Embedded Wallets across frameworks (React, React Native, Angular, Vue, Svelte) 📚 [Read the full docs here](https://docs.turnkey.com/sdks/typescript-frontend) ### Minor Changes * [#677](https://github.com/tkhq/sdk/pull/677) [`fc1d6e2`](https://github.com/tkhq/sdk/commit/fc1d6e2d26f4a53116633e9e8cccccd792267f4e) Author [@amircheikh](https://github.com/amircheikh) - @turnkey/react-wallet-kit and @turnkey/core beta-3 release * [#677](https://github.com/tkhq/sdk/pull/677) [`fc1d6e2`](https://github.com/tkhq/sdk/commit/fc1d6e2d26f4a53116633e9e8cccccd792267f4e) Author [@amircheikh](https://github.com/amircheikh) - @turnkey/react-wallet-kit and @turnkey/core beta-3 release * [#677](https://github.com/tkhq/sdk/pull/677) [`4880f26`](https://github.com/tkhq/sdk/commit/4880f26a4dd324c049bff7f35284098ccfc55823) Author [@amircheikh](https://github.com/amircheikh) - @turnkey/react-wallet-kit and @turnkey/core beta release * [#677](https://github.com/tkhq/sdk/pull/677) [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c) Author [@amircheikh](https://github.com/amircheikh) - updating package versions * [#677](https://github.com/tkhq/sdk/pull/677) [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c) Author [@amircheikh](https://github.com/amircheikh) - test build * [#677](https://github.com/tkhq/sdk/pull/677) [`06347ad`](https://github.com/tkhq/sdk/commit/06347adfa08fb0867c350e43821d0fed06c49624) Author [@amircheikh](https://github.com/amircheikh) - SDK beta release @turnkey/react-wallet-kit @turnkey/core ### Patch Changes * Updated dependencies \[[`fc1d6e2`](https://github.com/tkhq/sdk/commit/fc1d6e2d26f4a53116633e9e8cccccd792267f4e), [`fc1d6e2`](https://github.com/tkhq/sdk/commit/fc1d6e2d26f4a53116633e9e8cccccd792267f4e), [`4880f26`](https://github.com/tkhq/sdk/commit/4880f26a4dd324c049bff7f35284098ccfc55823), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`06347ad`](https://github.com/tkhq/sdk/commit/06347adfa08fb0867c350e43821d0fed06c49624), [`6bfcbc5`](https://github.com/tkhq/sdk/commit/6bfcbc5c098e64ab1d115518733b87cfc1653e17)]: * @turnkey/sdk-types\@0.4.0 * @turnkey/encoding\@0.6.0 * @turnkey/http\@3.12.0 * @turnkey/crypto\@2.6.0 * @turnkey/react-native-passkey-stamper\@1.2.0 * @turnkey/webauthn-stamper\@0.6.0 * @turnkey/api-key-stamper\@0.5.0 ## 1.0.0-beta.6 ### Minor Changes * @turnkey/react-wallet-kit and @turnkey/core beta release ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-types\@0.4.0-beta.6 * @turnkey/encoding\@0.6.0-beta.6 * @turnkey/crypto\@2.6.0-beta.6 * @turnkey/api-key-stamper\@0.5.0-beta.6 * @turnkey/http\@3.11.1-beta.0 * @turnkey/react-native-passkey-stamper\@1.2.0-beta.1 ## 1.0.0-beta.5 ### Minor Changes * SDK beta release @turnkey/react-wallet-kit @turnkey/core ### Patch Changes * Updated dependencies \[]: * @turnkey/react-native-passkey-stamper\@1.2.0-beta.0 * @turnkey/webauthn-stamper\@0.6.0-beta.0 * @turnkey/api-key-stamper\@0.5.0-beta.5 * @turnkey/sdk-types\@0.4.0-beta.5 * @turnkey/encoding\@0.6.0-beta.5 * @turnkey/crypto\@2.6.0-beta.5 * @turnkey/http\@3.10.0-beta.2 ## 1.0.0-beta.4 ### Minor Changes * @turnkey/react-wallet-kit and @turnkey/core beta-3 release ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-types\@0.4.0-beta.4 * @turnkey/encoding\@0.6.0-beta.4 * @turnkey/http\@3.10.0-beta.1 * @turnkey/api-key-stamper\@0.4.8-beta.4 * @turnkey/crypto\@2.5.1-beta.4 * @turnkey/react-native-passkey-stamper\@1.1.2-beta.4 ## 1.0.0-beta.3 ### Minor Changes * @turnkey/react-wallet-kit and @turnkey/core beta-3 release ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-types\@0.4.0-beta.3 * @turnkey/encoding\@0.6.0-beta.3 * @turnkey/http\@3.10.0-beta.0 * @turnkey/api-key-stamper\@0.4.8-beta.3 * @turnkey/crypto\@2.5.1-beta.3 * @turnkey/react-native-passkey-stamper\@1.1.2-beta.3 ## 1.0.0-beta.2 ### Minor Changes * updating package versions ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-types\@0.4.0-beta.2 * @turnkey/encoding\@0.6.0-beta.2 * @turnkey/api-key-stamper\@0.4.8-beta.2 * @turnkey/crypto\@2.5.1-beta.2 * @turnkey/http\@3.8.1-beta.2 * @turnkey/react-native-passkey-stamper\@1.1.2-beta.2 ## 1.0.0-beta.1 ### Minor Changes * test build ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-types\@0.4.0-beta.1 * @turnkey/encoding\@0.6.0-beta.1 * @turnkey/api-key-stamper\@0.4.8-beta.1 * @turnkey/crypto\@2.5.1-beta.1 * @turnkey/http\@3.8.1-beta.1 * @turnkey/react-native-passkey-stamper\@1.1.2-beta.1 ## 1.0.0-beta.0 ### Major Changes * beta for @turnkey/react-wallet-kit and @turnkey/core ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-types\@0.4.0-beta.0 * @turnkey/encoding\@0.6.0-beta.0 * @turnkey/api-key-stamper\@0.4.8-beta.0 * @turnkey/crypto\@2.5.1-beta.0 * @turnkey/http\@3.8.1-beta.0 * @turnkey/react-native-passkey-stamper\@1.1.2-beta.0 ## 1.0.0 ### Major Changes * Initial beta release for react wallet kit ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-types\@0.4.0 * @turnkey/encoding\@0.6.0 * @turnkey/api-key-stamper\@0.4.8 * @turnkey/crypto\@2.5.1 * @turnkey/http\@3.8.1 * @turnkey/react-native-passkey-stamper\@1.1.2 ## 1.0.0 ### Major Changes * Initial beta release for @turnkey/react-wallet-kit and @turnkey/core ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-types\@0.4.0 * @turnkey/encoding\@0.6.0 * @turnkey/api-key-stamper\@0.4.8 * @turnkey/crypto\@2.5.1 * @turnkey/http\@3.8.1 * @turnkey/react-native-passkey-stamper\@1.1.2 # Cosmjs Source: https://docs.turnkey.com/changelogs/cosmjs/readme # @turnkey/cosmjs ## 0.8.27 ### Patch Changes * Updated dependencies \[[`82dc76c`](https://github.com/tkhq/sdk/commit/82dc76c7ce51e5375570bbffab32eb739af90381), [`1d108d6`](https://github.com/tkhq/sdk/commit/1d108d6496ad8266db0e997a27aecc81e46008fb), [`dfdd864`](https://github.com/tkhq/sdk/commit/dfdd8647266fdd0297aaea32046ee815ae8fc27c)]: * @turnkey/core\@1.13.0 * @turnkey/sdk-browser\@5.15.2 * @turnkey/api-key-stamper\@0.6.3 * @turnkey/http\@3.17.1 * @turnkey/sdk-server\@5.1.1 ## 0.8.26 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-browser\@5.15.1 ## 0.8.25 ### Patch Changes * Updated dependencies \[[`af6262f`](https://github.com/tkhq/sdk/commit/af6262f31e1abb3090fcda1eec5318056e6d51fe), [`1f6e240`](https://github.com/tkhq/sdk/commit/1f6e2403fca1fd9cbca646f88c88dbc49ddb0c34), [`58e04e5`](https://github.com/tkhq/sdk/commit/58e04e5856626d9d2593abb61d8ca32d8ccbb833), [`7458b7c`](https://github.com/tkhq/sdk/commit/7458b7cd6fc64796b376e3374b7c2ed79467459c)]: * @turnkey/core\@1.12.0 * @turnkey/sdk-browser\@5.15.0 * @turnkey/sdk-server\@5.1.0 * @turnkey/http\@3.17.0 * @turnkey/api-key-stamper\@0.6.2 ## 0.8.24 ### Patch Changes * Updated dependencies \[[`d49ef7e`](https://github.com/tkhq/sdk/commit/d49ef7e9f0f78f16b1324a357f61cf0351198096), [`dced9db`](https://github.com/tkhq/sdk/commit/dced9dbbd8ea533442e19e45ce36e6a05a45a555), [`dced9db`](https://github.com/tkhq/sdk/commit/dced9dbbd8ea533442e19e45ce36e6a05a45a555)]: * @turnkey/core\@1.11.2 * @turnkey/sdk-browser\@5.14.3 * @turnkey/sdk-server\@5.0.3 * @turnkey/http\@3.16.3 ## 0.8.23 ### Patch Changes * Updated dependencies \[[`2d19991`](https://github.com/tkhq/sdk/commit/2d19991bcf4e1c9704b73a48c54e870373b4bd95), [`89d4084`](https://github.com/tkhq/sdk/commit/89d40844d791b0bbb6d439da5e778b1fdeca4273), [`4742eaf`](https://github.com/tkhq/sdk/commit/4742eafbfdcc6fe6b6d3aab01569ad94a5198571), [`ba2521d`](https://github.com/tkhq/sdk/commit/ba2521d5d1c1f6baaa58ee65dce8cc4839f7dc7b), [`12ca083`](https://github.com/tkhq/sdk/commit/12ca083314310b05cf41ac29fa2d55eed627f229), [`a85153c`](https://github.com/tkhq/sdk/commit/a85153c8ccc7454cd5aca974bc463fb47c7f8cd4)]: * @turnkey/core\@1.11.1 * @turnkey/sdk-server\@5.0.2 * @turnkey/sdk-browser\@5.14.2 * @turnkey/api-key-stamper\@0.6.1 * @turnkey/http\@3.16.2 ## 0.8.22 ### Patch Changes * Updated dependencies \[[`91d6a9e`](https://github.com/tkhq/sdk/commit/91d6a9eb1b9ac9e21745749615ac7a7be66f5cf6), [`91d6a9e`](https://github.com/tkhq/sdk/commit/91d6a9eb1b9ac9e21745749615ac7a7be66f5cf6), [`699fbd7`](https://github.com/tkhq/sdk/commit/699fbd75ef3f44f768ae641ab4f652e966b8e289)]: * @turnkey/core\@1.11.0 * @turnkey/api-key-stamper\@0.6.0 * @turnkey/sdk-browser\@5.14.1 * @turnkey/http\@3.16.1 * @turnkey/sdk-server\@5.0.1 ## 0.8.21 ### Patch Changes * Updated dependencies \[[`6261eed`](https://github.com/tkhq/sdk/commit/6261eed95af8627bf1e95e7291b9760a2267e301), [`78ec1d9`](https://github.com/tkhq/sdk/commit/78ec1d9afcafde3ca7107fc720323d486d6afaea), [`dbd4d8e`](https://github.com/tkhq/sdk/commit/dbd4d8e4ea567240c4d287452dd0d8f53050beca), [`cfd34ab`](https://github.com/tkhq/sdk/commit/cfd34ab14ff2abed0e22dca9a802c58a96b9e8e1), [`78ec1d9`](https://github.com/tkhq/sdk/commit/78ec1d9afcafde3ca7107fc720323d486d6afaea)]: * @turnkey/core\@1.10.0 * @turnkey/sdk-server\@5.0.0 * @turnkey/sdk-browser\@5.14.0 * @turnkey/http\@3.16.0 ## 0.8.20 ### Patch Changes * Updated dependencies \[[`29a42db`](https://github.com/tkhq/sdk/commit/29a42db8f5f3ef8b9c23c90cd00f4c21027aac2e)]: * @turnkey/core\@1.9.0 * @turnkey/sdk-browser\@5.13.6 * @turnkey/sdk-server\@4.12.2 ## 0.8.19 ### Patch Changes * Updated dependencies \[[`7185545`](https://github.com/tkhq/sdk/commit/7185545ea1fc05eb738af09de5a594455f2e08f3)]: * @turnkey/core\@1.8.3 * @turnkey/sdk-browser\@5.13.5 ## 0.8.18 ### Patch Changes * Updated dependencies \[[`3c23fc2`](https://github.com/tkhq/sdk/commit/3c23fc27eda5325a90e79afff4cc3a16f682e1d9)]: * @turnkey/core\@1.8.2 ## 0.8.17 ### Patch Changes * Updated dependencies \[[`d4768c7`](https://github.com/tkhq/sdk/commit/d4768c71b6796532c9800d546154116e5d36b255)]: * @turnkey/core\@1.8.1 * @turnkey/sdk-browser\@5.13.4 ## 0.8.16 ### Patch Changes * Updated dependencies \[[`fd2e031`](https://github.com/tkhq/sdk/commit/fd2e0318079de922512b1f5adb404b11921f77b7), [`e1bd68f`](https://github.com/tkhq/sdk/commit/e1bd68f963d6bbd9c797b1a8f077efadccdec421)]: * @turnkey/core\@1.8.0 * @turnkey/sdk-browser\@5.13.3 * @turnkey/sdk-server\@4.12.1 ## 0.8.15 ### Patch Changes * Updated dependencies \[[`4d29af2`](https://github.com/tkhq/sdk/commit/4d29af2dd7c735916c650d697f18f66dd76c1b79)]: * @turnkey/sdk-browser\@5.13.2 ## 0.8.14 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-browser\@5.13.1 ## 0.8.13 ### Patch Changes * Updated dependencies \[[`beee465`](https://github.com/tkhq/sdk/commit/beee465a13f64abeb71c5c00519f7abab9942607), [`67b03a5`](https://github.com/tkhq/sdk/commit/67b03a5d9ab1b6eabfb0b41938ac91365b5dcd9b)]: * @turnkey/core\@1.7.0 * @turnkey/sdk-browser\@5.13.0 * @turnkey/sdk-server\@4.12.0 * @turnkey/http\@3.15.0 ## 0.8.12 ### Patch Changes * Updated dependencies \[[`71cdca3`](https://github.com/tkhq/sdk/commit/71cdca3b97ba520dc5327410a1e82cf9ad85fb0e), [`9fbd5c4`](https://github.com/tkhq/sdk/commit/9fbd5c459782dc3721dd0935d0a4458babce258b)]: * @turnkey/sdk-server\@4.11.0 * @turnkey/sdk-browser\@5.12.0 * @turnkey/core\@1.6.0 * @turnkey/http\@3.14.0 ## 0.8.11 ### Patch Changes * Updated dependencies \[]: * @turnkey/core\@1.5.2 * @turnkey/sdk-browser\@5.11.6 * @turnkey/sdk-server\@4.10.5 ## 0.8.10 ### Patch Changes * [#1036](https://github.com/tkhq/sdk/pull/1036) [`13de561`](https://github.com/tkhq/sdk/commit/13de561bfe7e8a8ce26e4a5308d05be450868535) Author [@andrewkmin](https://github.com/andrewkmin) - noop: readme update ## 0.8.9 ### Patch Changes * Updated dependencies \[[`886f319`](https://github.com/tkhq/sdk/commit/886f319fab8b0ba560d040e34598436f3beceff0)]: * @turnkey/core\@1.5.1 ## 0.8.8 ### Patch Changes * Updated dependencies \[[`5c4495b`](https://github.com/tkhq/sdk/commit/5c4495bff1b0abfe3c427ead1b8e1a8d510c8186), [`001d822`](https://github.com/tkhq/sdk/commit/001d8225202500e53aa399d6aee0c8f48f6060e0)]: * @turnkey/core\@1.5.0 * @turnkey/sdk-browser\@5.11.5 * @turnkey/sdk-server\@4.10.4 ## 0.8.7 ### Patch Changes * Updated dependencies \[[`9df42ad`](https://github.com/tkhq/sdk/commit/9df42adc02c7ff77afba3b938536e79b57882ef1)]: * @turnkey/sdk-browser\@5.11.4 * @turnkey/sdk-server\@4.10.3 * @turnkey/core\@1.4.2 * @turnkey/http\@3.13.1 ## 0.8.6 ### Patch Changes * Updated dependencies \[[`e5b9c5c`](https://github.com/tkhq/sdk/commit/e5b9c5c5694b1f4d60c0b8606822bcd6d61da4a3)]: * @turnkey/core\@1.4.1 ## 0.8.5 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-browser\@5.11.3 ## 0.8.4 ### Patch Changes * Updated dependencies \[[`6ceb06e`](https://github.com/tkhq/sdk/commit/6ceb06ebdbb11b017ed97e81a7e0dcb862813bfa), [`68631c4`](https://github.com/tkhq/sdk/commit/68631c4008387f845dfe4f1a139981011727f6c9)]: * @turnkey/core\@1.4.0 * @turnkey/sdk-browser\@5.11.2 * @turnkey/sdk-server\@4.10.2 ## 0.8.3 ### Patch Changes * Updated dependencies \[[`4adbf9b`](https://github.com/tkhq/sdk/commit/4adbf9bbb6b93f84aa80e06a1eeabd61d1dbbb86), [`4ead6da`](https://github.com/tkhq/sdk/commit/4ead6da626468fde41daf85eae90faf18651d1c1), [`3997c0f`](https://github.com/tkhq/sdk/commit/3997c0fd08a8a85108acf904c0bf39d69f8dc79c)]: * @turnkey/core\@1.3.0 * @turnkey/sdk-browser\@5.11.1 * @turnkey/sdk-server\@4.10.1 ## 0.8.2 ### Patch Changes * Updated dependencies \[[`4567059`](https://github.com/tkhq/sdk/commit/45670598f102223925b87a5295edca15a6ce8241), [`010543c`](https://github.com/tkhq/sdk/commit/010543c3b1b56a18816ea92a1a1cbe028cf988e4)]: * @turnkey/sdk-browser\@5.11.0 * @turnkey/sdk-server\@4.10.0 * @turnkey/core\@1.2.0 * @turnkey/http\@3.13.0 ## 0.8.1 ### Patch Changes * Updated dependencies \[[`0080c4d`](https://github.com/tkhq/sdk/commit/0080c4d011a7f8d04b41d89b31863b75d1a816ef), [`5a96fe8`](https://github.com/tkhq/sdk/commit/5a96fe80db4c4c45e09ad8c613695ee4c2b8e51f), [`c2a0bd7`](https://github.com/tkhq/sdk/commit/c2a0bd7ea8a53524cde16897f375f8a7088ba963), [`90841f9`](https://github.com/tkhq/sdk/commit/90841f95f3f738c47c04797096902d9d0a23afc7), [`e4bc82f`](https://github.com/tkhq/sdk/commit/e4bc82fc51c692d742923ccfff72c2c862ee71a4)]: * @turnkey/core\@1.1.0 * @turnkey/sdk-browser\@5.10.1 * @turnkey/sdk-server\@4.9.1 * @turnkey/http\@3.12.1 ## 0.8.0 ### Minor Changes * Updated dependencies \[[`fc1d6e2`](https://github.com/tkhq/sdk/commit/fc1d6e2d26f4a53116633e9e8cccccd792267f4e), [`fc1d6e2`](https://github.com/tkhq/sdk/commit/fc1d6e2d26f4a53116633e9e8cccccd792267f4e), [`4880f26`](https://github.com/tkhq/sdk/commit/4880f26a4dd324c049bff7f35284098ccfc55823), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`06347ad`](https://github.com/tkhq/sdk/commit/06347adfa08fb0867c350e43821d0fed06c49624)]: * @turnkey/sdk-server\@4.9.0 * @turnkey/core\@1.0.0 * @turnkey/http\@3.12.0 * @turnkey/api-key-stamper\@0.5.0 * @turnkey/sdk-browser\@5.10.0 ## 0.8.0-beta.1 ### Patch Changes * Updated dependencies \[]: * @turnkey/core\@1.0.0-beta.6 * @turnkey/sdk-browser\@5.9.0-beta.1 * @turnkey/api-key-stamper\@0.5.0-beta.6 * @turnkey/http\@3.11.1-beta.0 * @turnkey/sdk-server\@4.8.1-beta.0 ## 0.8.0-beta.0 ### Minor Changes * SDK beta release @turnkey/react-wallet-kit @turnkey/core ### Patch Changes * Updated dependencies \[]: * @turnkey/api-key-stamper\@0.5.0-beta.5 * @turnkey/sdk-browser\@5.9.0-beta.0 * @turnkey/sdk-server\@4.7.0-beta.2 * @turnkey/core\@1.0.0-beta.5 * @turnkey/http\@3.10.0-beta.2 ## 0.7.27 ### Patch Changes * Updated dependencies \[[`026264c`](https://github.com/tkhq/sdk/commit/026264c55aa16342c8925af0bdcdf72dc00e5158)]: * @turnkey/sdk-browser\@5.9.0 * @turnkey/sdk-server\@4.8.0 * @turnkey/http\@3.11.0 ## 0.7.26 ### Patch Changes * Updated dependencies \[[`5d8be2d`](https://github.com/tkhq/sdk/commit/5d8be2d0329070c7aa025dddb1b28f04257ae4e6)]: * @turnkey/sdk-browser\@5.8.0 * @turnkey/sdk-server\@4.7.0 * @turnkey/http\@3.10.0 ## 0.7.25-beta.4 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-server\@4.7.0-beta.1 * @turnkey/http\@3.10.0-beta.1 * @turnkey/sdk-browser\@5.7.1-beta.1 * @turnkey/api-key-stamper\@0.4.8-beta.4 ## 0.7.25-beta.3 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-server\@4.7.0-beta.0 * @turnkey/http\@3.10.0-beta.0 * @turnkey/sdk-browser\@5.7.1-beta.0 * @turnkey/api-key-stamper\@0.4.8-beta.3 ## 0.7.25-beta.2 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-browser\@5.6.1-beta.2 * @turnkey/api-key-stamper\@0.4.8-beta.2 * @turnkey/http\@3.8.1-beta.2 * @turnkey/sdk-server\@4.5.1-beta.2 ## 0.7.25-beta.1 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-browser\@5.6.1-beta.1 * @turnkey/api-key-stamper\@0.4.8-beta.1 * @turnkey/http\@3.8.1-beta.1 * @turnkey/sdk-server\@4.5.1-beta.1 ## 0.7.25-beta.0 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-browser\@5.6.1-beta.0 * @turnkey/api-key-stamper\@0.4.8-beta.0 * @turnkey/http\@3.8.1-beta.0 * @turnkey/sdk-server\@4.5.1-beta.0 ## 0.7.25 ### Patch Changes * Updated dependencies \[[`8b39dba`](https://github.com/tkhq/sdk/commit/8b39dbabf68d3e376b5b07f26960d5b61ae87fa9), [`1a549b7`](https://github.com/tkhq/sdk/commit/1a549b71f9a6e7ab59d52aaae7e58e34c8f2e8b5)]: * @turnkey/sdk-browser\@5.7.0 * @turnkey/sdk-server\@4.6.0 * @turnkey/http\@3.9.0 ## 0.7.24 ### Patch Changes * Updated dependencies \[[`f83f25b`](https://github.com/tkhq/sdk/commit/f83f25ba33ef15dbd66723531eebe2fd00f43ac0)]: * @turnkey/sdk-browser\@5.6.0 * @turnkey/sdk-server\@4.5.0 * @turnkey/http\@3.8.0 ## 0.7.23 ### Patch Changes * Updated dependencies \[[`81e355c`](https://github.com/tkhq/sdk/commit/81e355c9a8321feffcac056916b65139cf35eeed)]: * @turnkey/http\@3.7.0 * @turnkey/sdk-browser\@5.5.0 * @turnkey/sdk-server\@4.4.0 ## 0.7.22 ### Patch Changes * Updated dependencies \[[`0d1eb2c`](https://github.com/tkhq/sdk/commit/0d1eb2c464bac3cf6f4386f402604ecf8f373f15)]: * @turnkey/sdk-browser\@5.4.1 ## 0.7.21 ### Patch Changes * Updated dependencies \[[`e90a478`](https://github.com/tkhq/sdk/commit/e90a478c9208d858b1144df9b2c2c7ba956c406e)]: * @turnkey/sdk-browser\@5.4.0 * @turnkey/sdk-server\@4.3.0 * @turnkey/http\@3.6.0 ## 0.7.20 ### Patch Changes * Updated dependencies \[[`2db00b0`](https://github.com/tkhq/sdk/commit/2db00b0a799d09ae33fa08a117e3b2f433f2b0b4)]: * @turnkey/sdk-server\@4.2.4 ## 0.7.19 ### Patch Changes * Updated dependencies \[[`cb13c26`](https://github.com/tkhq/sdk/commit/cb13c26edb79a01ab651e3b2897334fd154b436a)]: * @turnkey/sdk-browser\@5.3.4 * @turnkey/sdk-server\@4.2.3 * @turnkey/http\@3.5.1 ## 0.7.18 ### Patch Changes * Updated dependencies \[[`2c4f42c`](https://github.com/tkhq/sdk/commit/2c4f42c747ac8017cf17e86b0ca0c3fa6f593bbf)]: * @turnkey/sdk-browser\@5.3.3 ## 0.7.17 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-browser\@5.3.2 * @turnkey/sdk-server\@4.2.2 ## 0.7.16 ### Patch Changes * Updated dependencies \[[`fa46701`](https://github.com/tkhq/sdk/commit/fa467019eef34b5199372248edff1e7a64934e79)]: * @turnkey/sdk-browser\@5.3.1 * @turnkey/sdk-server\@4.2.1 ## 0.7.15 ### Patch Changes * Updated dependencies \[[`5f3dd98`](https://github.com/tkhq/sdk/commit/5f3dd9814650308b3bf3198168c453e7b1a98efd), [`5f3dd98`](https://github.com/tkhq/sdk/commit/5f3dd9814650308b3bf3198168c453e7b1a98efd), [`7625df0`](https://github.com/tkhq/sdk/commit/7625df0538002c3455bd5862211210e38472e164)]: * @turnkey/http\@3.5.0 * @turnkey/sdk-browser\@5.3.0 * @turnkey/sdk-server\@4.2.0 * @turnkey/api-key-stamper\@0.4.7 ## 0.7.14 ### Patch Changes * Updated dependencies: * @turnkey/sdk-browser\@5.2.3 ## 0.7.13 ### Patch Changes * Updated dependencies: * @turnkey/sdk-browser\@5.2.2 ## 0.7.12 ### Patch Changes * [#665](https://github.com/tkhq/sdk/pull/665) [`be0a621`](https://github.com/tkhq/sdk/commit/be0a621fb962bd51d2df1a1e79f5260d7c696772) Author [@amircheikh](https://github.com/amircheikh) - Fix for `no runner registered` error when using mismatched versions of turnkey/http * Updated dependencies \[[`be0a621`](https://github.com/tkhq/sdk/commit/be0a621fb962bd51d2df1a1e79f5260d7c696772)]: * @turnkey/http\@3.4.2 * @turnkey/sdk-browser\@5.2.1 * @turnkey/sdk-server\@4.1.1 ## 0.7.11 ### Patch Changes * Updated dependencies \[[`5afbe51`](https://github.com/tkhq/sdk/commit/5afbe51949bdd1997fad083a4c1e4272ff7409dc), [`a38a6e3`](https://github.com/tkhq/sdk/commit/a38a6e36dc2bf9abdea64bc817d1cad95b8a289a), [`40c4035`](https://github.com/tkhq/sdk/commit/40c40359ec7096d0bca39ffc93e89361b3b11a1a), [`593de2d`](https://github.com/tkhq/sdk/commit/593de2d9404ec8cf53426f9cf832c13eefa3fbf2)]: * @turnkey/sdk-browser\@5.2.0 * @turnkey/sdk-server\@4.1.0 * @turnkey/http\@3.4.1 * @turnkey/api-key-stamper\@0.4.6 ## 0.7.10 ### Patch Changes * Updated dependencies \[[`27fe590`](https://github.com/tkhq/sdk/commit/27fe590cdc3eb6a8cde093eeefda2ee1cdc79412)]: * @turnkey/sdk-browser\@5.1.0 * @turnkey/sdk-server\@4.0.1 ## 0.7.9 ### Patch Changes * Updated dependencies \[[`07dfd33`](https://github.com/tkhq/sdk/commit/07dfd3397472687092e1c73b1d68714f421b9ca0), [`e8a5f1b`](https://github.com/tkhq/sdk/commit/e8a5f1b431623c4ff1cb85c6039464b328cf0e6a)]: * @turnkey/sdk-browser\@5.0.0 * @turnkey/sdk-server\@4.0.0 * @turnkey/http\@3.4.0 ## 0.7.8 ### Patch Changes * Updated dependencies \[25ca339] * @turnkey/sdk-browser\@4.3.0 * @turnkey/sdk-server\@3.3.0 * @turnkey/http\@3.3.0 ## 0.7.7 ### Patch Changes * Updated dependencies \[3f6e415] * Updated dependencies \[4d1d775] * @turnkey/sdk-browser\@4.2.0 * @turnkey/sdk-server\@3.2.0 * @turnkey/http\@3.2.0 * @turnkey/api-key-stamper\@0.4.5 ## 0.7.6 ### Patch Changes * Updated dependencies \[3e4a482] * @turnkey/sdk-browser\@4.1.0 * @turnkey/sdk-server\@3.1.0 * @turnkey/http\@3.1.0 ## 0.7.5 ### Patch Changes * Updated dependencies \[7b72769] * @turnkey/sdk-server\@3.0.1 ## 0.7.4 ### Patch Changes * Updated dependencies \[e501690] * Updated dependencies \[d1083bd] * Updated dependencies \[f94d36e] * @turnkey/sdk-browser\@4.0.0 * @turnkey/sdk-server\@3.0.0 * @turnkey/http\@3.0.0 ## 0.7.3 ### Patch Changes * Updated dependencies \[bf87774] * @turnkey/sdk-browser\@3.1.0 ## 0.7.2 ### Patch Changes * Updated dependencies \[5ec5187] * @turnkey/sdk-browser\@3.0.1 * @turnkey/sdk-server\@2.6.1 ## 0.7.1 ### Patch Changes * Updated dependencies \[0e4e959] * Updated dependencies \[856f449] * Updated dependencies \[c9ae537] * Updated dependencies \[d4ce5fa] * Updated dependencies \[ecdb29a] * Updated dependencies \[72890f5] * @turnkey/sdk-browser\@3.0.0 * @turnkey/sdk-server\@2.6.0 * @turnkey/http\@2.22.0 ## 0.7.0 ### Minor Changes * a7b5ce3: Update @cosmos/\* dependencies from v0.31.0 to v0.33.0 and cosmjs-types from v0.8.0 to v0.9.0 ### Patch Changes * Updated dependencies \[93540e7] * Updated dependencies \[fdb8bf0] * Updated dependencies \[9147962] * @turnkey/sdk-browser\@2.0.0 * @turnkey/sdk-server\@2.5.0 ## 0.6.14 ### Patch Changes * Updated dependencies \[233ae71] * Updated dependencies \[9317588] * @turnkey/sdk-browser\@1.16.0 * @turnkey/sdk-server\@2.4.0 ## 0.6.13 ### Patch Changes * Updated dependencies \[56a307e] * @turnkey/sdk-browser\@1.15.0 * @turnkey/sdk-server\@2.3.0 * @turnkey/http\@2.21.0 ## 0.6.12 ### Patch Changes * Updated dependencies \[3c44c4a] * Updated dependencies \[bfc833f] * @turnkey/sdk-browser\@1.14.0 * @turnkey/sdk-server\@2.2.0 * @turnkey/http\@2.20.0 ## 0.6.11 ### Patch Changes * Updated dependencies \[69d2571] * Updated dependencies \[57f9cb0] * @turnkey/sdk-browser\@1.13.0 * @turnkey/sdk-server\@2.1.0 * @turnkey/http\@2.19.0 ## 0.6.10 ### Patch Changes * Updated dependencies \[755833b] * @turnkey/sdk-browser\@1.12.1 * @turnkey/sdk-server\@2.0.1 ## 0.6.9 ### Patch Changes * Updated dependencies \[6695af2] * Updated dependencies \[1ebd4e2] * @turnkey/sdk-browser\@1.12.0 * @turnkey/sdk-server\@2.0.0 * @turnkey/http\@2.18.0 ## 0.6.8 ### Patch Changes * Updated dependencies \[053fbfb] * @turnkey/sdk-browser\@1.11.2 * @turnkey/sdk-server\@1.7.3 * @turnkey/http\@2.17.3 ## 0.6.7 ### Patch Changes * Updated dependencies \[328d6aa] * Updated dependencies \[b90947e] * Updated dependencies \[2d5977b] * Updated dependencies \[fad7c37] * @turnkey/sdk-browser\@1.11.1 * @turnkey/sdk-server\@1.7.2 * @turnkey/api-key-stamper\@0.4.4 * @turnkey/http\@2.17.2 ## 0.6.6 ### Patch Changes * Updated dependencies \[7988bc1] * Updated dependencies \[538d4fc] * Updated dependencies \[12d5aaa] * @turnkey/sdk-browser\@1.11.0 * @turnkey/sdk-server\@1.7.1 * @turnkey/http\@2.17.1 ## 0.6.5 ### Patch Changes * @turnkey/sdk-browser\@1.10.2 ## 0.6.4 ### Patch Changes * Updated dependencies \[78bc39c] * @turnkey/sdk-server\@1.7.0 * @turnkey/http\@2.17.0 * @turnkey/sdk-browser\@1.10.1 ## 0.6.3 ### Patch Changes * Updated dependencies \[8bea78f] * @turnkey/sdk-browser\@1.10.0 ## 0.6.2 ### Patch Changes * Updated dependencies \[3dd74ac] * Updated dependencies \[1e36edf] * Updated dependencies \[4df8914] * Updated dependencies \[11a9e2f] * @turnkey/sdk-browser\@1.9.0 * @turnkey/sdk-server\@1.6.0 * @turnkey/http\@2.16.0 ## 0.6.1 ### Patch Changes * Updated dependencies \[9ebd062] * @turnkey/sdk-browser\@1.8.0 * @turnkey/sdk-server\@1.5.0 * @turnkey/http\@2.15.0 ## 0.6.0 ### Minor Changes * 5e60923: Add compatibility with wallet accounts and @turnkey/sdk-browser and @turnkey/sdk-server ### Patch Changes * Updated dependencies \[abe7138] * Updated dependencies \[96d7f99] * @turnkey/sdk-server\@1.4.2 * @turnkey/sdk-browser\@1.7.1 * @turnkey/http\@2.14.2 * @turnkey/api-key-stamper\@0.4.3 ## 0.5.21 ### Patch Changes * Updated dependencies \[ff059d5] * @turnkey/http\@2.14.1 ## 0.5.20 ### Patch Changes * Updated dependencies \[848f8d3] * @turnkey/http\@2.14.0 ## 0.5.19 ### Patch Changes * Updated dependencies \[93dee46] * @turnkey/http\@2.13.0 ## 0.5.18 ### Patch Changes * Updated dependencies \[e2f2e0b] * @turnkey/http\@2.12.3 ## 0.5.17 ### Patch Changes * Updated dependencies * @turnkey/http\@2.12.2 ## 0.5.16 ### Patch Changes * Updated dependencies \[f17a229] * @turnkey/http\@2.12.1 ## 0.5.15 ### Patch Changes * Updated dependencies * @turnkey/http\@2.12.0 ## 0.5.14 ### Patch Changes * Updated dependencies * @turnkey/http\@2.11.0 ## 0.5.13 ### Patch Changes * Updated dependencies \[7a9ce7a] * @turnkey/http\@2.10.0 ## 0.5.12 ### Patch Changes * Updated dependencies * @turnkey/http\@2.9.1 ## 0.5.11 ### Patch Changes * Updated dependencies \[83b62b5] * @turnkey/http\@2.9.0 ## 0.5.10 ### Patch Changes * Updated dependencies \[46a7d90] * @turnkey/http\@2.8.0 ## 0.5.9 ### Patch Changes * Updated dependencies * @turnkey/http\@2.7.1 ## 0.5.8 ### Patch Changes * Updated dependencies \[d73725b] * @turnkey/http\@2.7.0 ## 0.5.7 ### Patch Changes * Updated dependencies \[f9d636c] * @turnkey/http\@2.6.2 ## 0.5.6 ### Patch Changes * Updated dependencies \[52e2389] * @turnkey/http\@2.6.1 ## 0.5.5 ### Patch Changes * Updated dependencies \[7a3c890] * @turnkey/http\@2.6.0 ## 0.5.4 ### Patch Changes * Upgrade to Node v18 (#184) * Updated dependencies * @turnkey/http\@2.5.1 ## 0.5.3 ### Patch Changes * Updated dependencies \[464ac0e] * @turnkey/http\@2.5.0 ## 0.5.2 ### Patch Changes * @turnkey/http\@2.4.2 ## 0.5.1 ### Patch Changes * Updated dependencies \[f87ced8] * @turnkey/http\@2.4.1 ## 0.5.0 ### Minor Changes * Use rollup to build ESM and CommonJS, fix ESM support (#174) ### Patch Changes * Updated dependencies \[fc5b291] * @turnkey/http\@2.4.0 ## 0.4.14 ### Patch Changes * @turnkey/http\@2.3.1 ## 0.4.13 ### Patch Changes * Updated dependencies \[f1bd68a] * @turnkey/http\@2.3.0 ## 0.4.12 ### Patch Changes * Updated dependencies \[ed50a0f] * Updated dependencies * @turnkey/http\@2.2.0 ## 0.4.11 ### Patch Changes * Updated dependencies \[bb6ea0b] * @turnkey/http\@2.1.0 ## 0.4.10 ### Patch Changes * Updated dependencies * @turnkey/http\@2.0.0 * Updated the shape of signing ## 0.4.9 ### Patch Changes * Updated dependencies * @turnkey/http\@1.3.0 ## 0.4.8 ### Patch Changes * Updated dependencies * @turnkey/http\@1.2.0 ## 0.4.7 ### Patch Changes * @turnkey/http\@1.1.1 ## 0.4.6 ### Patch Changes * Updated dependencies * @turnkey/http\@1.1.0 ## 0.4.5 ### Patch Changes * Updated dependencies \[8d1d0e8] * @turnkey/http\@1.0.1 ## 0.4.4 ### Patch Changes * 46473ec: This breaking change updates generated code to be shorter and more intuitive to read: * generated fetchers do not include the HTTP method in their name. For example `useGetGetActivity` is now `useGetActivity`, and `usePostSignTransaction` is `useSignTransaction`. * input types follow the same convention (no HTTP method in the name): `TPostCreatePrivateKeysInput` is now `TCreatePrivateKeysInput`. * the "federated" request helpers introduced in `0.18.0` are now named "signed" requests to better reflect what they are. `FederatedRequest` is now `SignedRequest`, and generated types follow. For example: `federatedPostCreatePrivateKeys` is now `signCreatePrivateKeys`, `federatedGetGetActivity` is now `signGetActivity`, and so on. The name updates should be automatically suggested if you use VSCode since the new names are simply shorter versions of the old one. * Updated dependencies \[46473ec] * Updated dependencies \[38b424f] * @turnkey/http\@1.0.0 ## 0.4.3 ### Patch Changes * Updated dependencies * @turnkey/http\@0.18.1 ## 0.4.2 ### Patch Changes * Updated dependencies * @turnkey/http\@0.18.0 ## 0.4.1 ### Patch Changes * Updated dependencies * @turnkey/http\@0.17.1 ## 0.4.0 ### Minor Changes * No public facing changes ### Patch Changes * Updated dependencies \[9317f51] * @turnkey/http\@0.17.0 ## 0.3.0 ### Minor Changes * No public facing changes ### Patch Changes * Updated dependencies * @turnkey/http\@0.16.0 * Fix `.postGetPrivateKey(...)`'s underlying path, while adding `@deprecated` `.postGetPrivateKeyBackwardsCompat(...)` for backward compatibility ## 0.2.1 ### Patch Changes * Updated dependencies * @turnkey/http\@0.15.0 ## 0.2.0 ### Minor Changes * Moved `sha256` hashing from local to remote ### Patch Changes * Updated dependencies * @turnkey/http\@0.14.0 ## 0.1.1 ### Patch Changes * New `TurnkeyRequestError` error class that contains rich error details * Updated dependencies * @turnkey/http\@0.13.2 ## 0.1.0 * Initial release # Crypto Source: https://docs.turnkey.com/changelogs/crypto/readme # @turnkey/crypto ## 2.8.12 ### Patch Changes * Updated dependencies \[[`dfdd864`](https://github.com/tkhq/sdk/commit/dfdd8647266fdd0297aaea32046ee815ae8fc27c)]: * @turnkey/sdk-types\@0.12.1 ## 2.8.11 ### Patch Changes * Updated dependencies \[[`1f6e240`](https://github.com/tkhq/sdk/commit/1f6e2403fca1fd9cbca646f88c88dbc49ddb0c34), [`58e04e5`](https://github.com/tkhq/sdk/commit/58e04e5856626d9d2593abb61d8ca32d8ccbb833), [`7458b7c`](https://github.com/tkhq/sdk/commit/7458b7cd6fc64796b376e3374b7c2ed79467459c)]: * @turnkey/sdk-types\@0.12.0 ## 2.8.10 ### Patch Changes * Updated dependencies \[[`8e075b7`](https://github.com/tkhq/sdk/commit/8e075b7161ccc68cb446b10b54737856fa0c6d31)]: * @turnkey/sdk-types\@0.11.2 ## 2.8.9 ### Patch Changes * [#1165](https://github.com/tkhq/sdk/pull/1165) [`d0dba04`](https://github.com/tkhq/sdk/commit/d0dba0412fa7b0c7c9b135e73cc0ef6f55187314) Author [@moeodeh3](https://github.com/moeodeh3) - Remove `@turnkey/http` and `@turnkey/api-key-stamper` from devDependencies * Updated dependencies \[[`91d6a9e`](https://github.com/tkhq/sdk/commit/91d6a9eb1b9ac9e21745749615ac7a7be66f5cf6)]: * @turnkey/sdk-types\@0.11.1 ## 2.8.8 ### Patch Changes * Updated dependencies \[[`78ec1d9`](https://github.com/tkhq/sdk/commit/78ec1d9afcafde3ca7107fc720323d486d6afaea)]: * @turnkey/sdk-types\@0.11.0 ## 2.8.7 ### Patch Changes * Updated dependencies \[[`29a42db`](https://github.com/tkhq/sdk/commit/29a42db8f5f3ef8b9c23c90cd00f4c21027aac2e)]: * @turnkey/sdk-types\@0.10.0 ## 2.8.6 ### Patch Changes * Updated dependencies \[[`80ea306`](https://github.com/tkhq/sdk/commit/80ea306025a2161ff575a5e2b45794460eafdf1b)]: * @turnkey/sdk-types\@0.9.0 ## 2.8.5 ### Patch Changes * [#1068](https://github.com/tkhq/sdk/pull/1068) [`5f829c6`](https://github.com/tkhq/sdk/commit/5f829c67af03bb85c3806acd202b2debf8274e78) Author [@moeodeh3](https://github.com/moeodeh3) - - Updated dependencies \[[`9fbd5c4`](https://github.com/tkhq/sdk/commit/9fbd5c459782dc3721dd0935d0a4458babce258b): * @turnkey/sdk-types\@0.7.0 * Updated dependencies \[[`084acce`](https://github.com/tkhq/sdk/commit/084acce85fe7c15513a025e77c1571012ac82e4b), [`67b03a5`](https://github.com/tkhq/sdk/commit/67b03a5d9ab1b6eabfb0b41938ac91365b5dcd9b)]: * @turnkey/sdk-types\@0.8.0 ## 2.8.4 ### Patch Changes * [#1050](https://github.com/tkhq/sdk/pull/1050) [`c745646`](https://github.com/tkhq/sdk/commit/c745646ae4b2a275e116abca07c6e108f89beb04) Author [@amircheikh](https://github.com/amircheikh) - - Removed `@peculiar/webcrypto` dependancy. This will fix build errors in environments where `webcrypto` is not defined but will still require a polyfill if you use a function where `webcrypto` is required. ## 2.8.3 ### Patch Changes * [#992](https://github.com/tkhq/sdk/pull/992) [`5c4495b`](https://github.com/tkhq/sdk/commit/5c4495bff1b0abfe3c427ead1b8e1a8d510c8186) Author [@amircheikh](https://github.com/amircheikh) - - `verify` function is now exposed and supports web platforms * Updated dependencies \[[`5c4495b`](https://github.com/tkhq/sdk/commit/5c4495bff1b0abfe3c427ead1b8e1a8d510c8186)]: * @turnkey/sdk-types\@0.6.3 ## 2.8.2 ### Patch Changes * Updated dependencies \[[`9df42ad`](https://github.com/tkhq/sdk/commit/9df42adc02c7ff77afba3b938536e79b57882ef1)]: * @turnkey/sdk-types\@0.6.2 ## 2.8.1 ### Patch Changes * Updated dependencies \[[`68631c4`](https://github.com/tkhq/sdk/commit/68631c4008387f845dfe4f1a139981011727f6c9)]: * @turnkey/sdk-types\@0.6.1 ## 2.8.0 ### Minor Changes * [#974](https://github.com/tkhq/sdk/pull/974) [`3997c0f`](https://github.com/tkhq/sdk/commit/3997c0fd08a8a85108acf904c0bf39d69f8dc79c) Author [@narimonf](https://github.com/narimonf) - Added verification tooling for app proofs and boot proofs. Primarily adds `verify()`, which verifies an app proof boot proof pair. ### Patch Changes * Updated dependencies \[[`3997c0f`](https://github.com/tkhq/sdk/commit/3997c0fd08a8a85108acf904c0bf39d69f8dc79c)]: * @turnkey/sdk-types\@0.6.0 ## 2.7.0 ### Minor Changes * [#947](https://github.com/tkhq/sdk/pull/947) [`2191a1b`](https://github.com/tkhq/sdk/commit/2191a1b201fb17dea4c79cf9e02b3a493b18f97a) Author [@amircheikh](https://github.com/amircheikh) - - Added `encryptOnRampSecret` helper function. This is used for encrypting your fiat on ramp secrets before passing into the `CreateFiatOnRampCredential` activity ## 2.6.0 ### Minor Changes * Updated dependencies \[[`fc1d6e2`](https://github.com/tkhq/sdk/commit/fc1d6e2d26f4a53116633e9e8cccccd792267f4e), [`fc1d6e2`](https://github.com/tkhq/sdk/commit/fc1d6e2d26f4a53116633e9e8cccccd792267f4e), [`4880f26`](https://github.com/tkhq/sdk/commit/4880f26a4dd324c049bff7f35284098ccfc55823), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`06347ad`](https://github.com/tkhq/sdk/commit/06347adfa08fb0867c350e43821d0fed06c49624), [`6bfcbc5`](https://github.com/tkhq/sdk/commit/6bfcbc5c098e64ab1d115518733b87cfc1653e17)]: * @turnkey/encoding\@0.6.0 ## 2.6.0-beta.6 ### Minor Changes * @turnkey/react-wallet-kit and @turnkey/core beta release ### Patch Changes * Updated dependencies \[]: * @turnkey/encoding\@0.6.0-beta.6 ## 2.6.0-beta.5 ### Minor Changes * SDK beta release @turnkey/react-wallet-kit @turnkey/core ### Patch Changes * Updated dependencies \[]: * @turnkey/encoding\@0.6.0-beta.5 ## 2.6.0 ### Minor Changes * [#840](https://github.com/tkhq/sdk/pull/840) [`d7420e6`](https://github.com/tkhq/sdk/commit/d7420e6c3559efc1024b58749b31d253150cb189) Author [@zkharit](https://github.com/zkharit) - This change adds a new encryption mechanism to allow for messages to be encrypted to an enclaves quorum public key. A helper function specifically for OAith 2.0 client secret encryption is also included ## 2.5.1-beta.4 ### Patch Changes * Updated dependencies \[]: * @turnkey/encoding\@0.6.0-beta.4 ## 2.5.1-beta.3 ### Patch Changes * Updated dependencies \[]: * @turnkey/encoding\@0.6.0-beta.3 ## 2.5.1-beta.2 ### Patch Changes * Updated dependencies \[]: * @turnkey/encoding\@0.6.0-beta.2 ## 2.5.1-beta.1 ### Patch Changes * Updated dependencies \[]: * @turnkey/encoding\@0.6.0-beta.1 ## 2.5.1-beta.0 ### Patch Changes * Updated dependencies \[]: * @turnkey/encoding\@0.6.0-beta.0 ## 2.5.0 ### Minor Changes * [#812](https://github.com/tkhq/sdk/pull/812) [`6cde41c`](https://github.com/tkhq/sdk/commit/6cde41cfecdfb7d54abf52cc65e28ef0e2ad6ba3) Author [@turnekybc](https://github.com/turnekybc) - Add `@turnkey/encoding` as a package dependency instead of a devDependency to `@turnkey/crypto`. This resolves an issue with transitive dependencies when devDependencies are not included in the artifact. ## 2.4.3 ### Patch Changes * [#720](https://github.com/tkhq/sdk/pull/720) [`6cbff7a`](https://github.com/tkhq/sdk/commit/6cbff7a0c0b3a9a05586399e5cef476154d3bdca) Author [@moeodeh3](https://github.com/moeodeh3) - Fixed `decryptExportBundle` not working in some environments by adding a shim to handle `bs58`'s ESM-only export. ## 2.4.2 ### Patch Changes * [#699](https://github.com/tkhq/sdk/pull/699) [`c5cdf82`](https://github.com/tkhq/sdk/commit/c5cdf8229da5da1bd6d52db06b2fe42826e96d57) Author [@andrewkmin](https://github.com/andrewkmin) - Add validations to `fromDerSignature` for parsing DER signatures in the Turnkey context * [#716](https://github.com/tkhq/sdk/pull/716) [`fa46701`](https://github.com/tkhq/sdk/commit/fa467019eef34b5199372248edff1e7a64934e79) Author [@moeodeh3](https://github.com/moeodeh3) - Fixed `decryptCredentialBundle` not working in React Native by adding a shim to handle `bs58check`'s ESM-only export. ## 2.4.1 ### Patch Changes * [#700](https://github.com/tkhq/sdk/pull/700) [`878e039`](https://github.com/tkhq/sdk/commit/878e03973856cfec83e6e3fda5b76d1b64943628) Author [@andrewkmin](https://github.com/andrewkmin) - Add validations to uncompressRawPublicKey method ## 2.4.0 ### Minor Changes * [#662](https://github.com/tkhq/sdk/pull/662) [`10ee5c5`](https://github.com/tkhq/sdk/commit/10ee5c524b477ce998e4fc635152cd101ae5a9cc) Thanks [@moe-dev](https://github.com/moe-dev)! - Add function `verifySessionJwtSignature` to verify session tokens return from Turnkey and signed by the notarizer ## 2.3.1 ### Patch Changes * 2bc0046: Migrated from WebCrypto (crypto.subtle.verify) to Noble for ECDSA signature verification ## 2.3.0 ### Minor Changes * 668edfa: Add keyformat to decryptExportBundle for displaying Solana private keys ## 2.2.0 ### Minor Changes * Added `toDerSignature` function used to convert a raw ECDSA signature into DER-encoded format for compatibility with our backend, which requires DER signatures ## 2.1.0 ### Minor Changes * [https://github.com/tkhq/sdk/pull/384](https://github.com/tkhq/sdk/pull/384): Reorganize into two subparts: * `crypto.ts`: core cryptography utilities * `turnkey.ts`: Turnkey-specific cryptography utilities Add `verifyStampSignature` method: * See in-line code docs for more details + example of usage * This is useful for checking the validity of a stamp (signature) against the request body ### Patch Changes * d989d46: Remove unnecessary react/typsecript packages ## 2.0.0 ### Major Changes * \[BREAKING CHANGE] renamed `decryptBundle` to `decryptCredentialBundle` (for decrypting email auth/recovery and oauth credential bundles) in order to distinguish from the new `decryptExportBundle` (for decrypting bundles containing wallet mnemonics or private key material) ### Patch Changes * Updated dependencies \[e5c4fe9] * @turnkey/encoding\@0.4.0 ## 1.0.0 ### Major Changes * 93666ff: turnkey/crypto standard HPKE encryption, first major release. Allows for programmatic importing in environments like node. Moved some encoding helper functions to turnkey/encoding ### Patch Changes * Updated dependencies \[93666ff] * @turnkey/encoding\@0.3.0 ## 0.2.1 ### Patch Changes * Updated dependencies * @turnkey/encoding\@0.2.1 ## 0.2.0 ### Minor Changes * Add HPKE encryption ## 0.1.1 ### Patch Changes * d968e0b: Bugfix: return public key ## 0.1.0 Initial release # Dart Source: https://docs.turnkey.com/changelogs/dart/readme # Changelog All notable changes to this project will be documented in this file. See [Conventional Commits](https://conventionalcommits.org) for commit guidelines. ## 2025-03-11 ### Changes *** Packages with breaking changes: * There are no breaking changes in this release. Packages with other changes: * [`turnkey_sdk_flutter` - `v0.1.0`](#turnkey_sdk_flutter---v010) *** #### `turnkey_sdk_flutter` - `v0.1.0` * Initial release. Client side abstracted functions for Turnkey-powered Flutter apps ## 2025-02-18 ### Changes *** Packages with breaking changes: * There are no breaking changes in this release. Packages with other changes: * [`turnkey_sessions` - `v0.1.2`](#turnkey_sessions---v012) *** #### `turnkey_sessions` - `v0.1.2` * **DOCS**: Added auto login / logout example to README. ## 2025-02-18 ### Changes *** Packages with breaking changes: * There are no breaking changes in this release. Packages with other changes: * [`turnkey_sessions` - `v0.1.1`](#turnkey_sessions---v011) *** #### `turnkey_sessions` - `v0.1.1` * **FEAT**: Listeners notified when session expires (turnkey\_sessions). ## 2025-02-11 ### Changes *** Packages with breaking changes: * There are no breaking changes in this release. Packages with other changes: * [`turnkey_sessions` - `v0.1.0`](#turnkey_sessions---v010) *** #### `turnkey_sessions` - `v0.1.0` ## 2025-02-11 ### Changes *** Packages with breaking changes: * There are no breaking changes in this release. Packages with other changes: * [`turnkey_crypto` - `v0.1.1`](#turnkey_crypto---v011) *** #### `turnkey_crypto` - `v0.1.1` * Exposed generateP256KeyPair function # Eip 1193 Provider Source: https://docs.turnkey.com/changelogs/eip-1193-provider/readme # @turnkey/eip-1193-provider ## 3.4.26 ### Patch Changes * Updated dependencies \[[`82dc76c`](https://github.com/tkhq/sdk/commit/82dc76c7ce51e5375570bbffab32eb739af90381), [`1d108d6`](https://github.com/tkhq/sdk/commit/1d108d6496ad8266db0e997a27aecc81e46008fb), [`dfdd864`](https://github.com/tkhq/sdk/commit/dfdd8647266fdd0297aaea32046ee815ae8fc27c)]: * @turnkey/core\@1.13.0 * @turnkey/sdk-browser\@5.15.2 * @turnkey/api-key-stamper\@0.6.3 * @turnkey/http\@3.17.1 ## 3.4.25 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-browser\@5.15.1 ## 3.4.24 ### Patch Changes * Updated dependencies \[[`af6262f`](https://github.com/tkhq/sdk/commit/af6262f31e1abb3090fcda1eec5318056e6d51fe), [`1f6e240`](https://github.com/tkhq/sdk/commit/1f6e2403fca1fd9cbca646f88c88dbc49ddb0c34), [`58e04e5`](https://github.com/tkhq/sdk/commit/58e04e5856626d9d2593abb61d8ca32d8ccbb833), [`7458b7c`](https://github.com/tkhq/sdk/commit/7458b7cd6fc64796b376e3374b7c2ed79467459c)]: * @turnkey/core\@1.12.0 * @turnkey/sdk-browser\@5.15.0 * @turnkey/http\@3.17.0 * @turnkey/api-key-stamper\@0.6.2 ## 3.4.23 ### Patch Changes * Updated dependencies \[[`d49ef7e`](https://github.com/tkhq/sdk/commit/d49ef7e9f0f78f16b1324a357f61cf0351198096), [`dced9db`](https://github.com/tkhq/sdk/commit/dced9dbbd8ea533442e19e45ce36e6a05a45a555), [`dced9db`](https://github.com/tkhq/sdk/commit/dced9dbbd8ea533442e19e45ce36e6a05a45a555)]: * @turnkey/core\@1.11.2 * @turnkey/sdk-browser\@5.14.3 * @turnkey/http\@3.16.3 ## 3.4.22 ### Patch Changes * Updated dependencies \[[`2d19991`](https://github.com/tkhq/sdk/commit/2d19991bcf4e1c9704b73a48c54e870373b4bd95), [`89d4084`](https://github.com/tkhq/sdk/commit/89d40844d791b0bbb6d439da5e778b1fdeca4273), [`ba2521d`](https://github.com/tkhq/sdk/commit/ba2521d5d1c1f6baaa58ee65dce8cc4839f7dc7b), [`12ca083`](https://github.com/tkhq/sdk/commit/12ca083314310b05cf41ac29fa2d55eed627f229), [`a85153c`](https://github.com/tkhq/sdk/commit/a85153c8ccc7454cd5aca974bc463fb47c7f8cd4)]: * @turnkey/core\@1.11.1 * @turnkey/sdk-browser\@5.14.2 * @turnkey/api-key-stamper\@0.6.1 * @turnkey/http\@3.16.2 ## 3.4.21 ### Patch Changes * Updated dependencies \[[`91d6a9e`](https://github.com/tkhq/sdk/commit/91d6a9eb1b9ac9e21745749615ac7a7be66f5cf6), [`91d6a9e`](https://github.com/tkhq/sdk/commit/91d6a9eb1b9ac9e21745749615ac7a7be66f5cf6), [`699fbd7`](https://github.com/tkhq/sdk/commit/699fbd75ef3f44f768ae641ab4f652e966b8e289)]: * @turnkey/core\@1.11.0 * @turnkey/api-key-stamper\@0.6.0 * @turnkey/sdk-browser\@5.14.1 * @turnkey/http\@3.16.1 ## 3.4.20 ### Patch Changes * Updated dependencies \[[`6261eed`](https://github.com/tkhq/sdk/commit/6261eed95af8627bf1e95e7291b9760a2267e301), [`78ec1d9`](https://github.com/tkhq/sdk/commit/78ec1d9afcafde3ca7107fc720323d486d6afaea), [`cfd34ab`](https://github.com/tkhq/sdk/commit/cfd34ab14ff2abed0e22dca9a802c58a96b9e8e1), [`78ec1d9`](https://github.com/tkhq/sdk/commit/78ec1d9afcafde3ca7107fc720323d486d6afaea)]: * @turnkey/core\@1.10.0 * @turnkey/sdk-browser\@5.14.0 * @turnkey/http\@3.16.0 ## 3.4.19 ### Patch Changes * Updated dependencies \[[`29a42db`](https://github.com/tkhq/sdk/commit/29a42db8f5f3ef8b9c23c90cd00f4c21027aac2e)]: * @turnkey/core\@1.9.0 * @turnkey/sdk-browser\@5.13.6 ## 3.4.18 ### Patch Changes * Updated dependencies \[[`7185545`](https://github.com/tkhq/sdk/commit/7185545ea1fc05eb738af09de5a594455f2e08f3)]: * @turnkey/core\@1.8.3 * @turnkey/sdk-browser\@5.13.5 ## 3.4.17 ### Patch Changes * Updated dependencies \[[`3c23fc2`](https://github.com/tkhq/sdk/commit/3c23fc27eda5325a90e79afff4cc3a16f682e1d9)]: * @turnkey/core\@1.8.2 ## 3.4.16 ### Patch Changes * Updated dependencies \[[`d4768c7`](https://github.com/tkhq/sdk/commit/d4768c71b6796532c9800d546154116e5d36b255)]: * @turnkey/core\@1.8.1 * @turnkey/sdk-browser\@5.13.4 ## 3.4.15 ### Patch Changes * Updated dependencies \[[`fd2e031`](https://github.com/tkhq/sdk/commit/fd2e0318079de922512b1f5adb404b11921f77b7), [`e1bd68f`](https://github.com/tkhq/sdk/commit/e1bd68f963d6bbd9c797b1a8f077efadccdec421)]: * @turnkey/core\@1.8.0 * @turnkey/sdk-browser\@5.13.3 ## 3.4.14 ### Patch Changes * Updated dependencies \[[`4d29af2`](https://github.com/tkhq/sdk/commit/4d29af2dd7c735916c650d697f18f66dd76c1b79)]: * @turnkey/sdk-browser\@5.13.2 ## 3.4.13 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-browser\@5.13.1 ## 3.4.12 ### Patch Changes * Updated dependencies \[[`beee465`](https://github.com/tkhq/sdk/commit/beee465a13f64abeb71c5c00519f7abab9942607), [`67b03a5`](https://github.com/tkhq/sdk/commit/67b03a5d9ab1b6eabfb0b41938ac91365b5dcd9b)]: * @turnkey/core\@1.7.0 * @turnkey/sdk-browser\@5.13.0 * @turnkey/http\@3.15.0 ## 3.4.11 ### Patch Changes * Updated dependencies \[[`9fbd5c4`](https://github.com/tkhq/sdk/commit/9fbd5c459782dc3721dd0935d0a4458babce258b)]: * @turnkey/sdk-browser\@5.12.0 * @turnkey/core\@1.6.0 * @turnkey/http\@3.14.0 ## 3.4.10 ### Patch Changes * [#1044](https://github.com/tkhq/sdk/pull/1044) [`c0fa69c`](https://github.com/tkhq/sdk/commit/c0fa69cbf9de55d681c5bd67d8cbcb8cdcd4fd5b) Author [@andrewkmin](https://github.com/andrewkmin) - Only use relevant (Ethereum) wallet accounts, and better handle multiple chain IDs * Updated dependencies \[]: * @turnkey/core\@1.5.2 * @turnkey/sdk-browser\@5.11.6 ## 3.4.9 ### Patch Changes * Updated dependencies \[[`886f319`](https://github.com/tkhq/sdk/commit/886f319fab8b0ba560d040e34598436f3beceff0)]: * @turnkey/core\@1.5.1 ## 3.4.8 ### Patch Changes * Updated dependencies \[[`5c4495b`](https://github.com/tkhq/sdk/commit/5c4495bff1b0abfe3c427ead1b8e1a8d510c8186), [`001d822`](https://github.com/tkhq/sdk/commit/001d8225202500e53aa399d6aee0c8f48f6060e0)]: * @turnkey/core\@1.5.0 * @turnkey/sdk-browser\@5.11.5 ## 3.4.7 ### Patch Changes * Updated dependencies \[[`9df42ad`](https://github.com/tkhq/sdk/commit/9df42adc02c7ff77afba3b938536e79b57882ef1)]: * @turnkey/sdk-browser\@5.11.4 * @turnkey/core\@1.4.2 * @turnkey/http\@3.13.1 ## 3.4.6 ### Patch Changes * Updated dependencies \[[`e5b9c5c`](https://github.com/tkhq/sdk/commit/e5b9c5c5694b1f4d60c0b8606822bcd6d61da4a3)]: * @turnkey/core\@1.4.1 ## 3.4.5 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-browser\@5.11.3 ## 3.4.4 ### Patch Changes * Updated dependencies \[[`6ceb06e`](https://github.com/tkhq/sdk/commit/6ceb06ebdbb11b017ed97e81a7e0dcb862813bfa), [`68631c4`](https://github.com/tkhq/sdk/commit/68631c4008387f845dfe4f1a139981011727f6c9)]: * @turnkey/core\@1.4.0 * @turnkey/sdk-browser\@5.11.2 ## 3.4.3 ### Patch Changes * Updated dependencies \[[`4adbf9b`](https://github.com/tkhq/sdk/commit/4adbf9bbb6b93f84aa80e06a1eeabd61d1dbbb86), [`4ead6da`](https://github.com/tkhq/sdk/commit/4ead6da626468fde41daf85eae90faf18651d1c1), [`3997c0f`](https://github.com/tkhq/sdk/commit/3997c0fd08a8a85108acf904c0bf39d69f8dc79c)]: * @turnkey/core\@1.3.0 * @turnkey/sdk-browser\@5.11.1 ## 3.4.2 ### Patch Changes * Updated dependencies \[[`4567059`](https://github.com/tkhq/sdk/commit/45670598f102223925b87a5295edca15a6ce8241), [`010543c`](https://github.com/tkhq/sdk/commit/010543c3b1b56a18816ea92a1a1cbe028cf988e4)]: * @turnkey/sdk-browser\@5.11.0 * @turnkey/core\@1.2.0 * @turnkey/http\@3.13.0 ## 3.4.1 ### Patch Changes * Updated dependencies \[[`0080c4d`](https://github.com/tkhq/sdk/commit/0080c4d011a7f8d04b41d89b31863b75d1a816ef), [`5a96fe8`](https://github.com/tkhq/sdk/commit/5a96fe80db4c4c45e09ad8c613695ee4c2b8e51f), [`c2a0bd7`](https://github.com/tkhq/sdk/commit/c2a0bd7ea8a53524cde16897f375f8a7088ba963), [`90841f9`](https://github.com/tkhq/sdk/commit/90841f95f3f738c47c04797096902d9d0a23afc7), [`e4bc82f`](https://github.com/tkhq/sdk/commit/e4bc82fc51c692d742923ccfff72c2c862ee71a4)]: * @turnkey/core\@1.1.0 * @turnkey/sdk-browser\@5.10.1 * @turnkey/http\@3.12.1 ## 3.4.0 ### Minor Changes * Updated dependencies \[[`fc1d6e2`](https://github.com/tkhq/sdk/commit/fc1d6e2d26f4a53116633e9e8cccccd792267f4e), [`fc1d6e2`](https://github.com/tkhq/sdk/commit/fc1d6e2d26f4a53116633e9e8cccccd792267f4e), [`4880f26`](https://github.com/tkhq/sdk/commit/4880f26a4dd324c049bff7f35284098ccfc55823), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`06347ad`](https://github.com/tkhq/sdk/commit/06347adfa08fb0867c350e43821d0fed06c49624)]: * @turnkey/core\@1.0.0 * @turnkey/http\@3.12.0 * @turnkey/api-key-stamper\@0.5.0 * @turnkey/sdk-browser\@5.10.0 ## 3.4.0-beta.6 ### Patch Changes * Updated dependencies \[]: * @turnkey/core\@1.0.0-beta.6 * @turnkey/sdk-browser\@5.9.0-beta.1 * @turnkey/api-key-stamper\@0.5.0-beta.6 * @turnkey/http\@3.11.1-beta.0 ## 3.4.0-beta.5 ### Minor Changes * SDK beta release @turnkey/react-wallet-kit @turnkey/core ### Patch Changes * Updated dependencies \[]: * @turnkey/api-key-stamper\@0.5.0-beta.5 * @turnkey/sdk-browser\@5.9.0-beta.0 * @turnkey/core\@1.0.0-beta.5 * @turnkey/http\@3.10.0-beta.2 ## 3.4.0-beta.4 ### Minor Changes * @turnkey/react-wallet-kit and @turnkey/core beta-3 release ### Patch Changes * Updated dependencies \[]: * @turnkey/http\@3.10.0-beta.1 * @turnkey/sdk-browser\@5.7.1-beta.1 * @turnkey/api-key-stamper\@0.4.8-beta.4 ## 3.4.0-beta.3 ### Minor Changes * @turnkey/react-wallet-kit and @turnkey/core beta-3 release ### Patch Changes * Updated dependencies \[]: * @turnkey/http\@3.10.0-beta.0 * @turnkey/sdk-browser\@5.7.1-beta.0 * @turnkey/api-key-stamper\@0.4.8-beta.3 ## 3.3.26 ### Patch Changes * Updated dependencies \[[`026264c`](https://github.com/tkhq/sdk/commit/026264c55aa16342c8925af0bdcdf72dc00e5158)]: * @turnkey/sdk-browser\@5.9.0 * @turnkey/http\@3.11.0 ## 3.3.25 ### Patch Changes * Updated dependencies \[[`5d8be2d`](https://github.com/tkhq/sdk/commit/5d8be2d0329070c7aa025dddb1b28f04257ae4e6)]: * @turnkey/sdk-browser\@5.8.0 * @turnkey/http\@3.10.0 ## 3.3.24-beta.2 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-browser\@5.6.1-beta.2 * @turnkey/api-key-stamper\@0.4.8-beta.2 * @turnkey/http\@3.8.1-beta.2 ## 3.3.24-beta.1 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-browser\@5.6.1-beta.1 * @turnkey/api-key-stamper\@0.4.8-beta.1 * @turnkey/http\@3.8.1-beta.1 ## 3.3.24-beta.0 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-browser\@5.6.1-beta.0 * @turnkey/api-key-stamper\@0.4.8-beta.0 * @turnkey/http\@3.8.1-beta.0 ## 3.3.24 ### Patch Changes * Updated dependencies \[[`8b39dba`](https://github.com/tkhq/sdk/commit/8b39dbabf68d3e376b5b07f26960d5b61ae87fa9)]: * @turnkey/sdk-browser\@5.7.0 * @turnkey/http\@3.9.0 ## 3.3.23 ### Patch Changes * Updated dependencies \[[`f83f25b`](https://github.com/tkhq/sdk/commit/f83f25ba33ef15dbd66723531eebe2fd00f43ac0)]: * @turnkey/sdk-browser\@5.6.0 * @turnkey/http\@3.8.0 ## 3.3.22 ### Patch Changes * Updated dependencies \[[`81e355c`](https://github.com/tkhq/sdk/commit/81e355c9a8321feffcac056916b65139cf35eeed)]: * @turnkey/http\@3.7.0 * @turnkey/sdk-browser\@5.5.0 ## 3.3.21 ### Patch Changes * Updated dependencies \[[`0d1eb2c`](https://github.com/tkhq/sdk/commit/0d1eb2c464bac3cf6f4386f402604ecf8f373f15)]: * @turnkey/sdk-browser\@5.4.1 ## 3.3.20 ### Patch Changes * Updated dependencies \[[`e90a478`](https://github.com/tkhq/sdk/commit/e90a478c9208d858b1144df9b2c2c7ba956c406e)]: * @turnkey/sdk-browser\@5.4.0 * @turnkey/http\@3.6.0 ## 3.3.19 ### Patch Changes * Updated dependencies \[[`cb13c26`](https://github.com/tkhq/sdk/commit/cb13c26edb79a01ab651e3b2897334fd154b436a)]: * @turnkey/sdk-browser\@5.3.4 * @turnkey/http\@3.5.1 ## 3.3.18 ### Patch Changes * Updated dependencies \[[`2c4f42c`](https://github.com/tkhq/sdk/commit/2c4f42c747ac8017cf17e86b0ca0c3fa6f593bbf)]: * @turnkey/sdk-browser\@5.3.3 ## 3.3.17 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-browser\@5.3.2 ## 3.3.16 ### Patch Changes * Updated dependencies \[[`fa46701`](https://github.com/tkhq/sdk/commit/fa467019eef34b5199372248edff1e7a64934e79)]: * @turnkey/sdk-browser\@5.3.1 ## 3.3.15 ### Patch Changes * Updated dependencies \[[`5f3dd98`](https://github.com/tkhq/sdk/commit/5f3dd9814650308b3bf3198168c453e7b1a98efd), [`5f3dd98`](https://github.com/tkhq/sdk/commit/5f3dd9814650308b3bf3198168c453e7b1a98efd), [`7625df0`](https://github.com/tkhq/sdk/commit/7625df0538002c3455bd5862211210e38472e164)]: * @turnkey/http\@3.5.0 * @turnkey/sdk-browser\@5.3.0 * @turnkey/api-key-stamper\@0.4.7 ## 3.3.14 ### Patch Changes * Updated dependencies: * @turnkey/sdk-browser\@5.2.3 ## 3.3.13 ### Patch Changes * Updated dependencies: * @turnkey/sdk-browser\@5.2.2 ## 3.3.12 ### Patch Changes * [#665](https://github.com/tkhq/sdk/pull/665) [`be0a621`](https://github.com/tkhq/sdk/commit/be0a621fb962bd51d2df1a1e79f5260d7c696772) Author [@amircheikh](https://github.com/amircheikh) - Fix for `no runner registered` error when using mismatched versions of turnkey/http * Updated dependencies \[[`be0a621`](https://github.com/tkhq/sdk/commit/be0a621fb962bd51d2df1a1e79f5260d7c696772)]: * @turnkey/http\@3.4.2 * @turnkey/sdk-browser\@5.2.1 ## 3.3.11 ### Patch Changes * Updated dependencies \[[`5afbe51`](https://github.com/tkhq/sdk/commit/5afbe51949bdd1997fad083a4c1e4272ff7409dc), [`40c4035`](https://github.com/tkhq/sdk/commit/40c40359ec7096d0bca39ffc93e89361b3b11a1a), [`593de2d`](https://github.com/tkhq/sdk/commit/593de2d9404ec8cf53426f9cf832c13eefa3fbf2)]: * @turnkey/sdk-browser\@5.2.0 * @turnkey/http\@3.4.1 * @turnkey/api-key-stamper\@0.4.6 ## 3.3.10 ### Patch Changes * Updated dependencies \[[`27fe590`](https://github.com/tkhq/sdk/commit/27fe590cdc3eb6a8cde093eeefda2ee1cdc79412)]: * @turnkey/sdk-browser\@5.1.0 ## 3.3.9 ### Patch Changes * Updated dependencies \[[`07dfd33`](https://github.com/tkhq/sdk/commit/07dfd3397472687092e1c73b1d68714f421b9ca0)]: * @turnkey/sdk-browser\@5.0.0 * @turnkey/http\@3.4.0 ## 3.3.8 ### Patch Changes * Updated dependencies \[25ca339] * @turnkey/sdk-browser\@4.3.0 * @turnkey/http\@3.3.0 ## 3.3.7 ### Patch Changes * Updated dependencies \[3f6e415] * Updated dependencies \[4d1d775] * @turnkey/sdk-browser\@4.2.0 * @turnkey/http\@3.2.0 * @turnkey/api-key-stamper\@0.4.5 ## 3.3.6 ### Patch Changes * Updated dependencies \[3e4a482] * @turnkey/sdk-browser\@4.1.0 * @turnkey/http\@3.1.0 ## 3.3.5 ### Patch Changes * 7a89040: Fix type resolution ## 3.3.4 ### Patch Changes * Updated dependencies \[e501690] * Updated dependencies \[d1083bd] * Updated dependencies \[f94d36e] * @turnkey/sdk-browser\@4.0.0 * @turnkey/http\@3.0.0 ## 3.3.3 ### Patch Changes * Updated dependencies \[bf87774] * @turnkey/sdk-browser\@3.1.0 ## 3.3.2 ### Patch Changes * Updated dependencies \[5ec5187] * @turnkey/sdk-browser\@3.0.1 ## 3.3.1 ### Patch Changes * Updated dependencies \[0e4e959] * Updated dependencies \[856f449] * Updated dependencies \[d4ce5fa] * Updated dependencies \[ecdb29a] * Updated dependencies \[72890f5] * @turnkey/sdk-browser\@3.0.0 * @turnkey/http\@2.22.0 ## 3.3.0 ### Minor Changes * 93540e7: ## Major Package Updates ### @turnkey/sdk-browser * create abstract `TurnkeyBaseClient` class which extends `TurnkeySDKClientBase` * `TurnkeyBrowserClient`, `TurnkeyIframeClient`, `TurnkeyPasskeyClient`, and `TurnkeyWalletClient` all extend `TurnkeyBaseClient` * TurnkeyBrowserClient * Session Management * `refreshSession` - attempts to refresh an existing, active session and will extend the session expiry using the `expirationSeconds` parameter * loginWithBundle - authenticate a user via a credential bundle and creates a read-write session * loginWithPasskey - attempts to authenticate a user via passkey and create a read-only or read-write session * loginWithSession - takes a `Session`, which can be either read-only or read-write, created via a server action and attempts to authenticate the user * TurnkeyPasskeyClient * Session Management * createPasskeySession - leverages passkey authentication to create a read-write session. Once authenticated, the user will not be prompted for additional passkey taps. ### @turnkey/sdk-react * update `TurnkeyContext` to use new `.getSession()` method to check if there is an active session * `OTPVerification` component no longer receives `authIframeClient` or `onValidateSuccess` props ## Minor Package Updates ### @turnkey/sdk-server * expose `sendCredential` server action * add `SessionType` enum * `READ_ONLY` & `READ_WRITE` ### @turnkey/eip-1193-provider * update dependencies in `package.json` * moved from `peerDependencies` to `dependencies` * `"@turnkey/http": "workspace:*"` * `"@turnkey/sdk-browser": "workspace:*"` * moved from `devDependencies` to `dependencies` * `"@turnkey/api-key-stamper": "workspace:*"` * specify TypeScript version ^5.1.5 ### Patch Changes * Updated dependencies \[93540e7] * Updated dependencies \[9147962] * @turnkey/sdk-browser\@2.0.0 ## 3.1.5 ### Patch Changes * Updated dependencies \[233ae71] * @turnkey/sdk-browser\@1.16.0 ## 3.1.4 ### Patch Changes * Updated dependencies \[56a307e] * @turnkey/sdk-browser\@1.15.0 * @turnkey/http\@2.21.0 ## 3.1.3 ### Patch Changes * Updated dependencies \[3c44c4a] * @turnkey/sdk-browser\@1.14.0 * @turnkey/http\@2.20.0 ## 3.1.2 ### Patch Changes * Updated dependencies \[69d2571] * Updated dependencies \[57f9cb0] * @turnkey/sdk-browser\@1.13.0 * @turnkey/http\@2.19.0 ## 3.1.1 ### Patch Changes * Updated dependencies \[755833b] * @turnkey/sdk-browser\@1.12.1 ## 3.1.0 ### Minor Changes * 4945c71: Add support for @turnkey/sdk-browser clients ### Patch Changes * Updated dependencies \[6695af2] * @turnkey/sdk-browser\@1.12.0 * @turnkey/http\@2.18.0 ## 3.0.5 ### Patch Changes * Updated dependencies \[053fbfb] * @turnkey/http\@2.17.3 ## 3.0.4 ### Patch Changes * @turnkey/http\@2.17.2 ## 3.0.3 ### Patch Changes * Updated dependencies \[538d4fc] * @turnkey/http\@2.17.1 ## 3.0.2 ### Patch Changes * Updated dependencies \[78bc39c] * @turnkey/http\@2.17.0 ## 3.0.1 ### Patch Changes * Updated dependencies \[4df8914] * @turnkey/http\@2.16.0 ## 3.0.0 ### Patch Changes * 9c056d0: fix: personal\_sign parameters * Updated dependencies \[9ebd062] * @turnkey/http\@2.15.0 ## 2.0.8 ### Patch Changes * Updated dependencies \[96d7f99] * @turnkey/http\@2.14.2 ## 2.0.7 ### Patch Changes * Updated dependencies \[ff059d5] * @turnkey/http\@2.14.1 ## 2.0.6 ### Patch Changes * Updated dependencies \[848f8d3] * @turnkey/http\@2.14.0 ## 2.0.5 ### Patch Changes * Updated dependencies \[93dee46] * @turnkey/http\@2.13.0 ## 2.0.4 ### Patch Changes * Updated dependencies \[e2f2e0b] * @turnkey/http\@2.12.3 ## 2.0.3 ### Patch Changes * Removes unused VERSION from constants. Fixes issue with using process in a browser environment. ## 2.0.2 ### Patch Changes * Updated dependencies * @turnkey/http\@2.12.2 ## 2.0.1 ### Patch Changes * Updated dependencies \[f17a229] * @turnkey/http\@2.12.1 ## 2.0.0 ### Patch Changes * Updated dependencies * @turnkey/http\@2.12.0 ## 1.0.0 ### Patch Changes * Updated dependencies * @turnkey/http\@2.11.0 ## 0.2.0 ### Minor Changes * 65f781b: Initial Release ## 0.1.0 Initial release! # Encoding Source: https://docs.turnkey.com/changelogs/encoding/readme # @turnkey/encoding ## 0.6.0 ### Minor Changes * [#886](https://github.com/tkhq/sdk/pull/886) [`6bfcbc5`](https://github.com/tkhq/sdk/commit/6bfcbc5c098e64ab1d115518733b87cfc1653e17) Author [@moeodeh3](https://github.com/moeodeh3) - Expose `bs58` and `bs58check` shims for cross-platform usage. ## 0.6.0-beta.6 ### Minor Changes * @turnkey/react-wallet-kit and @turnkey/core beta release ## 0.6.0-beta.5 ### Minor Changes * SDK beta release @turnkey/react-wallet-kit @turnkey/core ## 0.6.0-beta.4 ### Minor Changes * @turnkey/react-wallet-kit and @turnkey/core beta-3 release ## 0.6.0-beta.3 ### Minor Changes * @turnkey/react-wallet-kit and @turnkey/core beta-3 release ## 0.6.0-beta.2 ### Minor Changes * updating package versions ## 0.6.0-beta.1 ### Minor Changes * test build ## 0.6.0-beta.0 ### Minor Changes * beta for @turnkey/react-wallet-kit and @turnkey/core ## 0.5.0 ### Minor Changes * [#653](https://github.com/tkhq/sdk/pull/653) [`40c4035`](https://github.com/tkhq/sdk/commit/40c40359ec7096d0bca39ffc93e89361b3b11a1a) Thanks [@moe-dev](https://github.com/moe-dev)! - Add pointEncode function ## 0.4.0 ### Minor Changes * added hexToAscii function, useful for converting a raw hex string to a (wallet) mnemonic ## 0.3.0 ### Minor Changes * 93666ff: turnkey/crypto standard HPKE encryption, first major release. Allows for programmatic importing in environments like node. Moved some encoding helper functions to turnkey/encoding ## 0.2.1 ### Patch Changes * 2d7e5a9: include additional utility functions ## 0.2.0 ### Minor Changes * fac7770: Add uint8ArrayFromHexstring and drop language saying this is an internal package ## 0.1.0 Initial release # Ethers Source: https://docs.turnkey.com/changelogs/ethers/readme # @turnkey/ethers ## 1.3.26 ### Patch Changes * Updated dependencies \[[`82dc76c`](https://github.com/tkhq/sdk/commit/82dc76c7ce51e5375570bbffab32eb739af90381), [`1d108d6`](https://github.com/tkhq/sdk/commit/1d108d6496ad8266db0e997a27aecc81e46008fb), [`dfdd864`](https://github.com/tkhq/sdk/commit/dfdd8647266fdd0297aaea32046ee815ae8fc27c)]: * @turnkey/core\@1.13.0 * @turnkey/sdk-browser\@5.15.2 * @turnkey/api-key-stamper\@0.6.3 * @turnkey/http\@3.17.1 * @turnkey/sdk-server\@5.1.1 ## 1.3.25 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-browser\@5.15.1 ## 1.3.24 ### Patch Changes * Updated dependencies \[[`af6262f`](https://github.com/tkhq/sdk/commit/af6262f31e1abb3090fcda1eec5318056e6d51fe), [`1f6e240`](https://github.com/tkhq/sdk/commit/1f6e2403fca1fd9cbca646f88c88dbc49ddb0c34), [`58e04e5`](https://github.com/tkhq/sdk/commit/58e04e5856626d9d2593abb61d8ca32d8ccbb833), [`7458b7c`](https://github.com/tkhq/sdk/commit/7458b7cd6fc64796b376e3374b7c2ed79467459c)]: * @turnkey/core\@1.12.0 * @turnkey/sdk-browser\@5.15.0 * @turnkey/sdk-server\@5.1.0 * @turnkey/http\@3.17.0 * @turnkey/api-key-stamper\@0.6.2 ## 1.3.23 ### Patch Changes * Updated dependencies \[[`d49ef7e`](https://github.com/tkhq/sdk/commit/d49ef7e9f0f78f16b1324a357f61cf0351198096), [`dced9db`](https://github.com/tkhq/sdk/commit/dced9dbbd8ea533442e19e45ce36e6a05a45a555), [`dced9db`](https://github.com/tkhq/sdk/commit/dced9dbbd8ea533442e19e45ce36e6a05a45a555)]: * @turnkey/core\@1.11.2 * @turnkey/sdk-browser\@5.14.3 * @turnkey/sdk-server\@5.0.3 * @turnkey/http\@3.16.3 ## 1.3.22 ### Patch Changes * Updated dependencies \[[`2d19991`](https://github.com/tkhq/sdk/commit/2d19991bcf4e1c9704b73a48c54e870373b4bd95), [`89d4084`](https://github.com/tkhq/sdk/commit/89d40844d791b0bbb6d439da5e778b1fdeca4273), [`4742eaf`](https://github.com/tkhq/sdk/commit/4742eafbfdcc6fe6b6d3aab01569ad94a5198571), [`ba2521d`](https://github.com/tkhq/sdk/commit/ba2521d5d1c1f6baaa58ee65dce8cc4839f7dc7b), [`12ca083`](https://github.com/tkhq/sdk/commit/12ca083314310b05cf41ac29fa2d55eed627f229), [`a85153c`](https://github.com/tkhq/sdk/commit/a85153c8ccc7454cd5aca974bc463fb47c7f8cd4)]: * @turnkey/core\@1.11.1 * @turnkey/sdk-server\@5.0.2 * @turnkey/sdk-browser\@5.14.2 * @turnkey/api-key-stamper\@0.6.1 * @turnkey/http\@3.16.2 ## 1.3.21 ### Patch Changes * Updated dependencies \[[`91d6a9e`](https://github.com/tkhq/sdk/commit/91d6a9eb1b9ac9e21745749615ac7a7be66f5cf6), [`91d6a9e`](https://github.com/tkhq/sdk/commit/91d6a9eb1b9ac9e21745749615ac7a7be66f5cf6), [`699fbd7`](https://github.com/tkhq/sdk/commit/699fbd75ef3f44f768ae641ab4f652e966b8e289)]: * @turnkey/core\@1.11.0 * @turnkey/api-key-stamper\@0.6.0 * @turnkey/sdk-browser\@5.14.1 * @turnkey/http\@3.16.1 * @turnkey/sdk-server\@5.0.1 ## 1.3.20 ### Patch Changes * Updated dependencies \[[`6261eed`](https://github.com/tkhq/sdk/commit/6261eed95af8627bf1e95e7291b9760a2267e301), [`78ec1d9`](https://github.com/tkhq/sdk/commit/78ec1d9afcafde3ca7107fc720323d486d6afaea), [`dbd4d8e`](https://github.com/tkhq/sdk/commit/dbd4d8e4ea567240c4d287452dd0d8f53050beca), [`cfd34ab`](https://github.com/tkhq/sdk/commit/cfd34ab14ff2abed0e22dca9a802c58a96b9e8e1), [`78ec1d9`](https://github.com/tkhq/sdk/commit/78ec1d9afcafde3ca7107fc720323d486d6afaea)]: * @turnkey/core\@1.10.0 * @turnkey/sdk-server\@5.0.0 * @turnkey/sdk-browser\@5.14.0 * @turnkey/http\@3.16.0 ## 1.3.19 ### Patch Changes * Updated dependencies \[[`29a42db`](https://github.com/tkhq/sdk/commit/29a42db8f5f3ef8b9c23c90cd00f4c21027aac2e)]: * @turnkey/core\@1.9.0 * @turnkey/sdk-browser\@5.13.6 * @turnkey/sdk-server\@4.12.2 ## 1.3.18 ### Patch Changes * [#1133](https://github.com/tkhq/sdk/pull/1133) [`4bd1183`](https://github.com/tkhq/sdk/commit/4bd1183418ec88e2ab0995f042fafff427ccbe90) Author [@zkharit](https://github.com/zkharit) - Fix a bug where the payload encoding parameter is not used with non Turnkey http clients * Updated dependencies \[[`7185545`](https://github.com/tkhq/sdk/commit/7185545ea1fc05eb738af09de5a594455f2e08f3)]: * @turnkey/core\@1.8.3 * @turnkey/sdk-browser\@5.13.5 ## 1.3.17 ### Patch Changes * Updated dependencies \[[`3c23fc2`](https://github.com/tkhq/sdk/commit/3c23fc27eda5325a90e79afff4cc3a16f682e1d9)]: * @turnkey/core\@1.8.2 ## 1.3.16 ### Patch Changes * Updated dependencies \[[`d4768c7`](https://github.com/tkhq/sdk/commit/d4768c71b6796532c9800d546154116e5d36b255)]: * @turnkey/core\@1.8.1 * @turnkey/sdk-browser\@5.13.4 ## 1.3.15 ### Patch Changes * Updated dependencies \[[`fd2e031`](https://github.com/tkhq/sdk/commit/fd2e0318079de922512b1f5adb404b11921f77b7), [`e1bd68f`](https://github.com/tkhq/sdk/commit/e1bd68f963d6bbd9c797b1a8f077efadccdec421)]: * @turnkey/core\@1.8.0 * @turnkey/sdk-browser\@5.13.3 * @turnkey/sdk-server\@4.12.1 ## 1.3.14 ### Patch Changes * Updated dependencies \[[`4d29af2`](https://github.com/tkhq/sdk/commit/4d29af2dd7c735916c650d697f18f66dd76c1b79)]: * @turnkey/sdk-browser\@5.13.2 ## 1.3.13 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-browser\@5.13.1 ## 1.3.12 ### Patch Changes * Updated dependencies \[[`beee465`](https://github.com/tkhq/sdk/commit/beee465a13f64abeb71c5c00519f7abab9942607), [`67b03a5`](https://github.com/tkhq/sdk/commit/67b03a5d9ab1b6eabfb0b41938ac91365b5dcd9b)]: * @turnkey/core\@1.7.0 * @turnkey/sdk-browser\@5.13.0 * @turnkey/sdk-server\@4.12.0 * @turnkey/http\@3.15.0 ## 1.3.11 ### Patch Changes * Updated dependencies \[[`71cdca3`](https://github.com/tkhq/sdk/commit/71cdca3b97ba520dc5327410a1e82cf9ad85fb0e), [`9fbd5c4`](https://github.com/tkhq/sdk/commit/9fbd5c459782dc3721dd0935d0a4458babce258b)]: * @turnkey/sdk-server\@4.11.0 * @turnkey/sdk-browser\@5.12.0 * @turnkey/core\@1.6.0 * @turnkey/http\@3.14.0 ## 1.3.10 ### Patch Changes * Updated dependencies \[]: * @turnkey/core\@1.5.2 * @turnkey/sdk-browser\@5.11.6 * @turnkey/sdk-server\@4.10.5 ## 1.3.9 ### Patch Changes * Updated dependencies \[[`886f319`](https://github.com/tkhq/sdk/commit/886f319fab8b0ba560d040e34598436f3beceff0)]: * @turnkey/core\@1.5.1 ## 1.3.8 ### Patch Changes * Updated dependencies \[[`5c4495b`](https://github.com/tkhq/sdk/commit/5c4495bff1b0abfe3c427ead1b8e1a8d510c8186), [`001d822`](https://github.com/tkhq/sdk/commit/001d8225202500e53aa399d6aee0c8f48f6060e0)]: * @turnkey/core\@1.5.0 * @turnkey/sdk-browser\@5.11.5 * @turnkey/sdk-server\@4.10.4 ## 1.3.7 ### Patch Changes * Updated dependencies \[[`9df42ad`](https://github.com/tkhq/sdk/commit/9df42adc02c7ff77afba3b938536e79b57882ef1)]: * @turnkey/sdk-browser\@5.11.4 * @turnkey/sdk-server\@4.10.3 * @turnkey/core\@1.4.2 * @turnkey/http\@3.13.1 ## 1.3.6 ### Patch Changes * Updated dependencies \[[`e5b9c5c`](https://github.com/tkhq/sdk/commit/e5b9c5c5694b1f4d60c0b8606822bcd6d61da4a3)]: * @turnkey/core\@1.4.1 ## 1.3.5 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-browser\@5.11.3 ## 1.3.4 ### Patch Changes * Updated dependencies \[[`6ceb06e`](https://github.com/tkhq/sdk/commit/6ceb06ebdbb11b017ed97e81a7e0dcb862813bfa), [`68631c4`](https://github.com/tkhq/sdk/commit/68631c4008387f845dfe4f1a139981011727f6c9)]: * @turnkey/core\@1.4.0 * @turnkey/sdk-browser\@5.11.2 * @turnkey/sdk-server\@4.10.2 ## 1.3.3 ### Patch Changes * Updated dependencies \[[`4adbf9b`](https://github.com/tkhq/sdk/commit/4adbf9bbb6b93f84aa80e06a1eeabd61d1dbbb86), [`4ead6da`](https://github.com/tkhq/sdk/commit/4ead6da626468fde41daf85eae90faf18651d1c1), [`3997c0f`](https://github.com/tkhq/sdk/commit/3997c0fd08a8a85108acf904c0bf39d69f8dc79c)]: * @turnkey/core\@1.3.0 * @turnkey/sdk-browser\@5.11.1 * @turnkey/sdk-server\@4.10.1 ## 1.3.2 ### Patch Changes * Updated dependencies \[[`4567059`](https://github.com/tkhq/sdk/commit/45670598f102223925b87a5295edca15a6ce8241), [`010543c`](https://github.com/tkhq/sdk/commit/010543c3b1b56a18816ea92a1a1cbe028cf988e4)]: * @turnkey/sdk-browser\@5.11.0 * @turnkey/sdk-server\@4.10.0 * @turnkey/core\@1.2.0 * @turnkey/http\@3.13.0 ## 1.3.1 ### Patch Changes * Updated dependencies \[[`0080c4d`](https://github.com/tkhq/sdk/commit/0080c4d011a7f8d04b41d89b31863b75d1a816ef), [`5a96fe8`](https://github.com/tkhq/sdk/commit/5a96fe80db4c4c45e09ad8c613695ee4c2b8e51f), [`c2a0bd7`](https://github.com/tkhq/sdk/commit/c2a0bd7ea8a53524cde16897f375f8a7088ba963), [`90841f9`](https://github.com/tkhq/sdk/commit/90841f95f3f738c47c04797096902d9d0a23afc7), [`e4bc82f`](https://github.com/tkhq/sdk/commit/e4bc82fc51c692d742923ccfff72c2c862ee71a4)]: * @turnkey/core\@1.1.0 * @turnkey/sdk-browser\@5.10.1 * @turnkey/sdk-server\@4.9.1 * @turnkey/http\@3.12.1 ## 1.3.0 ### Minor Changes * Updated dependencies \[[`fc1d6e2`](https://github.com/tkhq/sdk/commit/fc1d6e2d26f4a53116633e9e8cccccd792267f4e), [`fc1d6e2`](https://github.com/tkhq/sdk/commit/fc1d6e2d26f4a53116633e9e8cccccd792267f4e), [`4880f26`](https://github.com/tkhq/sdk/commit/4880f26a4dd324c049bff7f35284098ccfc55823), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`06347ad`](https://github.com/tkhq/sdk/commit/06347adfa08fb0867c350e43821d0fed06c49624)]: * @turnkey/sdk-server\@4.9.0 * @turnkey/core\@1.0.0 * @turnkey/http\@3.12.0 * @turnkey/api-key-stamper\@0.5.0 * @turnkey/sdk-browser\@5.10.0 ## 1.3.0-beta.1 ### Patch Changes * Updated dependencies \[]: * @turnkey/core\@1.0.0-beta.6 * @turnkey/sdk-browser\@5.9.0-beta.1 * @turnkey/api-key-stamper\@0.5.0-beta.6 * @turnkey/http\@3.11.1-beta.0 * @turnkey/sdk-server\@4.8.1-beta.0 ## 1.3.0-beta.0 ### Minor Changes * SDK beta release @turnkey/react-wallet-kit @turnkey/core ### Patch Changes * Updated dependencies \[]: * @turnkey/api-key-stamper\@0.5.0-beta.5 * @turnkey/sdk-browser\@5.9.0-beta.0 * @turnkey/sdk-server\@4.7.0-beta.2 * @turnkey/core\@1.0.0-beta.5 * @turnkey/http\@3.10.0-beta.2 ## 1.2.10 ### Patch Changes * Updated dependencies \[[`026264c`](https://github.com/tkhq/sdk/commit/026264c55aa16342c8925af0bdcdf72dc00e5158)]: * @turnkey/sdk-browser\@5.9.0 * @turnkey/sdk-server\@4.8.0 * @turnkey/http\@3.11.0 ## 1.2.9 ### Patch Changes * Updated dependencies \[[`5d8be2d`](https://github.com/tkhq/sdk/commit/5d8be2d0329070c7aa025dddb1b28f04257ae4e6)]: * @turnkey/sdk-browser\@5.8.0 * @turnkey/sdk-server\@4.7.0 * @turnkey/http\@3.10.0 ## 1.2.8-beta.4 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-server\@4.7.0-beta.1 * @turnkey/http\@3.10.0-beta.1 * @turnkey/sdk-browser\@5.7.1-beta.1 * @turnkey/api-key-stamper\@0.4.8-beta.4 ## 1.2.8-beta.3 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-server\@4.7.0-beta.0 * @turnkey/http\@3.10.0-beta.0 * @turnkey/sdk-browser\@5.7.1-beta.0 * @turnkey/api-key-stamper\@0.4.8-beta.3 ## 1.2.8-beta.2 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-browser\@5.6.1-beta.2 * @turnkey/api-key-stamper\@0.4.8-beta.2 * @turnkey/http\@3.8.1-beta.2 * @turnkey/sdk-server\@4.5.1-beta.2 ## 1.2.8-beta.1 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-browser\@5.6.1-beta.1 * @turnkey/api-key-stamper\@0.4.8-beta.1 * @turnkey/http\@3.8.1-beta.1 * @turnkey/sdk-server\@4.5.1-beta.1 ## 1.2.8-beta.0 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-browser\@5.6.1-beta.0 * @turnkey/api-key-stamper\@0.4.8-beta.0 * @turnkey/http\@3.8.1-beta.0 * @turnkey/sdk-server\@4.5.1-beta.0 ## 1.2.8 ### Patch Changes * Updated dependencies \[[`8b39dba`](https://github.com/tkhq/sdk/commit/8b39dbabf68d3e376b5b07f26960d5b61ae87fa9), [`1a549b7`](https://github.com/tkhq/sdk/commit/1a549b71f9a6e7ab59d52aaae7e58e34c8f2e8b5)]: * @turnkey/sdk-browser\@5.7.0 * @turnkey/sdk-server\@4.6.0 * @turnkey/http\@3.9.0 ## 1.2.7 ### Patch Changes * Updated dependencies \[[`f83f25b`](https://github.com/tkhq/sdk/commit/f83f25ba33ef15dbd66723531eebe2fd00f43ac0)]: * @turnkey/sdk-browser\@5.6.0 * @turnkey/sdk-server\@4.5.0 * @turnkey/http\@3.8.0 ## 1.2.6 ### Patch Changes * Updated dependencies \[[`81e355c`](https://github.com/tkhq/sdk/commit/81e355c9a8321feffcac056916b65139cf35eeed)]: * @turnkey/http\@3.7.0 * @turnkey/sdk-browser\@5.5.0 * @turnkey/sdk-server\@4.4.0 ## 1.2.5 ### Patch Changes * Updated dependencies \[[`0d1eb2c`](https://github.com/tkhq/sdk/commit/0d1eb2c464bac3cf6f4386f402604ecf8f373f15)]: * @turnkey/sdk-browser\@5.4.1 ## 1.2.4 ### Patch Changes * Updated dependencies \[[`e90a478`](https://github.com/tkhq/sdk/commit/e90a478c9208d858b1144df9b2c2c7ba956c406e)]: * @turnkey/sdk-browser\@5.4.0 * @turnkey/sdk-server\@4.3.0 * @turnkey/http\@3.6.0 ## 1.2.3 ### Patch Changes * Updated dependencies \[[`2db00b0`](https://github.com/tkhq/sdk/commit/2db00b0a799d09ae33fa08a117e3b2f433f2b0b4)]: * @turnkey/sdk-server\@4.2.4 ## 1.2.2 ### Patch Changes * Updated dependencies \[[`cb13c26`](https://github.com/tkhq/sdk/commit/cb13c26edb79a01ab651e3b2897334fd154b436a)]: * @turnkey/sdk-browser\@5.3.4 * @turnkey/sdk-server\@4.2.3 * @turnkey/http\@3.5.1 ## 1.2.1 ### Patch Changes * Updated dependencies \[[`2c4f42c`](https://github.com/tkhq/sdk/commit/2c4f42c747ac8017cf17e86b0ca0c3fa6f593bbf)]: * @turnkey/sdk-browser\@5.3.3 ## 1.2.0 ### Minor Changes * [#733](https://github.com/tkhq/sdk/pull/733) [`cc463d3`](https://github.com/tkhq/sdk/commit/cc463d3fde57f4d434fc41c5ed4ce42a0a506874) Author [@besler613](https://github.com/besler613) - Typed data hashing is now performed server-side using the new `PAYLOAD_ENCODING_EIP712` encoding, and EIP-712 Policies are supported via the `eth.eip_712` namespace. ## 1.1.34 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-browser\@5.3.2 * @turnkey/sdk-server\@4.2.2 ## 1.1.33 ### Patch Changes * Updated dependencies \[[`fa46701`](https://github.com/tkhq/sdk/commit/fa467019eef34b5199372248edff1e7a64934e79)]: * @turnkey/sdk-browser\@5.3.1 * @turnkey/sdk-server\@4.2.1 ## 1.1.32 ### Patch Changes * Updated dependencies \[[`5f3dd98`](https://github.com/tkhq/sdk/commit/5f3dd9814650308b3bf3198168c453e7b1a98efd), [`5f3dd98`](https://github.com/tkhq/sdk/commit/5f3dd9814650308b3bf3198168c453e7b1a98efd), [`7625df0`](https://github.com/tkhq/sdk/commit/7625df0538002c3455bd5862211210e38472e164)]: * @turnkey/http\@3.5.0 * @turnkey/sdk-browser\@5.3.0 * @turnkey/sdk-server\@4.2.0 * @turnkey/api-key-stamper\@0.4.7 ## 1.1.31 ### Patch Changes * Updated dependencies: * @turnkey/sdk-browser\@5.2.3 ## 1.1.30 ### Patch Changes * Updated dependencies: * @turnkey/sdk-browser\@5.2.2 ## 1.1.29 ### Patch Changes * [#665](https://github.com/tkhq/sdk/pull/665) [`be0a621`](https://github.com/tkhq/sdk/commit/be0a621fb962bd51d2df1a1e79f5260d7c696772) Author [@amircheikh](https://github.com/amircheikh) - Fix for `no runner registered` error when using mismatched versions of turnkey/http * Updated dependencies \[[`be0a621`](https://github.com/tkhq/sdk/commit/be0a621fb962bd51d2df1a1e79f5260d7c696772)]: * @turnkey/http\@3.4.2 * @turnkey/sdk-browser\@5.2.1 * @turnkey/sdk-server\@4.1.1 ## 1.1.28 ### Patch Changes * Updated dependencies \[[`5afbe51`](https://github.com/tkhq/sdk/commit/5afbe51949bdd1997fad083a4c1e4272ff7409dc), [`a38a6e3`](https://github.com/tkhq/sdk/commit/a38a6e36dc2bf9abdea64bc817d1cad95b8a289a), [`40c4035`](https://github.com/tkhq/sdk/commit/40c40359ec7096d0bca39ffc93e89361b3b11a1a), [`593de2d`](https://github.com/tkhq/sdk/commit/593de2d9404ec8cf53426f9cf832c13eefa3fbf2)]: * @turnkey/sdk-browser\@5.2.0 * @turnkey/sdk-server\@4.1.0 * @turnkey/http\@3.4.1 * @turnkey/api-key-stamper\@0.4.6 ## 1.1.27 ### Patch Changes * Updated dependencies \[[`27fe590`](https://github.com/tkhq/sdk/commit/27fe590cdc3eb6a8cde093eeefda2ee1cdc79412)]: * @turnkey/sdk-browser\@5.1.0 * @turnkey/sdk-server\@4.0.1 ## 1.1.26 ### Patch Changes * Updated dependencies \[[`07dfd33`](https://github.com/tkhq/sdk/commit/07dfd3397472687092e1c73b1d68714f421b9ca0), [`e8a5f1b`](https://github.com/tkhq/sdk/commit/e8a5f1b431623c4ff1cb85c6039464b328cf0e6a)]: * @turnkey/sdk-browser\@5.0.0 * @turnkey/sdk-server\@4.0.0 * @turnkey/http\@3.4.0 ## 1.1.25 ### Patch Changes * Updated dependencies \[25ca339] * @turnkey/sdk-browser\@4.3.0 * @turnkey/sdk-server\@3.3.0 * @turnkey/http\@3.3.0 ## 1.1.24 ### Patch Changes * Updated dependencies \[3f6e415] * Updated dependencies \[4d1d775] * @turnkey/sdk-browser\@4.2.0 * @turnkey/sdk-server\@3.2.0 * @turnkey/http\@3.2.0 * @turnkey/api-key-stamper\@0.4.5 ## 1.1.23 ### Patch Changes * Updated dependencies \[3e4a482] * @turnkey/sdk-browser\@4.1.0 * @turnkey/sdk-server\@3.1.0 * @turnkey/http\@3.1.0 ## 1.1.22 ### Patch Changes * Updated dependencies \[7b72769] * @turnkey/sdk-server\@3.0.1 ## 1.1.21 ### Patch Changes * Updated dependencies \[e501690] * Updated dependencies \[d1083bd] * Updated dependencies \[f94d36e] * @turnkey/sdk-browser\@4.0.0 * @turnkey/sdk-server\@3.0.0 * @turnkey/http\@3.0.0 ## 1.1.20 ### Patch Changes * Updated dependencies \[bf87774] * @turnkey/sdk-browser\@3.1.0 ## 1.1.19 ### Patch Changes * Updated dependencies \[5ec5187] * @turnkey/sdk-browser\@3.0.1 * @turnkey/sdk-server\@2.6.1 ## 1.1.18 ### Patch Changes * Updated dependencies \[0e4e959] * Updated dependencies \[856f449] * Updated dependencies \[c9ae537] * Updated dependencies \[d4ce5fa] * Updated dependencies \[ecdb29a] * Updated dependencies \[72890f5] * @turnkey/sdk-browser\@3.0.0 * @turnkey/sdk-server\@2.6.0 * @turnkey/http\@2.22.0 ## 1.1.17 ### Patch Changes * Updated dependencies \[93540e7] * Updated dependencies \[fdb8bf0] * Updated dependencies \[9147962] * @turnkey/sdk-browser\@2.0.0 * @turnkey/sdk-server\@2.5.0 ## 1.1.16 ### Patch Changes * Updated dependencies \[233ae71] * Updated dependencies \[9317588] * @turnkey/sdk-browser\@1.16.0 * @turnkey/sdk-server\@2.4.0 ## 1.1.15 ### Patch Changes * Updated dependencies \[56a307e] * @turnkey/sdk-browser\@1.15.0 * @turnkey/sdk-server\@2.3.0 * @turnkey/http\@2.21.0 ## 1.1.14 ### Patch Changes * Updated dependencies \[3c44c4a] * Updated dependencies \[bfc833f] * @turnkey/sdk-browser\@1.14.0 * @turnkey/sdk-server\@2.2.0 * @turnkey/http\@2.20.0 ## 1.1.13 ### Patch Changes * Updated dependencies \[69d2571] * Updated dependencies \[57f9cb0] * @turnkey/sdk-browser\@1.13.0 * @turnkey/sdk-server\@2.1.0 * @turnkey/http\@2.19.0 ## 1.1.12 ### Patch Changes * Updated dependencies \[755833b] * @turnkey/sdk-browser\@1.12.1 * @turnkey/sdk-server\@2.0.1 ## 1.1.11 ### Patch Changes * Updated dependencies \[6695af2] * Updated dependencies \[1ebd4e2] * @turnkey/sdk-browser\@1.12.0 * @turnkey/sdk-server\@2.0.0 * @turnkey/http\@2.18.0 ## 1.1.10 ### Patch Changes * Updated dependencies \[053fbfb] * @turnkey/sdk-browser\@1.11.2 * @turnkey/sdk-server\@1.7.3 * @turnkey/http\@2.17.3 ## 1.1.9 ### Patch Changes * Updated dependencies \[328d6aa] * Updated dependencies \[b90947e] * Updated dependencies \[2d5977b] * Updated dependencies \[fad7c37] * @turnkey/sdk-browser\@1.11.1 * @turnkey/sdk-server\@1.7.2 * @turnkey/api-key-stamper\@0.4.4 * @turnkey/http\@2.17.2 ## 1.1.8 ### Patch Changes * Updated dependencies \[7988bc1] * Updated dependencies \[538d4fc] * Updated dependencies \[12d5aaa] * @turnkey/sdk-browser\@1.11.0 * @turnkey/sdk-server\@1.7.1 * @turnkey/http\@2.17.1 ## 1.1.7 ### Patch Changes * @turnkey/sdk-browser\@1.10.2 ## 1.1.6 ### Patch Changes * Updated dependencies \[78bc39c] * @turnkey/sdk-server\@1.7.0 * @turnkey/http\@2.17.0 * @turnkey/sdk-browser\@1.10.1 ## 1.1.5 ### Patch Changes * Updated dependencies \[8bea78f] * @turnkey/sdk-browser\@1.10.0 ## 1.1.4 ### Patch Changes * Updated dependencies \[3dd74ac] * Updated dependencies \[1e36edf] * Updated dependencies \[4df8914] * Updated dependencies \[11a9e2f] * @turnkey/sdk-browser\@1.9.0 * @turnkey/sdk-server\@1.6.0 * @turnkey/http\@2.16.0 ## 1.1.3 ### Patch Changes * Updated dependencies \[9ebd062] * @turnkey/sdk-browser\@1.8.0 * @turnkey/sdk-server\@1.5.0 * @turnkey/http\@2.15.0 ## 1.1.2 ### Patch Changes * Updated dependencies \[abe7138] * Updated dependencies \[96d7f99] * @turnkey/sdk-server\@1.4.2 * @turnkey/sdk-browser\@1.7.1 * @turnkey/http\@2.14.2 * @turnkey/api-key-stamper\@0.4.3 ## 1.1.1 ### Patch Changes * Updated dependencies \[ff059d5] * Updated dependencies \[ff059d5] * @turnkey/sdk-browser\@1.7.0 * @turnkey/sdk-server\@1.4.1 * @turnkey/http\@2.14.1 * @turnkey/api-key-stamper\@0.4.2 ## 1.1.0 ### Minor Changes * bdded80: Support awaiting consensus * Add a few new helper functions: * `serializeSignature` serializes a raw signature ### Patch Changes * Updated dependencies \[c988ed0] * Updated dependencies \[848f8d3] * @turnkey/sdk-browser\@1.6.0 * @turnkey/sdk-server\@1.4.0 * @turnkey/http\@2.14.0 ## 1.0.21 ### Patch Changes * Updated dependencies \[1813ed5] * @turnkey/sdk-browser\@1.5.0 ## 1.0.20 ### Patch Changes * Updated dependencies \[bab5393] * Updated dependencies \[a16073c] * Updated dependencies \[7e7d209] * @turnkey/sdk-browser\@1.4.0 ## 1.0.19 ### Patch Changes * Updated dependencies \[93dee46] * @turnkey/http\@2.13.0 * @turnkey/sdk-browser\@1.3.0 * @turnkey/sdk-server\@1.3.0 ## 1.0.18 ### Patch Changes * Updated dependencies \[e2f2e0b] * @turnkey/sdk-browser\@1.2.4 * @turnkey/sdk-server\@1.2.4 * @turnkey/http\@2.12.3 ## 1.0.17 ### Patch Changes * Updated dependencies * @turnkey/sdk-browser\@1.2.3 * @turnkey/sdk-server\@1.2.3 ## 1.0.16 ### Patch Changes * Updated dependencies * @turnkey/api-key-stamper\@0.4.1 * @turnkey/http\@2.12.2 * @turnkey/sdk-browser\@1.2.2 * @turnkey/sdk-server\@1.2.2 ## 1.0.15 ### Patch Changes * Updated dependencies \[f17a229] * @turnkey/http\@2.12.1 * @turnkey/sdk-browser\@1.2.1 * @turnkey/sdk-server\@1.2.1 ## 1.0.14 ### Patch Changes * Updated dependencies * @turnkey/http\@2.12.0 * @turnkey/sdk-browser\@1.2.0 * @turnkey/sdk-server\@1.2.0 ## 1.0.13 ### Patch Changes * Updated dependencies * @turnkey/http\@2.11.0 * @turnkey/sdk-browser\@1.1.0 * @turnkey/sdk-server\@1.1.0 ## 1.0.12 ### Patch Changes * Updated dependencies * @turnkey/sdk-browser\@1.0.0 * @turnkey/sdk-server\@1.0.0 ## 1.0.11 ### Patch Changes * @turnkey/sdk-browser\@0.4.1 ## 1.0.10 ### Patch Changes * Updated dependencies \[e4b29da] * @turnkey/sdk-browser\@0.4.0 ## 1.0.9 ### Patch Changes * Updated dependencies \[d409d81] * @turnkey/sdk-browser\@0.3.0 ## 1.0.8 ### Patch Changes * @turnkey/sdk-browser\@0.2.1 ## 1.0.7 ### Patch Changes * Updated dependencies * Updated dependencies \[e4d2a84] * @turnkey/sdk-browser\@0.2.0 * @turnkey/sdk-server\@0.2.0 ## 1.0.6 ### Patch Changes * Updated dependencies * @turnkey/sdk-browser\@0.1.0 * @turnkey/sdk-server\@0.1.0 ## 1.0.5 ### Patch Changes * a6502e6: Add support for new Turnkey Client types ## 1.0.4 ### Patch Changes * Updated dependencies \[7a9ce7a] * @turnkey/http\@2.10.0 ## 1.0.3 ### Patch Changes * Updated dependencies * @turnkey/http\@2.9.1 ## 1.0.2 ### Patch Changes * Updated dependencies \[83b62b5] * @turnkey/http\@2.9.0 ## 1.0.1 ### Patch Changes * Updated dependencies \[46a7d90] * @turnkey/http\@2.8.0 ## 1.0.0 ### Major Changes Updates @turnkey/ethers package and examples to use ethers v6. Refer to [https://docs.ethers.org/v6/migrating](https://docs.ethers.org/v6/migrating) for full migration instructions. ✨Summary of Changes✨ `getBalance` is no longer a method on the signer. It must be obtained via the provider instance. Additionally, it requires an address to be passed in: ``` // before const balance = await connectedSigner.getBalance(); // after // first get the address const address = await connectedSigner.getAddress() // then pass it in const balance = await connectedSigner.provider?.getBalance(address) ``` `getChainId` is no longer a method on the signer. It must be obtained via the network object on the provider instance: ``` // before const chainId = await connectedSigner.getChainId(); // after const chainId = (await connectedSigner.provider?.getNetwork())?.chainId; ``` `getTransactionCount` is no longer a method on the signer. It must be obtained via the provider instance. Additionally, it requires an address to be passed in: ``` // before const transactionCount = await connectedSigner.getTransactionCount(); // after // first get the address const address = await connectedSigner.getAddress() // then pass it in const transactionCount = await connectedSigner.provider?.getTransactionCount(address); ``` `getFeeData` is no longer a method on the signer. It must be obtained via the provider instance: ``` // before const feeData = await connectedSigner.getFeeData(); // after const feeData = await connectedSigner.provider?.getFeeData(); ``` BigNumber -> bigint: numerical values such as, chainId, fee data, balance now use new ES6 primitive `bigint` instead of `BigNumber`. For example, when checking if the balance is `0`, `bigint` must now be used for comparison: ``` // before if (balance.isZero()) {...} // after if (balance === 0n) {...} ``` ## 0.19.9 ### Patch Changes * Updated dependencies * @turnkey/http\@2.7.1 ## 0.19.8 ### Patch Changes * Updated dependencies (\[c3b423b], \[d73725b]) * @turnkey/api-key-stamper\@0.4.0 * @turnkey/http\@2.7.0 ## 0.19.7 ### Patch Changes * Updated dependencies \[f9d636c] * @turnkey/http\@2.6.2 ## 0.19.6 ### Patch Changes * Updated dependencies \[52e2389] * @turnkey/http\@2.6.1 ## 0.19.5 ### Patch Changes * Updated dependencies \[7a3c890] * @turnkey/http\@2.6.0 ## 0.19.4 ### Patch Changes * Upgrade to Node v18 (#184) * Updated dependencies * @turnkey/api-key-stamper\@0.3.1 * @turnkey/http\@2.5.1 ## 0.19.3 ### Patch Changes * Updated dependencies \[464ac0e] * @turnkey/http\@2.5.0 ## 0.19.2 ### Patch Changes * @turnkey/http\@2.4.2 ## 0.19.1 ### Patch Changes * Updated dependencies \[f87ced8] * @turnkey/http\@2.4.1 ## 0.19.0 ### Minor Changes * Use rollup to build ESM and CommonJS, fix ESM support (#174) ### Patch Changes * Updated dependencies \[fc5b291] * @turnkey/api-key-stamper\@0.3.0 * @turnkey/http\@2.4.0 ## 0.18.3 ### Patch Changes * Updated dependencies * @turnkey/api-key-stamper\@0.3.0 * @turnkey/http\@2.3.1 ## 0.18.2 ### Patch Changes * Updated dependencies \[f1bd68a] * @turnkey/http\@2.3.0 ## 0.18.1 ### Patch Changes * Updated dependencies \[ed50a0f] * Updated dependencies * @turnkey/http\@2.2.0 ## 0.18.0 ### Minor Changes * cf8631a: Update interface to support `signWith` This change supports signing with wallet account addresses, private key addresses, or private key IDs. See below for an example: ```js theme={"system"} const turnkeyClient = new TurnkeyClient( { baseUrl: "https://api.turnkey.com", }, // This uses API key credentials. // If you're using passkeys, use `@turnkey/webauthn-stamper` to collect webauthn signatures: // new WebauthnStamper({...options...}) new ApiKeyStamper({ apiPublicKey: "...", apiPrivateKey: "...", }), ); // Initialize a Turnkey Signer const turnkeySigner = new TurnkeySigner({ client: turnkeyClient, organizationId: "...", signWith: "...", }); ``` ## 0.17.4 ### Patch Changes * Updated dependencies \[bb6ea0b] * @turnkey/http\@2.1.0 ## 0.17.3 ### Patch Changes * Updated dependencies * @turnkey/http\@2.0.0 * Updated the shape of signing ## 0.17.2 ### Patch Changes * Updated dependencies * @turnkey/http\@1.3.0 ## 0.17.1 ### Patch Changes * Update documentation as follows: * ebf87a9: This breaking change adds support for stampers (@turnkey/api-key-stamper / @turnkey/webauthn-stamper) to integrate with API keys or passkeys, bringing it to parity with our [Viem](https://github.com/tkhq/sdk/tree/main/packages/viem) package. See the following examples for sample usage: * [with-ethers](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-ethers): updated to use `@turnkey/api-key-stamper` * [with-ethers-and-passkeys](https://github.com/tkhq/sdk/tree/main/examples/with-ethers-and-passkeys): demonstrates usage of `@turnkey/webauthn-stamper` ## 0.17.0 ### Minor Changes * Add support for stampers (@turnkey/api-key-stamper / @turnkey/webauthn-stamper) to integrate with API keys or passkeys. ## 0.16.8 ### Patch Changes * Updated dependencies * @turnkey/http\@1.2.0 ## 0.16.7 ### Patch Changes * @turnkey/http\@1.1.1 ## 0.16.6 ### Patch Changes * Updated dependencies * @turnkey/http\@1.1.0 ## 0.16.5 ### Patch Changes * Updated dependencies \[8d1d0e8] * @turnkey/http\@1.0.1 ## 0.16.4 ### Patch Changes * 46473ec: This breaking change updates generated code to be shorter and more intuitive to read: * generated fetchers do not include the HTTP method in their name. For example `useGetGetActivity` is now `useGetActivity`, and `usePostSignTransaction` is `useSignTransaction`. * input types follow the same convention (no HTTP method in the name): `TPostCreatePrivateKeysInput` is now `TCreatePrivateKeysInput`. * the "federated" request helpers introduced in `0.18.0` are now named "signed" requests to better reflect what they are. `FederatedRequest` is now `SignedRequest`, and generated types follow. For example: `federatedPostCreatePrivateKeys` is now `signCreatePrivateKeys`, `federatedGetGetActivity` is now `signGetActivity`, and so on. The name updates should be automatically suggested if you use VSCode since the new names are simply shorter versions of the old one. * Updated dependencies \[46473ec] * Updated dependencies \[38b424f] * @turnkey/http\@1.0.0 ## 0.16.3 ### Patch Changes * Updated dependencies * @turnkey/http\@0.18.1 ## 0.16.2 ### Patch Changes * Updated dependencies * @turnkey/http\@0.18.0 ## 0.16.1 ### Patch Changes * Updated dependencies * @turnkey/http\@0.17.1 ## 0.16.0 ### Minor Changes * No public facing changes ### Patch Changes * Updated dependencies \[9317f51] * @turnkey/http\@0.17.0 ## 0.15.0 ### Minor Changes * No public facing changes ### Patch Changes * Updated dependencies * @turnkey/http\@0.16.0 * Fix `.postGetPrivateKey(...)`'s underlying path, while adding `@deprecated` `.postGetPrivateKeyBackwardsCompat(...)` for backward compatibility ## 0.14.1 ### Patch Changes * Updated dependencies * @turnkey/http\@0.15.0 ## 0.14.0 ### Minor Changes * `signTransaction(...)` now verifies and drops `tx.from` if present * This mimics the behavior of ethers' Wallet [implementation](https://github.com/ethers-io/ethers.js/blob/f97b92bbb1bde22fcc44100af78d7f31602863ab/packages/wallet/src.ts/index.ts#L117-L121) ### Patch Changes * Updated dependencies * @turnkey/http\@0.14.0 ## 0.13.2 ### Patch Changes * New `TurnkeyRequestError` error class that contains rich error details * Updated dependencies * @turnkey/http\@0.13.2 ## 0.13.1 ### Patch Changes * Error messages now contain Turnkey-specific error details * Updated dependencies * @turnkey/http\@0.13.1 ## 0.13.0 ### Minor Changes * No public facing changes ### Patch Changes * Updated dependencies * @turnkey/http\@0.13.0 ## 0.12.0 ### Minor Changes * Error messages now contain Turnkey-specific error code and message ### Patch Changes * Updated dependencies * @turnkey/http\@0.12.0 ## 0.11.0 ### Minor Changes * `TurnkeySigner` now conforms to ethers' `TypedDataSigner` interface ### Patch Changes * Updated dependencies * @turnkey/http\@0.11.0 ## 0.10.0 ### Minor Changes * Added EIP-712 support for signing typed data to Ethers. * Update Gnosis example to make use of new signing functionality. ### Patch Changes * Updated dependencies * @turnkey/http\@0.10.0 ## 0.9.0 ### Minor Changes * Improved support for React Native runtime ([https://github.com/tkhq/sdk/pull/37](https://github.com/tkhq/sdk/pull/37)) ### Patch Changes * Updated dependencies * @turnkey/http\@0.9.0 ## 0.8.1 ### Patch Changes * Switched from `undici` to `cross-fetch` to improve bundler compatibility * Updated dependencies * @turnkey/http\@0.8.1 ## 0.8.0 ### Minor Changes * Added browser runtime support — `@turnkey/ethers` is now a universal (isomorphic) package * Dropped support for Node.js v14; we recommend using Node v18+ ### Patch Changes * Updated dependencies * @turnkey/http\@0.8.0 ## 0.7.0 ### Minor Changes * No public facing changes ### Patch Changes * Updated dependencies * @turnkey/http\@0.7.0 ## 0.6.0 ### Minor Changes * `#signMessage(...)`: move encoding and hashing logic to client side, `eth_sign` style ### Patch Changes * Updated dependencies * @turnkey/http\@0.6.0 ## 0.5.0 ### Minor Changes * Arbitrary message signing ### Patch Changes * Updated dependencies * @turnkey/http\@0.5.0 ## 0.4.0 ### Minor Changes * `timestamp` -> `timestampMs` ### Patch Changes * Updated dependencies * @turnkey/http\@0.4.0 ## 0.3.1 ### Patch Changes * Fix outdated artifact * Updated dependencies * @turnkey/http\@0.3.1 ## 0.3.0 ### Minor Changes * `keyId` -> `privateKeyId` everywhere ### Patch Changes * Updated dependencies * @turnkey/http\@0.3.0 ## 0.2.0 ### Minor Changes * Change parameter from `keyId` to `privateKeyId` * Bump API version to latest Beta ### Patch Changes * Updated dependencies * @turnkey/http\@0.2.0 ## 0.1.3 ### Patch Changes * Support runtime config for credentials * Updated dependencies * @turnkey/http\@0.1.3 ## 0.1.2 ### Patch Changes * Drop internal dev dependency * Updated dependencies * @turnkey/http\@0.1.2 ## 0.1.1 ### Patch Changes * Initial release * Updated dependencies * @turnkey/http\@0.1.1 # Go Source: https://docs.turnkey.com/changelogs/golang/readme # Changelog ## [v0.3.0](https://github.com/tkhq/go-sdk/compare/v0.2.0...v0.3.0) (2025-02-19) * Update per mono release v2025.2.1 * Introduces new `GetWalletAccount` query ## [v0.2.0](https://github.com/tkhq/go-sdk/compare/v0.1.0...v0.2.0) (2025-02-13) * Update per mono release v2025.1.11 * Update vulnerable go crypto package ## [v0.1.0](https://github.com/tkhq/go-sdk/compare/8c73e973e9a5e1e4cfabef7aaae24a8fad91478f...v0.1.0) (2025-01-17) * First "official" beta release! 🥳 * Because it's the first, this release version corresponds to the latest changes merged in `8c73e973e9a5e1e4cfabef7aaae24a8fad91478f` # Http Source: https://docs.turnkey.com/changelogs/http/readme # @turnkey/http ## 3.17.1 ### Patch Changes * Updated dependencies \[]: * @turnkey/api-key-stamper\@0.6.3 ## 3.17.0 ### Minor Changes * [#1206](https://github.com/tkhq/sdk/pull/1206) [`58e04e5`](https://github.com/tkhq/sdk/commit/58e04e5856626d9d2593abb61d8ca32d8ccbb833) Author [@DeRauk](https://github.com/DeRauk) - Adds sdk methods for the GetWalletAddressBalances and ListSupportedAssets apis. ### Patch Changes * [#1201](https://github.com/tkhq/sdk/pull/1201) [`1f6e240`](https://github.com/tkhq/sdk/commit/1f6e2403fca1fd9cbca646f88c88dbc49ddb0c34) Author [@ethankonk](https://github.com/ethankonk) - Synced with Mono v2026.2.0 * [#1197](https://github.com/tkhq/sdk/pull/1197) [`7458b7c`](https://github.com/tkhq/sdk/commit/7458b7cd6fc64796b376e3374b7c2ed79467459c) Thanks [@moe-dev](https://github.com/moe-dev)! - Add support for SolSendTransaction and associated abstractions * Updated dependencies \[]: * @turnkey/api-key-stamper\@0.6.2 ## 3.16.3 ### Patch Changes * [#1194](https://github.com/tkhq/sdk/pull/1194) [`dced9db`](https://github.com/tkhq/sdk/commit/dced9dbbd8ea533442e19e45ce36e6a05a45a555) Author [@moeodeh3](https://github.com/moeodeh3) - Add `Content-Type: application/json` header to all Turnkey API requests. The missing header caused "Network request failed" errors on React Native, intermittent for some setups and consistent for others, where OkHttp-backed fetch can reject `POST` requests without an explicit `Content-Type`. See also: [https://github.com/JakeChampion/fetch/issues/823](https://github.com/JakeChampion/fetch/issues/823) Special thanks to @jrmykolyn and @niroshanS for helping identify and debug this issue ## 3.16.2 ### Patch Changes * Updated dependencies \[]: * @turnkey/api-key-stamper\@0.6.1 ## 3.16.1 ### Patch Changes * Updated dependencies \[[`91d6a9e`](https://github.com/tkhq/sdk/commit/91d6a9eb1b9ac9e21745749615ac7a7be66f5cf6)]: * @turnkey/api-key-stamper\@0.6.0 ## 3.16.0 ### Minor Changes * [#1153](https://github.com/tkhq/sdk/pull/1153) [`78ec1d9`](https://github.com/tkhq/sdk/commit/78ec1d9afcafde3ca7107fc720323d486d6afaea) Thanks [@moe-dev](https://github.com/moe-dev)! - Update as per mono v2025.12.3. ### Behavioral Changes * `appName` is now **required**: * In `emailCustomization` for Email Auth activities * At the top-level intent for OTP activities * Auth proxy endpoints are **not affected** ### Activity Version Bumps The following activity types have been versioned: * `ACTIVITY_TYPE_INIT_OTP` → `ACTIVITY_TYPE_INIT_OTP_V2` * `ACTIVITY_TYPE_INIT_OTP_AUTH_V2` → `ACTIVITY_TYPE_INIT_OTP_V3` * `ACTIVITY_TYPE_EMAIL_AUTH_V2` → `ACTIVITY_TYPE_EMAIL_AUTH_V3` * `ACTIVITY_TYPE_INIT_USER_EMAIL_RECOVERY` -> `ACTIVITY_TYPE_INIT_USER_EMAIL_RECOVERY_V2` ## 3.15.0 ### Minor Changes * [#1072](https://github.com/tkhq/sdk/pull/1072) [`67b03a5`](https://github.com/tkhq/sdk/commit/67b03a5d9ab1b6eabfb0b41938ac91365b5dcd9b) Thanks [@moe-dev](https://github.com/moe-dev)! - Bump packages as per mono v2025.11.0 ## 3.14.0 ### Minor Changes * [#1058](https://github.com/tkhq/sdk/pull/1058) [`9fbd5c4`](https://github.com/tkhq/sdk/commit/9fbd5c459782dc3721dd0935d0a4458babce258b) Author [@moeodeh3](https://github.com/moeodeh3) - Update per mono release `v2025.10.10-hotfix.2` ## 3.13.1 ### Patch Changes * [#1016](https://github.com/tkhq/sdk/pull/1016) [`9df42ad`](https://github.com/tkhq/sdk/commit/9df42adc02c7ff77afba3b938536e79b57882ef1) Author [@amircheikh](https://github.com/amircheikh) - Synced API as per mono v2025.10.2 ## 3.13.0 ### Minor Changes * [#977](https://github.com/tkhq/sdk/pull/977) [`4567059`](https://github.com/tkhq/sdk/commit/45670598f102223925b87a5295edca15a6ce8241) Author [@besler613](https://github.com/besler613) - OAuth2Authenticate now supports returning the encrypted bearer token via the optional `bearerTokenTargetPublicKey` request parameter (mono release v2025.9.5) ## 3.12.1 ### Patch Changes * [#958](https://github.com/tkhq/sdk/pull/958) [`5a96fe8`](https://github.com/tkhq/sdk/commit/5a96fe80db4c4c45e09ad8c613695ee4c2b8e51f) Author [@amircheikh](https://github.com/amircheikh) - - Synced api with mono ## 3.12.0 ### Minor Changes * Updated dependencies \[[`fc1d6e2`](https://github.com/tkhq/sdk/commit/fc1d6e2d26f4a53116633e9e8cccccd792267f4e), [`fc1d6e2`](https://github.com/tkhq/sdk/commit/fc1d6e2d26f4a53116633e9e8cccccd792267f4e), [`4880f26`](https://github.com/tkhq/sdk/commit/4880f26a4dd324c049bff7f35284098ccfc55823), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`06347ad`](https://github.com/tkhq/sdk/commit/06347adfa08fb0867c350e43821d0fed06c49624), [`6bfcbc5`](https://github.com/tkhq/sdk/commit/6bfcbc5c098e64ab1d115518733b87cfc1653e17)]: * @turnkey/encoding\@0.6.0 * @turnkey/webauthn-stamper\@0.6.0 * @turnkey/api-key-stamper\@0.5.0 ## 3.11.1-beta.0 ### Patch Changes * Updated dependencies \[]: * @turnkey/encoding\@0.6.0-beta.6 * @turnkey/api-key-stamper\@0.5.0-beta.6 ## 3.11.0 ### Minor Changes * [#879](https://github.com/tkhq/sdk/pull/879) [`026264c`](https://github.com/tkhq/sdk/commit/026264c55aa16342c8925af0bdcdf72dc00e5158) Author [@zkharit](https://github.com/zkharit) - Update packages to include new activities as of the newest release (mono v2025.8.10) ## 3.10.0-beta.2 ### Minor Changes * SDK beta release @turnkey/react-wallet-kit @turnkey/core ### Patch Changes * Updated dependencies \[]: * @turnkey/webauthn-stamper\@0.6.0-beta.0 * @turnkey/api-key-stamper\@0.5.0-beta.5 * @turnkey/encoding\@0.6.0-beta.5 ## 3.10.0-beta.1 ### Minor Changes * @turnkey/react-wallet-kit and @turnkey/core beta-3 release ### Patch Changes * Updated dependencies \[]: * @turnkey/encoding\@0.6.0-beta.4 * @turnkey/api-key-stamper\@0.4.8-beta.4 ## 3.10.0-beta.0 ### Minor Changes * @turnkey/react-wallet-kit and @turnkey/core beta-3 release ### Patch Changes * Updated dependencies \[]: * @turnkey/encoding\@0.6.0-beta.3 * @turnkey/api-key-stamper\@0.4.8-beta.3 ## 3.10.0 ### Minor Changes * [#861](https://github.com/tkhq/sdk/pull/861) [`5d8be2d`](https://github.com/tkhq/sdk/commit/5d8be2d0329070c7aa025dddb1b28f04257ae4e6) Author [@amircheikh](https://github.com/amircheikh) - Synced as per mono 2025.8.4 ## 3.9.0 ### Minor Changes * [#834](https://github.com/tkhq/sdk/pull/834) [`8b39dba`](https://github.com/tkhq/sdk/commit/8b39dbabf68d3e376b5b07f26960d5b61ae87fa9) Author [@moeodeh3](https://github.com/moeodeh3) - Update per mono release v2025.8.3-hotfix.0 ## 3.8.1-beta.2 ### Patch Changes * Updated dependencies \[]: * @turnkey/encoding\@0.6.0-beta.2 * @turnkey/api-key-stamper\@0.4.8-beta.2 ## 3.8.1-beta.1 ### Patch Changes * Updated dependencies \[]: * @turnkey/encoding\@0.6.0-beta.1 * @turnkey/api-key-stamper\@0.4.8-beta.1 ## 3.8.1-beta.0 ### Patch Changes * Updated dependencies \[]: * @turnkey/encoding\@1.0.0-beta.0 * @turnkey/api-key-stamper\@0.4.8-beta.0 ## 3.8.0 ### Minor Changes * [#826](https://github.com/tkhq/sdk/pull/826) [`f83f25b`](https://github.com/tkhq/sdk/commit/f83f25ba33ef15dbd66723531eebe2fd00f43ac0) Author [@turnekybc](https://github.com/turnekybc) - Update per mono release v2025.8.1 ## 3.7.0 ### Minor Changes * [#651](https://github.com/tkhq/sdk/pull/651) [`81e355c`](https://github.com/tkhq/sdk/commit/81e355c9a8321feffcac056916b65139cf35eeed) Author [@turnekybc](https://github.com/turnekybc) - Add Coinbase & MoonPay Fiat Onramp. View the [Fiat Onramp feature docs](https://docs.turnkey.com/wallets/fiat-on-ramp). ## 3.6.0 ### Minor Changes * [#782](https://github.com/tkhq/sdk/pull/782) [`e90a478`](https://github.com/tkhq/sdk/commit/e90a478c9208d858b1144df9b2c2c7ba956c406e) Thanks [@r-n-o](https://github.com/r-n-o)! - Release v2025.7.16 ## 3.5.1 ### Patch Changes * [#763](https://github.com/tkhq/sdk/pull/763) [`cb13c26`](https://github.com/tkhq/sdk/commit/cb13c26edb79a01ab651e3b2897334fd154b436a) Author [@andrewkmin](https://github.com/andrewkmin) - Release per mono v2025.7.1. This release contains the following API changes: * Introduction of `SmartContractInterfaces`: we've now exposed endpoints for uploading ABIs and IDLs to help secure EVM and Solana signing flows. For more information, see our docs [here](https://docs.turnkey.com/concepts/policies/smart-contract-interfaces) ## 3.5.0 ### Minor Changes * [#704](https://github.com/tkhq/sdk/pull/704) [`5f3dd98`](https://github.com/tkhq/sdk/commit/5f3dd9814650308b3bf3198168c453e7b1a98efd) Author [@amircheikh](https://github.com/amircheikh) - Added `name` field to constructor. `isHttpClient` now uses this new field to complete the check. This fixes a bug where `isHttpClient` would fail the check under certain production environments. Synced with mono 2025.6.10 to include the following endpoints: `update_user_email`: Update a User's email in an existing Organization `update_user_name`: Update a User's name in an existing Organization `update_user_phone_number`: Update a User's phone number in an existing Organization ### Patch Changes * Updated dependencies \[[`7625df0`](https://github.com/tkhq/sdk/commit/7625df0538002c3455bd5862211210e38472e164)]: * @turnkey/api-key-stamper\@0.4.7 ## 3.4.2 ### Patch Changes * [#665](https://github.com/tkhq/sdk/pull/665) [`be0a621`](https://github.com/tkhq/sdk/commit/be0a621fb962bd51d2df1a1e79f5260d7c696772) Author [@amircheikh](https://github.com/amircheikh) - Exposed `isHttpClient` function for determining if a passed in client is from turnkey/http ## 3.4.1 ### Patch Changes * [#663](https://github.com/tkhq/sdk/pull/663) [`593de2d`](https://github.com/tkhq/sdk/commit/593de2d9404ec8cf53426f9cf832c13eefa3fbf2) Thanks [@moe-dev](https://github.com/moe-dev)! - Update to endpoints as per mono v2025.5.7. Add V5 TON address format generation. Non breaking * Updated dependencies \[[`5afbe51`](https://github.com/tkhq/sdk/commit/5afbe51949bdd1997fad083a4c1e4272ff7409dc), [`40c4035`](https://github.com/tkhq/sdk/commit/40c40359ec7096d0bca39ffc93e89361b3b11a1a)]: * @turnkey/webauthn-stamper\@0.5.1 * @turnkey/encoding\@0.5.0 * @turnkey/api-key-stamper\@0.4.6 ## 3.4.0 ### Minor Changes * Added new authentication activities: * STAMP\_LOGIN: Handles authentication flows for passkeys, wallet logins, and session refresh. Initiated by sub-organizations; returns a session JWT. * INIT\_OTP: Initiates sending a 6–9 digit or bech32 alphanumeric OTP to an email or phone. Initiated by the parent organization. * VERIFY\_OTP: Verifies the OTP and returns a verification token. Initiated by the parent organization. * OTP\_LOGIN: Completes OTP-based authentication by verifying a tokenized OTP challenge and establishing a session. Initiated by the parent organization; returns a session JWT. * OAUTH\_LOGIN: Finalizes OAuth-based logins from third-party OIDC providers. Initiated by the parent organization; returns a session JWT. ## 3.3.0 ### Minor Changes * 25ca339: Adding replyToEmailAddress field for specifying reply-to when using a customer sender ## 3.2.0 ### Minor Changes * 3f6e415: Update per mono v2025.4.5 * Introduces Tron transaction parsing and policy engine support. For more information, take a look at our [docs](https://docs.turnkey.com/networks/tron) ### Patch Changes * Updated dependencies \[4d1d775] * @turnkey/api-key-stamper\@0.4.5 ## 3.1.0 ### Minor Changes * 3e4a482: Release per mono v2025.4.4 * Adds parsing and policy engine support for Ethereum Type 3 (EIP-4844) and Type 4 (EIP-7702) transactions. There is no change to any signing interface or API; you simply can now use Turnkey's signing endpoints to sign those transaction types. See [with-viem](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-viem/) for examples. * New wallet account creations will now automatically derive the underlying derived account's public key. For example: previously, if derived an Ethereum wallet account, you would get the resulting Ethereum address (`0x...`). If you also wanted the public key associated with that underlying key, you would've had to derive an additional wallet account with `ADDRESS_FORMAT_COMPRESSED`. Now, this will automatically be derived for you. It is now a property that has been added to the wallet account primitive (i.e. accessible via `walletAccount.publicKey`). ## 3.0.0 ### Major Changes * f94d36e: Remove deprecated TurnkeyApiService. TurnkeyApi should be used instead. ### Minor Changes * d1083bd: New activity `INIT_OTP_AUTH_V2` which allows alphanumeric boolean and otpLength (6-9) to be passed * This release introduces the `INIT_OTP_AUTH_V2` activity. The difference between it and `INIT_OTP_AUTH` is that it can now accept `alphanumeric` and `otpLength` for selecting crockford bech32 alphanumeric codes and the length of those codes. By default alphanumeric = true, otpLength = 9 * This release introduces `sendFromEmailSenderName` to `INIT_OTP_AUTH`, `INIT_OTP_AUTH_V2`, `EMAIL_AUTH` and `EMAIL_AUTH_V2`. This is an optional custom sender name for use with sendFromEmailAddress; if left empty, will default to 'Notifications'. ## 2.22.0 ### Minor Changes * ecdb29a: Update API as per mono v2025.3.2 * This release introduces the `CREATE_USERS_V3` activity. The difference between it and `CREATE_USERS_V2` is that it can now accept `userPhoneNumber` and `oauthProviders`. In total, it accepts the following parameters: ```javascript theme={"system"} /** @description A list of Users. */ users: { /** @description Human-readable name for a User. */ userName: string; /** @description The user's email address. */ userEmail?: string; /** @description The user's phone number in E.164 format e.g. +13214567890 */ userPhoneNumber?: string; /** @description A list of API Key parameters. This field, if not needed, should be an empty array in your request body. */ apiKeys: definitions["v1ApiKeyParamsV2"][]; /** @description A list of Authenticator parameters. This field, if not needed, should be an empty array in your request body. */ authenticators: definitions["v1AuthenticatorParamsV2"][]; /** @description A list of Oauth providers. This field, if not needed, should be an empty array in your request body. */ oauthProviders: definitions["v1OauthProviderParams"][]; /** @description A list of User Tag IDs. This field, if not needed, should be an empty array in your request body. */ userTags: string[]; } ``` See [source code](https://github.com/tkhq/sdk/blob/60c0c03440785b841d1f6f393612046423dc665f/packages/http/src/__generated__/services/coordinator/public/v1/public_api.types.ts#L2894-L2909) to view details on the nested types. ## 2.21.0 ### Minor Changes * 56a307e: Update API to mono v2025.3.0 * This release introduces an `invalidateExisting` flag to the `CreateReadWriteSession` and `Oauth` activities. If enabled, this will invalidate existing read-write and oauth API keys. This is useful in scenarios where a user attempts to create numerous `ReadWrite` or `Oauth` sessions. Because our API caps the number of session keys associated with a user, this flag can clear all other existing session keys of that specific type (e.g. setting `invalidateExisting: true` for `CreateReadWriteSession` will invalidate all previously created read-write session keys) ## 2.20.0 ### Minor Changes * 3c44c4a: Updates per mono release v2025.2.2 ## 2.19.0 ### Minor Changes * 57f9cb0: Update endpoints - surface `GetWalletAccount`. This endpoint takes in the following args: ```javascript theme={"system"} /** @description Unique identifier for a given Organization. */ organizationId: string; /** @description Unique identifier for a given Wallet. */ walletId: string; /** @description Address corresponding to a Wallet Account. */ address?: string; /** @description Path corresponding to a Wallet Account. */ path?: string; ``` ## 2.18.0 ### Minor Changes * 6695af2: Update per mono release v2025.1.11 ## 2.17.3 ### Patch Changes * 053fbfb: Update mono dependencies ## 2.17.2 ### Patch Changes * Updated dependencies \[2d5977b] * @turnkey/api-key-stamper\@0.4.4 ## 2.17.1 ### Patch Changes * 538d4fc: Update api endpoints - NEW: User verification, SMS customization params ## 2.17.0 ### Minor Changes * 78bc39c: Add default accounts for various address types * Add wallet account ID to list wallets endpoint ## 2.16.0 ### Minor Changes * 4df8914: Version bump corresponding to mono release v2024.10.10. * Improved error message for duplicate activity submission * Address derivation support for DOGE, TON, SEI, XLM * Fix server side error if sub\_org doesn’t have email and/or phone number ## 2.15.0 ### Minor Changes * 9ebd062: Release OTP functionality ## 2.14.2 ### Patch Changes * 96d7f99: Update dependencies * Updated dependencies \[e5c4fe9] * @turnkey/encoding\@0.4.0 * @turnkey/api-key-stamper\@0.4.3 ## 2.14.1 ### Patch Changes * ff059d5: Update dependencies * Updated dependencies \[93666ff] * @turnkey/encoding\@0.3.0 * @turnkey/api-key-stamper\@0.4.2 ## 2.14.0 ### Minor Changes * 848f8d3: Add new helpers and update types and errors * `getSignatureFromActivity` returns the signature corresponding to a completed activity * `getSignedTransactionFromActivity` returns the signed transaction corresponding to a completed activity * `assertActivityCompleted` checks the state of an activity and throws an error if the activity either requires consensus or is otherwise not yet completed * `TERMINAL_ACTIVITY_STATUSES` is a const containing all terminal activity statuses. Useful for checking on an activity * `TurnkeyActivityError` now uses `undefined` instead of `null` * Export some additional types: `TActivity`, `TActivityId`, `TActivityStatus`, `TActivityType` ## 2.13.0 ### Minor Changes * 93dee46: Add create read write session v2 which allows for user targeting directly from stamp or optional userId in intent ## 2.12.3 ### Patch Changes * e2f2e0b: Added two new endpoints for deleting private keys and deleting wallets ## 2.12.2 ### Patch Changes * 2d7e5a9: fix a (currently unused) return value * Updated dependencies * @turnkey/api-key-stamper\@0.4.1 * @turnkey/encoding\@0.2.1 ## 2.12.1 ### Patch Changes * f17a229: Update to oauth related endpoints to drop jwks uri from oauth providers ## 2.12.0 ### Minor Changes * Add Email Auth V2 - Optional invalidate exisiting Email Authentication API keys ## 2.11.0 ### Minor Changes * Update to use new endpoints. Including CREATE\_READ\_WRITE\_SESSION which allows one shot passkey sessions (returns org information and a credential bundle) and CREATE\_API\_KEYS\_V2 which allows a curve type to be passed (SECP256K1 or P256) ## 2.10.0 ### Minor Changes * 7a9ce7a: Sync 2024.3.16 ## 2.9.1 ### Patch Changes * Update generated files to latest release: optional pagination options were added to list sub-organization and list wallet account endpoints. ## 2.9.0 ### Minor Changes * 83b62b5: Sync types for latest release ## 2.8.0 ### Minor Changes * 46a7d90: Update to v2024.2.1 API: add activities to initialize wallet import, import wallet, delete users, delete private key tags, delete user tags, and list sub-organizations ## 2.7.1 ### Patch Changes * Update to v2024.2.0 API types: `mnemonicLength` is now a number instead of a string ## 2.7.0 ### Minor Changes * Introduce and reference `@turnkey/encoding` to consolidate utility functions * Updated dependencies (\[c3b423b], \[d73725b]) * @turnkey/webauthn-stamper\@0.5.0 * @turnkey/api-key-stamper\@0.4.0 * @turnkey/encoding\@0.1.0 ## 2.6.2 ### Patch Changes * b45a9ac: Include package version in request headers * f9d636c: Export VERSION from turnkey/http ## 2.6.1 ### Patch Changes * 52e2389: Revert version export (#186 and #187) ## 2.6.0 ### Minor Changes * 0794f41: Add VERSION constant * 7a3c890: Add key export support ### Patch Changes * 4517e3b: Update version string to include package name ## 2.5.1 ### Patch Changes * Upgrade to Node v18 (#184) * Updated dependencies * @turnkey/webauthn-stamper\@0.4.3 * @turnkey/api-key-stamper\@0.3.1 ## 2.5.0 ### Minor Changes * 464ac0e: Update protos for latest release, which includes: * Support optional expirations for API keys, configurable via the `expirationSeconds` parameter. * Support Email Auth. Details to follow ⚡️ ## 2.4.2 ### Patch Changes * Updated dependencies \[a03e385] * @turnkey/webauthn-stamper\@0.4.2 ## 2.4.1 ### Patch Changes * Fix universal files to stop using `require`. Use ES6 imports instead (#178) * Updated dependencies \[f87ced8] * @turnkey/webauthn-stamper\@0.4.1 ## 2.4.0 ### Minor Changes * Use rollup to build ESM and CommonJS, fix ESM support (#174) ### Patch Changes * Updated dependencies \[fc5b291] * @turnkey/api-key-stamper\@0.3.0 * @turnkey/webauthn-stamper\@0.4.0 ## 2.3.1 ### Patch Changes * Updated dependencies * @turnkey/api-key-stamper\@0.2.0 ## 2.3.0 ### Minor Changes * Sync protos from latest public endpoints ## 2.2.0 ### Minor Changes * Add ESM to package dist (#154) ### Patch Changes * ed50a0f: simplify types ## 2.1.0 ### Minor Changes * bb6ea0b: Update generated files * new query endpoints to retrieve wallets (`/public/v1/query/list_wallets`) * new query endpoint to retrieve wallet accounts (`/public/v1/query/list_wallet_accounts`) ## 2.0.0 ### Major Changes * Synced protos from mono ### Upgrade notes * `signRawPayload` and `signTransaction` now expect a `signWith` param instead of `privateKeyId` previously * `signRawPayload` and `signTransaction` have been updated to expect a new type: `ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2` and `ACTIVITY_TYPE_SIGN_TRANSACTION_V2`, respectively * If you have policies authorizing `ACTIVITY_TYPE_SIGN_RAW_PAYLOAD` or `ACTIVITY_TYPE_SIGN_TRANSACTION` specifically, they will need to be updated to authorize `ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2` and `ACTIVITY_TYPE_SIGN_TRANSACTION_V2` (or better yet, update your policies to allow all signing actions categorically using policy resources and actions. See [https://docs.turnkey.com/managing-policies/examples](https://docs.turnkey.com/managing-policies/examples)) * `createSubOrganization` now uses `ACTIVITY_TYPE_CREATE_SUB_ORGANIZATION_V4` under the hood, which utilizes wallets. The shape of the request has been updated to include the following parameter, `wallet`. Here's an example: ```js theme={"system"} { ... wallet: { walletName: "Default Wallet", accounts: [ { curve: "CURVE_SECP256K1", pathFormat: "PATH_FORMAT_BIP32", path: "m/44'/60'/0'/0/0", addressFormat: "ADDRESS_FORMAT_ETHEREUM", }, ], }, } ``` See [https://docs.turnkey.com/concepts/sub-organizations](https://docs.turnkey.com/concepts/sub-organizations) for more details. ## 1.3.0 ### Minor Changes * Synced protos from mono * Adds base URL check during initialization (closes [https://github.com/tkhq/sdk/issues/124](https://github.com/tkhq/sdk/issues/124)) * The following are new features additions, fresh out the oven. Still getting them ready for primetime! Refreshed examples to come soon™️. Stay tuned and reach out to the Turnkey team if you have any questions. * Wallets: * 🟢 `ACTIVITY_TYPE_CREATE_WALLET` (via `/api/v1/submit/create_wallet`): create a HD wallet * 🟢 `ACTIVITY_TYPE_CREATE_WALLET_ACCOUNTS` (via `/api/v1/submit/create_wallet_accounts`): create a wallet account (address) * 🟢 `ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2` (via `/api/v1/submit/sign_raw_payload_v2`): sign a payload with a specified private key or address * 🟢 `ACTIVITY_TYPE_SIGN_TRANSACTION_V2` (via `/api/v1/submit/sign_transaction_v2`): sign a transaction with a specified private key or address * Organization features: * 🟢 `ACTIVITY_TYPE_SET_ORGANIZATION_FEATURE` (via `/api/v1/submit/set_organization_feature`): set an organization feature * 🟢 `ACTIVITY_TYPE_REMOVE_ORGANIZATION_FEATURE` (via `/api/v1/submit/remove_organization_feature`): remove an organization feature * Only one feature supported as of this time; additional documentation to follow. * Export private key: * 🟡 `ACTIVITY_TYPE_EXPORT_PRIVATE_KEY` (via `/api/v1/submit/export_private_key`): export a private key, encrypted to a target public key. We do not yet have CLI or front-end tooling to use this safely; stay tuned! * Email recovery: * 🟡 `ACTIVITY_TYPE_INIT_USER_EMAIL_RECOVERY` (via `/api/v1/submit/init_user_email_recovery`): initialize a new email recovery flow Note: * 🟢: good to go! * 🟡: these endpoints are safe to use, but still experimental/unstable. Check back for updates and guidance. ### Patch Changes * Updated dependencies * @turnkey/webauthn-stamper\@0.2.0 ## 1.2.0 ### Minor Changes * The `createSubOrganization` request has been updated under the hood: * Calling `.createSubOrganization` on our HTTP client will trigger an activity of type `CREATE_SUB_ORGANIZATION_V3` instead of `CREATE_SUB_ORGANIZATION_V2` previously. * If there are any policies referencing `CREATE_SUB_ORGANIZATION_V2` specifically, they will no longer work out of the box if creating sub-orgs via SDK. These policies will need to be updated to allow `CREATE_SUB_ORGANIZATION_V3`. See policy examples related to access control [here](https://docs.turnkey.com/managing-policies/examples#access-control) for additional methods of constructing policies. * `CREATE_SUB_ORGANIZATION_V3` supports everything `CREATE_SUB_ORGANIZATION_V2` supports, with the addition of a `privateKeys` field to atomically create a sub-org with private keys. If no private keys are desired, simply provide an empty array. * **NOTE**: when reading `createSubOrganization` results, SDK users will now need to look at `activity.result.createSubOrganizationResultV3` instead of the previously valid `activity.result.createSubOrganizationResult`. ## 1.1.1 ### Patch Changes * Updated dependencies * @turnkey/api-key-stamper\@0.1.1 ## 1.1.0 ### Minor Changes New exports: * new `TurnkeyClient`. This is now the preferred interface to make Turnkey requests, because it supports both API keys and webauthn-signed requests. It also doesn't rely on global initialization * new method to poll requests: `createActivityPoller` Deprecation notices: * deprecate `TurnkeyApi` (use `TurnkeyClient` instead), `init`, `browserInit` (no need for them anymore if you're using `TurnkeyClient`), and `withAsyncPolling` (use `createActivityPoller` instead) * deprecate `SignedRequest` in favor of `TSignedRequest`. Besides the more correct name, `TSignedRequest` differs in its `stamp` property. It now stores the stamper header name as well as value, so users do not have to hardcode Turnkey stamp header names (e.g. "X-Stamp-Webauthn"). Update our swagger and generated files to latest versions: * new endpoint to update users: `/public/v1/submit/update_user` * pagination `limit` option has been updated to `string` instead of number for consistency with other pagination options Signing is now performed through Turnkey stampers. New dependencies: * @turnkey/webauthn-stamper\@0.1.0 * @turnkey/api-key-stamper\@0.1.0 ## 1.0.1 ### Patch Changes * 8d1d0e8: Synced protos from mono ## 1.0.0 ### Major Changes * 46473ec: This breaking change updates generated code to be shorter and more intuitive to read: * generated fetchers do not include the HTTP method in their name. For example `useGetGetActivity` is now `useGetActivity`, and `usePostSignTransaction` is `useSignTransaction`. * input types follow the same convention (no HTTP method in the name): `TPostCreatePrivateKeysInput` is now `TCreatePrivateKeysInput`. * the "federated" request helpers introduced in `0.18.0` are now named "signed" requests to better reflect what they are. `FederatedRequest` is now `SignedRequest`, and generated types follow. For example: `federatedPostCreatePrivateKeys` is now `signCreatePrivateKeys`, `federatedGetGetActivity` is now `signGetActivity`, and so on. The name updates should be automatically suggested if you use VSCode since the new names are simply shorter versions of the old one. ### Patch Changes * 38b424f: Sync public api types ## 0.18.1 ### Patch Changes * Synced protos from mono ## 0.18.0 ### Minor Changes * Add support for federated requests (an example is included under `sdk/examples/authentication/with-federated-passkeys`) * Routine re-sync protos from mono ## 0.17.1 ### Patch Changes * Re-sync protos from mono. No public-facing changes. ## 0.17.0 ### Minor Changes * Added support for ed25519 * New endpoint to programmatically approve or reject activities (`/submit/approve_activity`, `/submit/reject_activity`) * New endpoint to programmatically create authenticators (`/submit/create_authenticators`) * New endpoints to update Private Key tags (`/submit/update_private_key_tag`) * New endpoints to update User tags (`/submit/update_user_tag`) * Simplified shape for `AuthenticatorParams` with a new `AuthenticatorParamsV2`. To take advantage of this new shape, use `ACTIVITY_TYPE_CREATE_USERS_V2` and the new `ACTIVITY_TYPE_CREATE_AUTHENTICATORS`. ## 0.16.0 ### Minor Changes * Fix `.postGetPrivateKey(...)`'s underlying path, while adding `@deprecated` `.postGetPrivateKeyBackwardsCompat(...)` for backward compatibility ## 0.15.0 ### Minor Changes * Export a new helper for offline request signing: `sealAndStampRequestBody(...)`. ## 0.14.0 ### Minor Changes * Updated the `addressFormats` enum field in `/submit/create_private_keys` ## 0.13.2 ### Patch Changes * New `TurnkeyRequestError` error class that contains rich error details ## 0.13.1 ### Patch Changes * Error messages now contain Turnkey-specific error details ## 0.13.0 ### Minor Changes * New `/submit/create_api_only_users` endpoint: `TurnkeyApi.postCreateApiOnlyUsers(...)` * Marked `TurnkeyApi.postCreateUsers(...)` as deprecated * Improved documentation on methods (via TSDoc) ## 0.12.0 ### Minor Changes * Error messages now contain Turnkey-specific error code and message ## 0.11.0 ### Minor Changes * New `/submit/create_users` endpoint: `TurnkeyApi.postCreateUsers(...)` ## 0.10.0 ### Minor Changes * No public-facing changes ## 0.9.0 ### Minor Changes * Improved support for React Native runtime ([https://github.com/tkhq/sdk/pull/37](https://github.com/tkhq/sdk/pull/37)) ## 0.8.1 ### Patch Changes * Switched from `undici` to `cross-fetch` to improve bundler compatibility ## 0.8.0 ### Minor Changes * Added browser runtime support — `@turnkey/http` is now a universal (isomorphic) package * The API fetchers are now exported as namespace `TurnkeyApi`. `PublicApiService` has been marked as deprecated, but will remain functional until we hit v1.0. * Dropped support for Node.js v14; we recommend using Node v18+ ## 0.7.0 ### Minor Changes * Improved documentation * Added `withAsyncPolling(...)` helper to provide built-in async polling support. Read more: * [https://github.com/tkhq/sdk/tree/main/packages/http#withasyncpolling-helper](https://github.com/tkhq/sdk/tree/main/packages/http#withasyncpolling-helper) ## 0.6.0 ### Minor Changes * Improved OpenAPI documentation ## 0.5.0 ### Minor Changes * Arbitrary message signing ## 0.4.0 ### Minor Changes * `timestamp` -> `timestampMs` ## 0.3.1 ### Patch Changes * Fix outdated artifact ## 0.3.0 ### Minor Changes * `keyId` -> `privateKeyId` everywhere ## 0.2.0 ### Minor Changes * Change parameter from `keyId` to `privateKeyId` * Bump API version to latest Beta ## 0.1.3 ### Patch Changes * Support runtime config for credentials ## 0.1.2 ### Patch Changes * Drop internal dev dependency ## 0.1.1 ### Patch Changes * Initial release * Updated dependencies * @turnkey/jest-config\@0.1.1 # Iframe Stamper Source: https://docs.turnkey.com/changelogs/iframe-stamper/readme # @turnkey/iframe-stamper ## 2.11.0 ### Minor Changes * [#1200](https://github.com/tkhq/sdk/pull/1200) [`207fc93`](https://github.com/tkhq/sdk/commit/207fc932374a8362ec6f803ac0a67c2e5dbfc29e) Author [@ethankonk](https://github.com/ethankonk) - Added the ability to override the iframe's embedded key pair using a Turnkey P256 private key exported and encrypted to the iframe's embedded key pair. ## 2.10.0 ### Minor Changes * [#1126](https://github.com/tkhq/sdk/pull/1126) [`fb0ff3e`](https://github.com/tkhq/sdk/commit/fb0ff3e38e061c48f01b35c44294f4549b61d61d) Author [@ethankonk](https://github.com/ethankonk) - Added Bitcoin WIF & Sui Bech32 private key formats to import/export with iframe flows ## 2.9.0 ### Minor Changes * [#1104](https://github.com/tkhq/sdk/pull/1104) [`850a3ee`](https://github.com/tkhq/sdk/commit/850a3ee5dbb5e2cc46bda50348c917c555e55f73) Author [@ethankonk](https://github.com/ethankonk) - Added ability to toggle passphrase input for the import iframe ## 2.8.0 ### Minor Changes * [#1103](https://github.com/tkhq/sdk/pull/1103) [`7ac558c`](https://github.com/tkhq/sdk/commit/7ac558c39c3fa0ddeb6e695182a49f03ee6d4f00) Author [@andrewkmin](https://github.com/andrewkmin) - Add optional address parameter for methods intended to be used within the export-and-sign iframe. Also improves documentation (TypeDocs) ## 2.7.1 ### Patch Changes * [#1086](https://github.com/tkhq/sdk/pull/1086) [`2fd1d55`](https://github.com/tkhq/sdk/commit/2fd1d5555dd358a1c0210ca65fd6ca70ff172058) Author [@amircheikh](https://github.com/amircheikh) - Updated `TIframeStamperConfig` to include `clearClipboardOnPaste`. Defaulting to true, this will grant the iframe `clipboard-write` permissions. Allows clipboard to be cleared after pasting in secrets to import. ## 2.7.0 ### Minor Changes * [#945](https://github.com/tkhq/sdk/pull/945) [`e76d2bf`](https://github.com/tkhq/sdk/commit/e76d2bfbe3fb481aedac9b992260c50217823e8a) Author [@andrewkmin](https://github.com/andrewkmin) - Pressure-test and add the following functionality: `signMessage`, `signTransaction`, `clearEmbeddedPrivateKey`. Each of these are to be used in very specific scenarios where we want to perform operations with a decrypted key living in an iframe. ## 2.6.0 ## 2.6.0-beta.0 ### Minor Changes * SDK beta release @turnkey/react-wallet-kit @turnkey/core ## 2.5.0 ### Minor Changes * e501690: Add new utility functions * Add `clearEmbeddedKey()` async function, which clears the embedded key within an iframe * Add `initEmbeddedKey()` async function, which reinitializes the embedded key within an iframe ## 2.4.0 ### Minor Changes * a833088: Add `getEmbeddedPublicKey()` async function to get the public key of the live embedded key within the iframe ## 2.3.0 ### Minor Changes * 9147962: Add `dangerouslyOverrideIframeKeyTtl` option to override iframe embedded key TTL (for longer lived read/write sessions) ## 2.2.0 ### Minor Changes * a216a47: Add `requestId` to iframe requests. This allows developers to send multiple requests at once to an iframe, and have the corresponding responses be handled correctly (in order) ## 2.1.0 ### Minor Changes * fad7c37: `@turnkey/iframe-stamper` - Implemented MessageChannel API for secure communication between the parent and iframe. @turnkey/sdk-browser - fixed spelling in package.json @turnkey/sdk-server - fixed spelling in package.json ## 2.0.0 ### Major Changes * 5d0bfde: Include `organizationId` and `userId` in injected import and export bundles. ### Minor Changes * 2f2d09a: Add implementation for `applySettings()` * This is a function to apply settings on allowed parameters in the iframe. * Ultimately, this is used to style the HTML element used for plaintext in wallet and private key import. ### Patch Changes * 976663e: Add `sandbox` attribute to iframe element ## 1.2.0 ### Minor Changes * 0281b88: Remove optional publicKey parameter from injectKeyExportBundle. * 0e3584a: Add optional keyFormat and publicKey parameters to injectKeyExportBundle. Add extractKeyEncryptedBundle. ## 1.1.0 ### Minor Changes * 46a7d90: Add injectImportBundle and extractWalletEncryptedBundle to support wallet import. ## 1.0.0 ### Major Changes * This breaking change uses an HTML element instead of an ID to reference the iframe's container. ## 0.4.1 ### Patch Changes * Upgrade to Node v18 (#184) ## 0.4.0 ### Minor Changes * c98c222: - Add support for auth (e.g. via email), and include recovery under it. Note that the preferred path is now to use `injectCredentialBundle`, as opposed to `injectRecoveryBundle` (deprecated). ## 0.3.0 ### Minor Changes * Use rollup to build ESM and CommonJS, fix ESM support (#174) ## 0.2.1 ### Patch Changes * Catch and bubble up errors in the underlying iframe by listening to `ERROR` events (#165) ## 0.2.0 ### Minor Changes * Support wallet and private key export ## 0.1.0 Initial release # React Native Passkey Stamper Source: https://docs.turnkey.com/changelogs/react-native-passkey-stamper/readme # @turnkey/react-native-passkey-stamper ## 1.2.11 ### Patch Changes * Updated dependencies \[]: * @turnkey/http\@3.17.1 ## 1.2.10 ### Patch Changes * Updated dependencies \[[`1f6e240`](https://github.com/tkhq/sdk/commit/1f6e2403fca1fd9cbca646f88c88dbc49ddb0c34), [`58e04e5`](https://github.com/tkhq/sdk/commit/58e04e5856626d9d2593abb61d8ca32d8ccbb833), [`7458b7c`](https://github.com/tkhq/sdk/commit/7458b7cd6fc64796b376e3374b7c2ed79467459c)]: * @turnkey/http\@3.17.0 ## 1.2.9 ### Patch Changes * Updated dependencies \[[`dced9db`](https://github.com/tkhq/sdk/commit/dced9dbbd8ea533442e19e45ce36e6a05a45a555)]: * @turnkey/http\@3.16.3 ## 1.2.8 ### Patch Changes * Updated dependencies \[]: * @turnkey/http\@3.16.2 ## 1.2.7 ### Patch Changes * Updated dependencies \[]: * @turnkey/http\@3.16.1 ## 1.2.6 ### Patch Changes * Updated dependencies \[[`78ec1d9`](https://github.com/tkhq/sdk/commit/78ec1d9afcafde3ca7107fc720323d486d6afaea)]: * @turnkey/http\@3.16.0 ## 1.2.5 ### Patch Changes * Updated dependencies \[[`67b03a5`](https://github.com/tkhq/sdk/commit/67b03a5d9ab1b6eabfb0b41938ac91365b5dcd9b)]: * @turnkey/http\@3.15.0 ## 1.2.4 ### Patch Changes * Updated dependencies \[[`9fbd5c4`](https://github.com/tkhq/sdk/commit/9fbd5c459782dc3721dd0935d0a4458babce258b)]: * @turnkey/http\@3.14.0 ## 1.2.3 ### Patch Changes * [#1015](https://github.com/tkhq/sdk/pull/1015) [`429e4c4`](https://github.com/tkhq/sdk/commit/429e4c4b5d897a7233584d4ec429b21bba7a1f2b) Author [@moeodeh3](https://github.com/moeodeh3) - Update react-native-passkey to the include the latest version for Expo 54 compatibility * Updated dependencies \[[`9df42ad`](https://github.com/tkhq/sdk/commit/9df42adc02c7ff77afba3b938536e79b57882ef1)]: * @turnkey/http\@3.13.1 ## 1.2.2 ### Patch Changes * Updated dependencies \[[`4567059`](https://github.com/tkhq/sdk/commit/45670598f102223925b87a5295edca15a6ce8241)]: * @turnkey/http\@3.13.0 ## 1.2.1 ### Patch Changes * Updated dependencies \[[`5a96fe8`](https://github.com/tkhq/sdk/commit/5a96fe80db4c4c45e09ad8c613695ee4c2b8e51f)]: * @turnkey/http\@3.12.1 ## 1.2.0 ### Minor Changes * Updated dependencies \[[`fc1d6e2`](https://github.com/tkhq/sdk/commit/fc1d6e2d26f4a53116633e9e8cccccd792267f4e), [`fc1d6e2`](https://github.com/tkhq/sdk/commit/fc1d6e2d26f4a53116633e9e8cccccd792267f4e), [`4880f26`](https://github.com/tkhq/sdk/commit/4880f26a4dd324c049bff7f35284098ccfc55823), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`06347ad`](https://github.com/tkhq/sdk/commit/06347adfa08fb0867c350e43821d0fed06c49624), [`6bfcbc5`](https://github.com/tkhq/sdk/commit/6bfcbc5c098e64ab1d115518733b87cfc1653e17)]: * @turnkey/encoding\@0.6.0 * @turnkey/http\@3.12.0 ## 1.2.0-beta.1 ### Patch Changes * Updated dependencies \[]: * @turnkey/encoding\@0.6.0-beta.6 * @turnkey/http\@3.11.1-beta.0 ## 1.2.0-beta.0 ### Minor Changes * SDK beta release @turnkey/react-wallet-kit @turnkey/core ### Patch Changes * Updated dependencies \[]: * @turnkey/encoding\@0.6.0-beta.5 * @turnkey/http\@3.10.0-beta.2 ## 1.1.4 ### Patch Changes * Updated dependencies \[[`026264c`](https://github.com/tkhq/sdk/commit/026264c55aa16342c8925af0bdcdf72dc00e5158)]: * @turnkey/http\@3.11.0 ## 1.1.3 ### Patch Changes * Updated dependencies \[[`5d8be2d`](https://github.com/tkhq/sdk/commit/5d8be2d0329070c7aa025dddb1b28f04257ae4e6)]: * @turnkey/http\@3.10.0 ## 1.1.2-beta.4 ### Patch Changes * Updated dependencies \[]: * @turnkey/encoding\@0.6.0-beta.4 * @turnkey/http\@3.10.0-beta.1 ## 1.1.2-beta.3 ### Patch Changes * Updated dependencies \[]: * @turnkey/encoding\@0.6.0-beta.3 * @turnkey/http\@3.10.0-beta.0 ## 1.1.2-beta.2 ### Patch Changes * Updated dependencies \[]: * @turnkey/encoding\@0.6.0-beta.2 * @turnkey/http\@3.8.1-beta.2 ## 1.1.2-beta.1 ### Patch Changes * Updated dependencies \[]: * @turnkey/encoding\@0.6.0-beta.1 * @turnkey/http\@3.8.1-beta.1 ## 1.1.2-beta.0 ### Patch Changes * Updated dependencies \[]: * @turnkey/encoding\@1.0.0-beta.0 * @turnkey/http\@3.8.1-beta.0 ## 1.1.2 ### Patch Changes * Updated dependencies \[[`8b39dba`](https://github.com/tkhq/sdk/commit/8b39dbabf68d3e376b5b07f26960d5b61ae87fa9)]: * @turnkey/http\@3.9.0 ## 1.1.1 ### Patch Changes * Updated dependencies \[[`f83f25b`](https://github.com/tkhq/sdk/commit/f83f25ba33ef15dbd66723531eebe2fd00f43ac0)]: * @turnkey/http\@3.8.0 ## 1.1.0 ### Minor Changes * [#651](https://github.com/tkhq/sdk/pull/651) [`81e355c`](https://github.com/tkhq/sdk/commit/81e355c9a8321feffcac056916b65139cf35eeed) Author [@turnekybc](https://github.com/turnekybc) - Add Coinbase & MoonPay Fiat Onramp. View the [Fiat Onramp feature docs](https://docs.turnkey.com/wallets/fiat-on-ramp). ### Patch Changes * Updated dependencies \[[`81e355c`](https://github.com/tkhq/sdk/commit/81e355c9a8321feffcac056916b65139cf35eeed)]: * @turnkey/http\@3.7.0 ## 1.0.19 ### Patch Changes * Updated dependencies \[[`e90a478`](https://github.com/tkhq/sdk/commit/e90a478c9208d858b1144df9b2c2c7ba956c406e)]: * @turnkey/http\@3.6.0 ## 1.0.18 ### Patch Changes * Updated dependencies \[[`cb13c26`](https://github.com/tkhq/sdk/commit/cb13c26edb79a01ab651e3b2897334fd154b436a)]: * @turnkey/http\@3.5.1 ## 1.0.17 ### Patch Changes * Updated dependencies \[[`5f3dd98`](https://github.com/tkhq/sdk/commit/5f3dd9814650308b3bf3198168c453e7b1a98efd)]: * @turnkey/http\@3.5.0 ## 1.0.16 ### Patch Changes * Updated dependencies \[[`be0a621`](https://github.com/tkhq/sdk/commit/be0a621fb962bd51d2df1a1e79f5260d7c696772)]: * @turnkey/http\@3.4.2 ## 1.0.15 ### Patch Changes * Updated dependencies \[[`40c4035`](https://github.com/tkhq/sdk/commit/40c40359ec7096d0bca39ffc93e89361b3b11a1a), [`593de2d`](https://github.com/tkhq/sdk/commit/593de2d9404ec8cf53426f9cf832c13eefa3fbf2)]: * @turnkey/encoding\@0.5.0 * @turnkey/http\@3.4.1 ## 1.0.14 ### Patch Changes * Updated dependencies \[[`07dfd33`](https://github.com/tkhq/sdk/commit/07dfd3397472687092e1c73b1d68714f421b9ca0)]: * @turnkey/http\@3.4.0 ## 1.0.13 ### Patch Changes * Updated dependencies \[25ca339] * @turnkey/http\@3.3.0 ## 1.0.12 ### Patch Changes * Updated dependencies \[3f6e415] * @turnkey/http\@3.2.0 ## 1.0.11 ### Patch Changes * Updated dependencies \[3e4a482] * @turnkey/http\@3.1.0 ## 1.0.10 ### Patch Changes * Updated dependencies \[d1083bd] * Updated dependencies \[f94d36e] * @turnkey/http\@3.0.0 ## 1.0.9 ### Patch Changes * Updated dependencies \[ecdb29a] * @turnkey/http\@2.22.0 ## 1.0.8 ### Patch Changes * Updated dependencies \[56a307e] * @turnkey/http\@2.21.0 ## 1.0.7 ### Patch Changes * Updated dependencies \[3c44c4a] * @turnkey/http\@2.20.0 ## 1.0.6 ### Patch Changes * Updated dependencies \[57f9cb0] * @turnkey/http\@2.19.0 ## 1.0.5 ### Patch Changes * Updated dependencies \[6695af2] * @turnkey/http\@2.18.0 ## 1.0.4 ### Patch Changes * Updated dependencies \[053fbfb] * @turnkey/http\@2.17.3 ## 1.0.3 ### Patch Changes * @turnkey/http\@2.17.2 ## 1.0.2 ### Patch Changes * Updated dependencies \[538d4fc] * @turnkey/http\@2.17.1 ## 1.0.1 ### Patch Changes * Updated dependencies \[78bc39c] * @turnkey/http\@2.17.0 ## 1.0.0 ### Major Changes Upgrade react-native-passkey to 3.0.0 (see [release notes](https://github.com/f-23/react-native-passkey/releases/tag/v3.0.0)). Among other things you can now specify `withSecurityKey` and `withPlatformKey` (new optional arguments to `createPasskey`) to target platform passkeys or security keys on iOS. The same options can be passed as configuration to `PasskeyStamper` to target these features at authentication time. This is a major change because the `transports` property, previously a string array (`Array`) is now an array of enums (`Array`). ## 0.2.16 ### Patch Changes * Updated dependencies \[4df8914] * @turnkey/http\@2.16.0 ## 0.2.15 ### Patch Changes * Updated dependencies \[9ebd062] * @turnkey/http\@2.15.0 ## 0.2.14 ### Patch Changes * Updated dependencies \[e5c4fe9] * Updated dependencies \[96d7f99] * @turnkey/encoding\@0.4.0 * @turnkey/http\@2.14.2 ## 0.2.13 ### Patch Changes * Updated dependencies \[ff059d5] * Updated dependencies \[93666ff] * @turnkey/http\@2.14.1 * @turnkey/encoding\@0.3.0 ## 0.2.12 ### Patch Changes * Updated dependencies \[848f8d3] * @turnkey/http\@2.14.0 ## 0.2.11 ### Patch Changes * Updated dependencies \[93dee46] * @turnkey/http\@2.13.0 ## 0.2.10 ### Patch Changes * Updated dependencies \[e2f2e0b] * @turnkey/http\@2.12.3 ## 0.2.9 ### Patch Changes * Updated dependencies * @turnkey/encoding\@0.2.1 * @turnkey/http\@2.12.2 ## 0.2.8 ### Patch Changes * Updated dependencies \[f17a229] * @turnkey/http\@2.12.1 ## 0.2.7 ### Patch Changes * Updated dependencies * @turnkey/http\@2.12.0 ## 0.2.6 ### Patch Changes * Updated dependencies * @turnkey/http\@2.11.0 ## 0.2.5 ### Patch Changes * Updated dependencies \[7a9ce7a] * @turnkey/http\@2.10.0 ## 0.2.4 ### Patch Changes * Updated dependencies * @turnkey/http\@2.9.1 ## 0.2.3 ### Patch Changes * Updated dependencies \[83b62b5] * @turnkey/http\@2.9.0 ## 0.2.2 ### Patch Changes * Updated dependencies \[46a7d90] * @turnkey/http\@2.8.0 ## 0.2.1 ### Patch Changes * Updated dependencies * @turnkey/http\@2.7.1 ## 0.2.0 ### Minor Changes * Introduce `@turnkey/encoding` to consolidate utility functions * Updated dependencies \[d73725b] * @turnkey/encoding\@0.1.0 * @turnkey/http\@2.7.0 ## 0.1.0 Initial release # React Wallet Kit Source: https://docs.turnkey.com/changelogs/react-wallet-kit/readme # @turnkey/react-wallet-kit ## 1.10.0 ### Minor Changes * [#1228](https://github.com/tkhq/sdk/pull/1228) [`1d108d6`](https://github.com/tkhq/sdk/commit/1d108d6496ad8266db0e997a27aecc81e46008fb) Thanks [@moe-dev](https://github.com/moe-dev)! - This branch adds first-class ERC20 transfer abstractions across `@turnkey/core`, `@turnkey/react-wallet-kit`, and `@turnkey/react-native-wallet-kit`. ### `@turnkey/core` * Added `Erc20Transfer` and `EthSendErc20TransferParams` method types. * Added `TurnkeyClient.ethSendErc20Transfer(...)` as a convenience wrapper that ABI-encodes `transfer(address,uint256)` and submits via `ethSendTransaction`. * Updated `ethSendTransaction` to stop prefetching nonces with `getNonces`; transaction fields are now forwarded directly to Turnkey's coordinator (including optional caller-provided `nonce` / `gasStationNonce`). ### `@turnkey/react-wallet-kit` * Added low-level `ethSendErc20Transfer(...)` passthrough in the client provider context. * Added `handleSendErc20Transfer(...)` modal flow that submits ERC20 transfers and polls transaction status to terminal state. * Added new public types/docs for `HandleSendErc20TransferParams` and `ClientContextType.handleSendErc20Transfer`. ### `@turnkey/react-native-wallet-kit` * Added low-level `ethSendErc20Transfer(...)` passthrough in `TurnkeyProvider` context to match `ClientContextType` and support ERC20 sends from React Native. ### Patch Changes * Updated dependencies \[[`82dc76c`](https://github.com/tkhq/sdk/commit/82dc76c7ce51e5375570bbffab32eb739af90381), [`1d108d6`](https://github.com/tkhq/sdk/commit/1d108d6496ad8266db0e997a27aecc81e46008fb), [`dfdd864`](https://github.com/tkhq/sdk/commit/dfdd8647266fdd0297aaea32046ee815ae8fc27c)]: * @turnkey/core\@1.13.0 * @turnkey/sdk-types\@0.12.1 ## 1.9.0 ### Minor Changes * [#1204](https://github.com/tkhq/sdk/pull/1204) [`389a75a`](https://github.com/tkhq/sdk/commit/389a75af8539570a663df366d61ccc7fd390c414) Author [@radusandor](https://github.com/radusandor) - Fix swapped JSDoc comments for handleUpdateUserEmail and handleUpdateUserName ### Patch Changes * [#1197](https://github.com/tkhq/sdk/pull/1197) [`7458b7c`](https://github.com/tkhq/sdk/commit/7458b7cd6fc64796b376e3374b7c2ed79467459c) Thanks [@moe-dev](https://github.com/moe-dev)! - Add support for SolSendTransaction and associated abstractions * Updated dependencies \[[`af6262f`](https://github.com/tkhq/sdk/commit/af6262f31e1abb3090fcda1eec5318056e6d51fe), [`1f6e240`](https://github.com/tkhq/sdk/commit/1f6e2403fca1fd9cbca646f88c88dbc49ddb0c34), [`58e04e5`](https://github.com/tkhq/sdk/commit/58e04e5856626d9d2593abb61d8ca32d8ccbb833), [`7458b7c`](https://github.com/tkhq/sdk/commit/7458b7cd6fc64796b376e3374b7c2ed79467459c)]: * @turnkey/core\@1.12.0 * @turnkey/sdk-types\@0.12.0 ## 1.8.1 ### Patch Changes * Updated dependencies \[[`d49ef7e`](https://github.com/tkhq/sdk/commit/d49ef7e9f0f78f16b1324a357f61cf0351198096), [`dced9db`](https://github.com/tkhq/sdk/commit/dced9dbbd8ea533442e19e45ce36e6a05a45a555)]: * @turnkey/core\@1.11.2 ## 1.8.0 ### Minor Changes * [#1180](https://github.com/tkhq/sdk/pull/1180) [`8e075b7`](https://github.com/tkhq/sdk/commit/8e075b7161ccc68cb446b10b54737856fa0c6d31) Author [@amircheikh](https://github.com/amircheikh) - Added optional `openInPage` boolean parameter to `handleAddOauthProvider` which open the oAuth flow in the current page (redirect). This respects the `openInPage` value passed into the `TurnkeyConfig` and defaults to `true` on mobile devices. Twitter oAuth credentials created from `handleXOauth` or `handleAddOauthProvider` will now be stored with the `providerName` `"x"` in the user's `oauthProviders` list. This only affects new credentials. * [#1126](https://github.com/tkhq/sdk/pull/1126) [`fb0ff3e`](https://github.com/tkhq/sdk/commit/fb0ff3e38e061c48f01b35c44294f4549b61d61d) Author [@ethankonk](https://github.com/ethankonk) - Added Bitcoin WIF & Sui Bech32 private key formats to import/export with iframe flows ### Patch Changes * Updated dependencies \[[`8e075b7`](https://github.com/tkhq/sdk/commit/8e075b7161ccc68cb446b10b54737856fa0c6d31), [`2d19991`](https://github.com/tkhq/sdk/commit/2d19991bcf4e1c9704b73a48c54e870373b4bd95), [`89d4084`](https://github.com/tkhq/sdk/commit/89d40844d791b0bbb6d439da5e778b1fdeca4273), [`ba2521d`](https://github.com/tkhq/sdk/commit/ba2521d5d1c1f6baaa58ee65dce8cc4839f7dc7b), [`12ca083`](https://github.com/tkhq/sdk/commit/12ca083314310b05cf41ac29fa2d55eed627f229), [`a85153c`](https://github.com/tkhq/sdk/commit/a85153c8ccc7454cd5aca974bc463fb47c7f8cd4), [`fb0ff3e`](https://github.com/tkhq/sdk/commit/fb0ff3e38e061c48f01b35c44294f4549b61d61d)]: * @turnkey/sdk-types\@0.11.2 * @turnkey/core\@1.11.1 * @turnkey/iframe-stamper\@2.10.0 ## 1.7.2 ### Patch Changes * Updated dependencies \[[`91d6a9e`](https://github.com/tkhq/sdk/commit/91d6a9eb1b9ac9e21745749615ac7a7be66f5cf6), [`699fbd7`](https://github.com/tkhq/sdk/commit/699fbd75ef3f44f768ae641ab4f652e966b8e289), [`91d6a9e`](https://github.com/tkhq/sdk/commit/91d6a9eb1b9ac9e21745749615ac7a7be66f5cf6)]: * @turnkey/core\@1.11.0 * @turnkey/sdk-types\@0.11.1 ## 1.7.1 ### Patch Changes * Updated dependencies \[[`6261eed`](https://github.com/tkhq/sdk/commit/6261eed95af8627bf1e95e7291b9760a2267e301), [`78ec1d9`](https://github.com/tkhq/sdk/commit/78ec1d9afcafde3ca7107fc720323d486d6afaea)]: * @turnkey/core\@1.10.0 * @turnkey/sdk-types\@0.11.0 ## 1.7.0 ### Minor Changes * [#1118](https://github.com/tkhq/sdk/pull/1118) [`29a42db`](https://github.com/tkhq/sdk/commit/29a42db8f5f3ef8b9c23c90cd00f4c21027aac2e) Thanks [@moe-dev](https://github.com/moe-dev)! - Add a new `handleSendTransaction` helper to the Wallet Kit (**for embedded wallet use only**). This handler provides a complete transaction-submission flow, including: * Construction of the Ethereum transaction intent (sponsored and non-sponsored) * Submission via `ethSendTransaction` from `@turnkey/core` * Integrated modal UI for progress + success states * Polling for transaction confirmation using `pollTransactionStatus` * Surfacing of the final on-chain `txHash` back to the caller This addition centralizes all transaction UX and logic into a single, reusable helper and enables consistent send-transaction flows across applications using the Wallet Kit. ### Patch Changes * Updated dependencies \[[`29a42db`](https://github.com/tkhq/sdk/commit/29a42db8f5f3ef8b9c23c90cd00f4c21027aac2e), [`29a42db`](https://github.com/tkhq/sdk/commit/29a42db8f5f3ef8b9c23c90cd00f4c21027aac2e)]: * @turnkey/sdk-types\@0.10.0 * @turnkey/core\@1.9.0 ## 1.6.3 ### Patch Changes * Updated dependencies \[[`850a3ee`](https://github.com/tkhq/sdk/commit/850a3ee5dbb5e2cc46bda50348c917c555e55f73), [`7185545`](https://github.com/tkhq/sdk/commit/7185545ea1fc05eb738af09de5a594455f2e08f3)]: * @turnkey/iframe-stamper\@2.9.0 * @turnkey/core\@1.8.3 ## 1.6.2 ### Patch Changes * Updated dependencies \[[`3c23fc2`](https://github.com/tkhq/sdk/commit/3c23fc27eda5325a90e79afff4cc3a16f682e1d9)]: * @turnkey/core\@1.8.2 ## 1.6.1 ### Patch Changes * Updated dependencies \[[`d4768c7`](https://github.com/tkhq/sdk/commit/d4768c71b6796532c9800d546154116e5d36b255), [`7ac558c`](https://github.com/tkhq/sdk/commit/7ac558c39c3fa0ddeb6e695182a49f03ee6d4f00)]: * @turnkey/core\@1.8.1 * @turnkey/iframe-stamper\@2.8.0 ## 1.6.0 ### Minor Changes * [#1090](https://github.com/tkhq/sdk/pull/1090) [`e1bd68f`](https://github.com/tkhq/sdk/commit/e1bd68f963d6bbd9c797b1a8f077efadccdec421) Author [@moeodeh3](https://github.com/moeodeh3) - - Fixed unnecessary re-renders by ensuring all `useCallback` hooks include only direct dependencies * ConnectWallet and Auth model updated to show WalletConnect loading state during initialization ### Patch Changes * [#1102](https://github.com/tkhq/sdk/pull/1102) [`8ed182a`](https://github.com/tkhq/sdk/commit/8ed182aa95218b348d1f8e79c235ce86f418e0bf) Author [@amircheikh](https://github.com/amircheikh) - - Added `autoFetchWalletKitConfig` option to the `TurnkeyProvider` config. Setting this to false will disable the initial `walletKitConfig` fetch, saving on initialization time. If this is disabled and you want to use the `handleLogin` modal with Turnkey's Auth Proxy, you must pass in the enabled auth methods manually into the `TurnkeyProvider` config. * Fixed `refreshWallets` and `refreshUser` not working when `autoRefreshManagedState` is disabled. * Updated dependencies \[[`fd2e031`](https://github.com/tkhq/sdk/commit/fd2e0318079de922512b1f5adb404b11921f77b7), [`80ea306`](https://github.com/tkhq/sdk/commit/80ea306025a2161ff575a5e2b45794460eafdf1b), [`e1bd68f`](https://github.com/tkhq/sdk/commit/e1bd68f963d6bbd9c797b1a8f077efadccdec421)]: * @turnkey/core\@1.8.0 * @turnkey/sdk-types\@0.9.0 ## 1.5.1 ### Patch Changes * [#1086](https://github.com/tkhq/sdk/pull/1086) [`2fd1d55`](https://github.com/tkhq/sdk/commit/2fd1d5555dd358a1c0210ca65fd6ca70ff172058) Author [@amircheikh](https://github.com/amircheikh) - Added optional `clearClipboardOnPaste` to `handleImportWallet` and `handleImportPrivateKey`. Defaulting to true, this will create the import iframe with `clipboard-write` permissions. Allows clipboard to be cleared after pasting in secrets to import. * [#1083](https://github.com/tkhq/sdk/pull/1083) [`658b89c`](https://github.com/tkhq/sdk/commit/658b89c9036f03ec52963ca0a4ea68d00f39e94e) Thanks [@moe-dev](https://github.com/moe-dev)! - Minor fixes - change on-ramp to onramp and change sandbox info text to match primary colour * Updated dependencies \[[`2fd1d55`](https://github.com/tkhq/sdk/commit/2fd1d5555dd358a1c0210ca65fd6ca70ff172058)]: * @turnkey/iframe-stamper\@2.7.1 ## 1.5.0 ### Minor Changes * [#1062](https://github.com/tkhq/sdk/pull/1062) [`084acce`](https://github.com/tkhq/sdk/commit/084acce85fe7c15513a025e77c1571012ac82e4b) Thanks [@moe-dev](https://github.com/moe-dev)! - - **Added `handleOnRamp()` helper** to simplify fiat-to-crypto on-ramping flows directly from the SDK. * Supports overriding defaults through optional parameters: * `network` (e.g., `FiatOnRampBlockchainNetwork.ETHEREUM`) * `cryptoCurrencyCode` (e.g., `FiatOnRampCryptoCurrency.ETHEREUM`) * `fiatCurrencyAmount`, `fiatCurrencyCode`, `paymentMethod`, and `onrampProvider`. * Integrates seamlessly with the `client.httpClient.initFiatOnRamp()` method to open a provider popup (Coinbase, MoonPay, etc.) and monitor transaction completion. ### Patch Changes * Updated dependencies \[[`beee465`](https://github.com/tkhq/sdk/commit/beee465a13f64abeb71c5c00519f7abab9942607), [`084acce`](https://github.com/tkhq/sdk/commit/084acce85fe7c15513a025e77c1571012ac82e4b), [`67b03a5`](https://github.com/tkhq/sdk/commit/67b03a5d9ab1b6eabfb0b41938ac91365b5dcd9b)]: * @turnkey/core\@1.7.0 * @turnkey/sdk-types\@0.8.0 ## 1.4.3 ### Patch Changes * [#1059](https://github.com/tkhq/sdk/pull/1059) [`046544f`](https://github.com/tkhq/sdk/commit/046544fa4243f31b28068f5b82917e54b8442be5) Author [@moeodeh3](https://github.com/moeodeh3) - Fixed `storeSession` not updating wallet and user state * Updated dependencies \[[`9fbd5c4`](https://github.com/tkhq/sdk/commit/9fbd5c459782dc3721dd0935d0a4458babce258b)]: * @turnkey/core\@1.6.0 ## 1.4.2 ### Patch Changes * [#1049](https://github.com/tkhq/sdk/pull/1049) [`4ea9649`](https://github.com/tkhq/sdk/commit/4ea9649f458b7f24f68bc2b64264128928bfc89b) Author [@moeodeh3](https://github.com/moeodeh3) - Fixed `userId` param being ignored in handleUpdateUserName and handleAddPhoneNumber * [#1049](https://github.com/tkhq/sdk/pull/1049) [`c9f29a4`](https://github.com/tkhq/sdk/commit/c9f29a4bb19a4f7ded7ecc8dc7e53994aa45be63) Author [@moeodeh3](https://github.com/moeodeh3) - Fixed `expirationSeconds` param being ignored in auth functions * Updated dependencies \[]: * @turnkey/core\@1.5.2 ## 1.4.1 ### Patch Changes * Updated dependencies \[[`886f319`](https://github.com/tkhq/sdk/commit/886f319fab8b0ba560d040e34598436f3beceff0)]: * @turnkey/core\@1.5.1 ## 1.4.0 ### Minor Changes * [#992](https://github.com/tkhq/sdk/pull/992) [`5c4495b`](https://github.com/tkhq/sdk/commit/5c4495bff1b0abfe3c427ead1b8e1a8d510c8186) Author [@amircheikh](https://github.com/amircheikh) - - Added `verifyAppProofs` function. Used alongside activities that return app proofs, this function will fetch the corresponding boot proof for a list of app proofs and securely verify them on the client. Learn more about Turnkey Verified [here](https://docs.turnkey.com/security/turnkey-verified) * All auth methods that make signup requests now optionally return a list of `appProofs` * Added `handleVerifyAppProofs` function. This will do the same actions as `verifyAppProofs` but will also show a loading and confirmation modal * Added `verifyWalletOnSignup` param to the `TurnkeyProvider` config. This will automatically run `handleVerifyAppProofs` after a successful signup ### Patch Changes * Updated dependencies \[[`5c4495b`](https://github.com/tkhq/sdk/commit/5c4495bff1b0abfe3c427ead1b8e1a8d510c8186), [`5c4495b`](https://github.com/tkhq/sdk/commit/5c4495bff1b0abfe3c427ead1b8e1a8d510c8186), [`001d822`](https://github.com/tkhq/sdk/commit/001d8225202500e53aa399d6aee0c8f48f6060e0)]: * @turnkey/core\@1.5.0 * @turnkey/sdk-types\@0.6.3 ## 1.3.3 ### Patch Changes * [#1012](https://github.com/tkhq/sdk/pull/1012) [`9e123eb`](https://github.com/tkhq/sdk/commit/9e123eb154df7183bef002c7f94c57a72c6ef81b) Author [@moeodeh3](https://github.com/moeodeh3) - Fixed `switchWalletAccountChain` referencing stale `walletProvider` state * Updated dependencies \[[`9df42ad`](https://github.com/tkhq/sdk/commit/9df42adc02c7ff77afba3b938536e79b57882ef1)]: * @turnkey/sdk-types\@0.6.2 * @turnkey/core\@1.4.2 ## 1.3.2 ### Patch Changes * [#1010](https://github.com/tkhq/sdk/pull/1010) [`e5b9c5c`](https://github.com/tkhq/sdk/commit/e5b9c5c5694b1f4d60c0b8606822bcd6d61da4a3) Author [@moeodeh3](https://github.com/moeodeh3) - Fixed stuck connecting state in `handleConnectExternalWallet()` * Updated dependencies \[[`e5b9c5c`](https://github.com/tkhq/sdk/commit/e5b9c5c5694b1f4d60c0b8606822bcd6d61da4a3)]: * @turnkey/core\@1.4.1 ## 1.3.1 ### Patch Changes * [#997](https://github.com/tkhq/sdk/pull/997) [`b6f9675`](https://github.com/tkhq/sdk/commit/b6f96757356c8b35563e4147d73a99a95e522a64) Author [@moeodeh3](https://github.com/moeodeh3) - Added missing `publicKey` field to the `onOauthSuccess` callback in OAuth handler functions ## 1.3.0 ### Minor Changes * [#986](https://github.com/tkhq/sdk/pull/986) [`6ceb06e`](https://github.com/tkhq/sdk/commit/6ceb06ebdbb11b017ed97e81a7e0dcb862813bfa) Author [@amircheikh](https://github.com/amircheikh) - - Added `defaultStamperType` param to the configuration. This will force the underlying `httpClient` to default to a specific stamper for all requests * Added `createHttpClient` function. This allows a duplicate instance of `TurnkeySDKClientBase` to be created and returned. Custom configuration can be passed in to create an entirely new client with a unique config. This is useful for creating different HTTP clients with different default stampers to be used in our helper packages (`@turnkey/viem`, `@turnkey/ethers`, etc) * [#993](https://github.com/tkhq/sdk/pull/993) [`68631c4`](https://github.com/tkhq/sdk/commit/68631c4008387f845dfe4f1a139981011727f6c9) Author [@moeodeh3](https://github.com/moeodeh3) - - Added `sendSignedRequest()` to execute any `TSignedRequest` returned by SDK stamping methods. * Added `buildWalletLoginRequest()` method, which prepares and signs a wallet login request without sending it to Turnkey, returning the `stampLogin` signed request alongside the wallet’s public key used for login. ### Patch Changes * [#989](https://github.com/tkhq/sdk/pull/989) [`9ca7b8b`](https://github.com/tkhq/sdk/commit/9ca7b8bdf7cb897948d377d544b85b69a98b7a29) Author [@amircheikh](https://github.com/amircheikh) - Padding and margin styles are now only forced under `.tk-modal` * Updated dependencies \[[`68631c4`](https://github.com/tkhq/sdk/commit/68631c4008387f845dfe4f1a139981011727f6c9), [`6ceb06e`](https://github.com/tkhq/sdk/commit/6ceb06ebdbb11b017ed97e81a7e0dcb862813bfa), [`68631c4`](https://github.com/tkhq/sdk/commit/68631c4008387f845dfe4f1a139981011727f6c9)]: * @turnkey/sdk-types\@0.6.1 * @turnkey/core\@1.4.0 ## 1.2.0 ### Minor Changes * [#974](https://github.com/tkhq/sdk/pull/974) [`3997c0f`](https://github.com/tkhq/sdk/commit/3997c0fd08a8a85108acf904c0bf39d69f8dc79c) Author [@narimonf](https://github.com/narimonf) - Added `fetchBootProofForAppProof`, which fetches the boot proof for a given app proof. ### Patch Changes * [#973](https://github.com/tkhq/sdk/pull/973) [`48f59f9`](https://github.com/tkhq/sdk/commit/48f59f9ffe7f64ec526b40bb8e03feac8ad0d7ba) Author [@moeodeh3](https://github.com/moeodeh3) - Fix handling of providers that cannot be disconnected * Updated dependencies \[[`4adbf9b`](https://github.com/tkhq/sdk/commit/4adbf9bbb6b93f84aa80e06a1eeabd61d1dbbb86), [`4ead6da`](https://github.com/tkhq/sdk/commit/4ead6da626468fde41daf85eae90faf18651d1c1), [`3997c0f`](https://github.com/tkhq/sdk/commit/3997c0fd08a8a85108acf904c0bf39d69f8dc79c), [`3997c0f`](https://github.com/tkhq/sdk/commit/3997c0fd08a8a85108acf904c0bf39d69f8dc79c)]: * @turnkey/core\@1.3.0 * @turnkey/sdk-types\@0.6.0 ## 1.1.2 ### Patch Changes * Updated dependencies \[[`4567059`](https://github.com/tkhq/sdk/commit/45670598f102223925b87a5295edca15a6ce8241), [`010543c`](https://github.com/tkhq/sdk/commit/010543c3b1b56a18816ea92a1a1cbe028cf988e4)]: * @turnkey/sdk-types\@0.5.0 * @turnkey/core\@1.2.0 ## 1.1.1 ### Patch Changes * [#968](https://github.com/tkhq/sdk/pull/968) [`14424ee`](https://github.com/tkhq/sdk/commit/14424eeeabb9cea8067f978051dceb0537c22e34) Author [@moeodeh3](https://github.com/moeodeh3) - Fixed type re-exports from `@turnkey/core` * [#962](https://github.com/tkhq/sdk/pull/962) [`62937e7`](https://github.com/tkhq/sdk/commit/62937e74e1e27093906e434c62f6f0545f73e934) Author [@moeodeh3](https://github.com/moeodeh3) - - Fixed memory leaks in `handle*` functions * `handleConnectExternalWallet` now returns `{ type: "connect" | "disconnect"; account?: WalletAccount }` * [#964](https://github.com/tkhq/sdk/pull/964) [`1e15cc9`](https://github.com/tkhq/sdk/commit/1e15cc9d672905b87566324ec5b10580318fca19) Author [@moeodeh3](https://github.com/moeodeh3) - Fix `onClose` callbacks not triggering in child modal pages ## 1.1.0 ### Minor Changes * [#941](https://github.com/tkhq/sdk/pull/941) [`f2c95ae`](https://github.com/tkhq/sdk/commit/f2c95aed9c5fc56efa6ecda62e5231fc05d0c96e) Author [@ethankonk](https://github.com/ethankonk) - - Added options in the config and handleLogin() to add a logo for light and/or dark mode * [#951](https://github.com/tkhq/sdk/pull/951) [`3ad8718`](https://github.com/tkhq/sdk/commit/3ad87184fab0e66c36276210b8c1c2c598888014) Author [@ethankonk](https://github.com/ethankonk) - - Added sheets to the modal system which popup from below within the modal. Future proofing for more OAuth methods and such * [#944](https://github.com/tkhq/sdk/pull/944) [`e7edb0f`](https://github.com/tkhq/sdk/commit/e7edb0f7fe03ff453ddb8ff05c3283b608ad2b86) Author [@ethankonk](https://github.com/ethankonk) - Added optional name overide param for handleImportWallet & handleImportPrivateKey. If provided, the input field for wallet name will no longer be shown and the passed in name param will be used instead. * [#931](https://github.com/tkhq/sdk/pull/931) [`f8a8d20`](https://github.com/tkhq/sdk/commit/f8a8d204ccf1831a742ecd47b2c42dc3a672dd7e) Author [@ethankonk](https://github.com/ethankonk) - - Added config option to disable managed state auto refreshing. * The session state is automatically cleared if a request to Turnkey returns an unauthorized error indicating that the session keypair is no longer valid. * [#940](https://github.com/tkhq/sdk/pull/940) [`e4bc82f`](https://github.com/tkhq/sdk/commit/e4bc82fc51c692d742923ccfff72c2c862ee71a4) Author [@moeodeh3](https://github.com/moeodeh3) - - Added optional params for sessionless stamping (passkey/wallet only setups) ### Patch Changes * [#952](https://github.com/tkhq/sdk/pull/952) [`6e3114b`](https://github.com/tkhq/sdk/commit/6e3114bd16246b0e1dcb540f30ff3a430164c2fd) Author [@amircheikh](https://github.com/amircheikh) - - Fixed broken padding on Safari using iOS 26 and MacOS 26 * [#955](https://github.com/tkhq/sdk/pull/955) [`c534b5b`](https://github.com/tkhq/sdk/commit/c534b5ba7834bf8f16a5e903b468b262972f9320) Author [@ethankonk](https://github.com/ethankonk) - Methods no longer rely on the session state variable, meaning functions that modify session can be placed in-line with methods reliant on session updates * [#934](https://github.com/tkhq/sdk/pull/934) [`9c1fea5`](https://github.com/tkhq/sdk/commit/9c1fea51ba156c176f81ba5883e7d8c837f95c19) Author [@moeodeh3](https://github.com/moeodeh3) - Re-exported useful modules from `@turnkey/core`: * `TurnkeyClient` * `TurnkeyClientMethods` * `TurnkeySDKClientBase` * `isEthereumProvider` * `isSolanaProvider` * [#954](https://github.com/tkhq/sdk/pull/954) [`474ba20`](https://github.com/tkhq/sdk/commit/474ba20e90c4d7c056d108c44fc2442a0e1cd992) Author [@moeodeh3](https://github.com/moeodeh3) - Added a Copy Link button to the WalletConnect screen in the auth component * [#958](https://github.com/tkhq/sdk/pull/958) [`5a96fe8`](https://github.com/tkhq/sdk/commit/5a96fe80db4c4c45e09ad8c613695ee4c2b8e51f) Author [@amircheikh](https://github.com/amircheikh) - - otpLength and alphanumeric settings now properly apply from dashboard * [#946](https://github.com/tkhq/sdk/pull/946) [`0080c4d`](https://github.com/tkhq/sdk/commit/0080c4d011a7f8d04b41d89b31863b75d1a816ef) Author [@moeodeh3](https://github.com/moeodeh3) - - Fixed double sign prompt for WalletConnect in React Dev Mode * Fixed expired WalletConnect URIs * Fixed errors on unapproved WalletConnect sessions * [#960](https://github.com/tkhq/sdk/pull/960) [`c2a0bd7`](https://github.com/tkhq/sdk/commit/c2a0bd7ea8a53524cde16897f375f8a7088ba963) Author [@moeodeh3](https://github.com/moeodeh3) - - Removed requirement of session for external wallet usage * `connectExternalWalletAccount()` now returns the full `WalletAccount` object instead of `void` * `fetchWallets()` now supports an optional `connectedOnly` parameter to fetch only connected wallets * Updated dependencies \[[`0080c4d`](https://github.com/tkhq/sdk/commit/0080c4d011a7f8d04b41d89b31863b75d1a816ef), [`5a96fe8`](https://github.com/tkhq/sdk/commit/5a96fe80db4c4c45e09ad8c613695ee4c2b8e51f), [`c2a0bd7`](https://github.com/tkhq/sdk/commit/c2a0bd7ea8a53524cde16897f375f8a7088ba963), [`90841f9`](https://github.com/tkhq/sdk/commit/90841f95f3f738c47c04797096902d9d0a23afc7), [`e4bc82f`](https://github.com/tkhq/sdk/commit/e4bc82fc51c692d742923ccfff72c2c862ee71a4)]: * @turnkey/core\@1.1.0 * @turnkey/sdk-types\@0.4.1 ## 1.0.0 ### Major Changes * Initial Stable Release: `@turnkey/react-wallet-kit` 🎉 Turnkey’s **Embedded Wallet Kit** is the easiest way to integrate Turnkey’s Embedded Wallets into your React applications, with no backend required. * Built on [`@turnkey/core`](https://www.npmjs.com/package/@turnkey/core) * Provides a set of UI components and simple functions, all exported through a React hook * Designed to help you quickly build secure embedded wallet experiences 📚 [Read the full docs here](https://docs.turnkey.com/sdks/react) ### Minor Changes * [#677](https://github.com/tkhq/sdk/pull/677) [`fc1d6e2`](https://github.com/tkhq/sdk/commit/fc1d6e2d26f4a53116633e9e8cccccd792267f4e) Author [@amircheikh](https://github.com/amircheikh) - @turnkey/react-wallet-kit and @turnkey/core beta-3 release * [#677](https://github.com/tkhq/sdk/pull/677) [`fc1d6e2`](https://github.com/tkhq/sdk/commit/fc1d6e2d26f4a53116633e9e8cccccd792267f4e) Author [@amircheikh](https://github.com/amircheikh) - @turnkey/react-wallet-kit and @turnkey/core beta-3 release * [#677](https://github.com/tkhq/sdk/pull/677) [`4880f26`](https://github.com/tkhq/sdk/commit/4880f26a4dd324c049bff7f35284098ccfc55823) Author [@amircheikh](https://github.com/amircheikh) - @turnkey/react-wallet-kit and @turnkey/core beta release * [#677](https://github.com/tkhq/sdk/pull/677) [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c) Author [@amircheikh](https://github.com/amircheikh) - updating package versions * [#677](https://github.com/tkhq/sdk/pull/677) [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c) Author [@amircheikh](https://github.com/amircheikh) - test build * [#677](https://github.com/tkhq/sdk/pull/677) [`06347ad`](https://github.com/tkhq/sdk/commit/06347adfa08fb0867c350e43821d0fed06c49624) Author [@amircheikh](https://github.com/amircheikh) - SDK beta release @turnkey/react-wallet-kit @turnkey/core ### Patch Changes * Updated dependencies \[[`fc1d6e2`](https://github.com/tkhq/sdk/commit/fc1d6e2d26f4a53116633e9e8cccccd792267f4e), [`fc1d6e2`](https://github.com/tkhq/sdk/commit/fc1d6e2d26f4a53116633e9e8cccccd792267f4e), [`4880f26`](https://github.com/tkhq/sdk/commit/4880f26a4dd324c049bff7f35284098ccfc55823), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`06347ad`](https://github.com/tkhq/sdk/commit/06347adfa08fb0867c350e43821d0fed06c49624)]: * @turnkey/sdk-types\@0.4.0 * @turnkey/core\@1.0.0 * @turnkey/iframe-stamper\@2.6.0 ## 1.0.0-beta.6 ### Minor Changes * @turnkey/react-wallet-kit and @turnkey/core beta release ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-types\@0.4.0-beta.6 * @turnkey/core\@1.0.0-beta.6 ## 1.0.0-beta.5 ### Minor Changes * SDK beta release @turnkey/react-wallet-kit @turnkey/core ### Patch Changes * Updated dependencies \[]: * @turnkey/iframe-stamper\@2.6.0-beta.0 * @turnkey/sdk-types\@0.4.0-beta.5 * @turnkey/core\@1.0.0-beta.5 ## 1.0.0-beta.4 ### Minor Changes * @turnkey/react-wallet-kit and @turnkey/core beta-3 release ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-types\@0.4.0-beta.4 * @turnkey/core\@1.0.0-beta.4 ## 1.0.0-beta.3 ### Minor Changes * @turnkey/react-wallet-kit and @turnkey/core beta-3 release ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-types\@0.4.0-beta.3 * @turnkey/core\@1.0.0-beta.3 ## 1.0.0-beta.2 ### Minor Changes * updating package versions ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-types\@0.4.0-beta.2 * @turnkey/core\@1.0.0-beta.2 ## 1.0.0-beta.1 ### Minor Changes * test build ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-types\@0.4.0-beta.1 * @turnkey/core\@1.0.0-beta.1 ## 1.0.0-beta.0 ### Major Changes * beta for @turnkey/react-wallet-kit and @turnkey/core ### Patch Changes * Updated dependencies \[]: * @turnkey/core\@1.0.0-beta.0 * @turnkey/sdk-types\@0.4.0-beta.0 ## 1.0.0 ### Major Changes * Initial beta release for react wallet kit ### Patch Changes * Updated dependencies \[]: * @turnkey/core\@1.0.0 * @turnkey/sdk-types\@0.4.0 ## 1.0.0 ### Major Changes * Initial beta release for @turnkey/react-wallet-kit and @turnkey/core ### Patch Changes * Updated dependencies \[]: * @turnkey/core\@1.0.0 * @turnkey/sdk-types\@0.4.0 # SDK Browser Source: https://docs.turnkey.com/changelogs/sdk-browser/readme # @turnkey/sdk-browser ## 5.15.2 ### Patch Changes * Updated dependencies \[[`dfdd864`](https://github.com/tkhq/sdk/commit/dfdd8647266fdd0297aaea32046ee815ae8fc27c)]: * @turnkey/sdk-types\@0.12.1 * @turnkey/crypto\@2.8.12 * @turnkey/api-key-stamper\@0.6.3 * @turnkey/wallet-stamper\@1.1.14 * @turnkey/http\@3.17.1 * @turnkey/indexed-db-stamper\@1.2.4 ## 5.15.1 ### Patch Changes * Updated dependencies \[[`207fc93`](https://github.com/tkhq/sdk/commit/207fc932374a8362ec6f803ac0a67c2e5dbfc29e)]: * @turnkey/iframe-stamper\@2.11.0 ## 5.15.0 ### Minor Changes * [#1206](https://github.com/tkhq/sdk/pull/1206) [`58e04e5`](https://github.com/tkhq/sdk/commit/58e04e5856626d9d2593abb61d8ca32d8ccbb833) Author [@DeRauk](https://github.com/DeRauk) - Adds sdk methods for the GetWalletAddressBalances and ListSupportedAssets apis. ### Patch Changes * [#1201](https://github.com/tkhq/sdk/pull/1201) [`1f6e240`](https://github.com/tkhq/sdk/commit/1f6e2403fca1fd9cbca646f88c88dbc49ddb0c34) Author [@ethankonk](https://github.com/ethankonk) - Synced with Mono v2026.2.0 * [#1197](https://github.com/tkhq/sdk/pull/1197) [`7458b7c`](https://github.com/tkhq/sdk/commit/7458b7cd6fc64796b376e3374b7c2ed79467459c) Thanks [@moe-dev](https://github.com/moe-dev)! - Add support for SolSendTransaction and associated abstractions * Updated dependencies \[[`1f6e240`](https://github.com/tkhq/sdk/commit/1f6e2403fca1fd9cbca646f88c88dbc49ddb0c34), [`58e04e5`](https://github.com/tkhq/sdk/commit/58e04e5856626d9d2593abb61d8ca32d8ccbb833), [`7458b7c`](https://github.com/tkhq/sdk/commit/7458b7cd6fc64796b376e3374b7c2ed79467459c)]: * @turnkey/sdk-types\@0.12.0 * @turnkey/http\@3.17.0 * @turnkey/crypto\@2.8.11 * @turnkey/wallet-stamper\@1.1.13 * @turnkey/api-key-stamper\@0.6.2 * @turnkey/indexed-db-stamper\@1.2.3 ## 5.14.3 ### Patch Changes * [#1194](https://github.com/tkhq/sdk/pull/1194) [`dced9db`](https://github.com/tkhq/sdk/commit/dced9dbbd8ea533442e19e45ce36e6a05a45a555) Author [@moeodeh3](https://github.com/moeodeh3) - Add `Content-Type: application/json` header to all Turnkey API requests * Updated dependencies \[[`dced9db`](https://github.com/tkhq/sdk/commit/dced9dbbd8ea533442e19e45ce36e6a05a45a555)]: * @turnkey/http\@3.16.3 * @turnkey/wallet-stamper\@1.1.12 ## 5.14.2 ### Patch Changes * Updated dependencies \[[`8e075b7`](https://github.com/tkhq/sdk/commit/8e075b7161ccc68cb446b10b54737856fa0c6d31), [`fb0ff3e`](https://github.com/tkhq/sdk/commit/fb0ff3e38e061c48f01b35c44294f4549b61d61d)]: * @turnkey/sdk-types\@0.11.2 * @turnkey/iframe-stamper\@2.10.0 * @turnkey/crypto\@2.8.10 * @turnkey/api-key-stamper\@0.6.1 * @turnkey/wallet-stamper\@1.1.12 * @turnkey/http\@3.16.2 * @turnkey/indexed-db-stamper\@1.2.2 ## 5.14.1 ### Patch Changes * Updated dependencies \[[`d0dba04`](https://github.com/tkhq/sdk/commit/d0dba0412fa7b0c7c9b135e73cc0ef6f55187314), [`91d6a9e`](https://github.com/tkhq/sdk/commit/91d6a9eb1b9ac9e21745749615ac7a7be66f5cf6), [`91d6a9e`](https://github.com/tkhq/sdk/commit/91d6a9eb1b9ac9e21745749615ac7a7be66f5cf6)]: * @turnkey/crypto\@2.8.9 * @turnkey/api-key-stamper\@0.6.0 * @turnkey/sdk-types\@0.11.1 * @turnkey/wallet-stamper\@1.1.11 * @turnkey/http\@3.16.1 * @turnkey/indexed-db-stamper\@1.2.1 ## 5.14.0 ### Minor Changes * [#1153](https://github.com/tkhq/sdk/pull/1153) [`78ec1d9`](https://github.com/tkhq/sdk/commit/78ec1d9afcafde3ca7107fc720323d486d6afaea) Thanks [@moe-dev](https://github.com/moe-dev)! - Update as per mono v2025.12.3. ### Breaking/Behavioral Changes * `appName` is now **required**: * In `emailCustomization` for Email Auth activities * At the top-level intent for OTP activities * Auth proxy endpoints are **not affected** ### Activity Version Bumps The following activity types have been versioned: * `ACTIVITY_TYPE_INIT_OTP` → `ACTIVITY_TYPE_INIT_OTP_V2` * `ACTIVITY_TYPE_INIT_OTP_AUTH_V2` → `ACTIVITY_TYPE_INIT_OTP_V3` * `ACTIVITY_TYPE_EMAIL_AUTH_V2` → `ACTIVITY_TYPE_EMAIL_AUTH_V3` * `ACTIVITY_TYPE_INIT_USER_EMAIL_RECOVERY` -> `ACTIVITY_TYPE_INIT_USER_EMAIL_RECOVERY_V2` ### Patch Changes * [#1145](https://github.com/tkhq/sdk/pull/1145) [`cfd34ab`](https://github.com/tkhq/sdk/commit/cfd34ab14ff2abed0e22dca9a802c58a96b9e8e1) Author [@moeodeh3](https://github.com/moeodeh3) - Stamp function improvements * Queries: add `organizationId` fallback from config * Activities: fix request structure to include the `parameters wrapper`, `organizationId`, `timestampMs`, and `type` fields * Updated dependencies \[[`78ec1d9`](https://github.com/tkhq/sdk/commit/78ec1d9afcafde3ca7107fc720323d486d6afaea)]: * @turnkey/sdk-types\@0.11.0 * @turnkey/http\@3.16.0 * @turnkey/crypto\@2.8.8 * @turnkey/wallet-stamper\@1.1.10 ## 5.13.6 ### Patch Changes * Updated dependencies \[[`29a42db`](https://github.com/tkhq/sdk/commit/29a42db8f5f3ef8b9c23c90cd00f4c21027aac2e)]: * @turnkey/sdk-types\@0.10.0 * @turnkey/crypto\@2.8.7 * @turnkey/wallet-stamper\@1.1.9 ## 5.13.5 ### Patch Changes * Updated dependencies \[[`850a3ee`](https://github.com/tkhq/sdk/commit/850a3ee5dbb5e2cc46bda50348c917c555e55f73)]: * @turnkey/iframe-stamper\@2.9.0 ## 5.13.4 ### Patch Changes * Updated dependencies \[[`7ac558c`](https://github.com/tkhq/sdk/commit/7ac558c39c3fa0ddeb6e695182a49f03ee6d4f00)]: * @turnkey/iframe-stamper\@2.8.0 ## 5.13.3 ### Patch Changes * Updated dependencies \[[`80ea306`](https://github.com/tkhq/sdk/commit/80ea306025a2161ff575a5e2b45794460eafdf1b)]: * @turnkey/sdk-types\@0.9.0 * @turnkey/crypto\@2.8.6 * @turnkey/wallet-stamper\@1.1.8 ## 5.13.2 ### Patch Changes * [#1097](https://github.com/tkhq/sdk/pull/1097) Bumping `hpke/core` to `1.7.5` to resolve [https://github.com/dajiaji/hpke-js/security/advisories/GHSA-73g8-5h73-26h4](https://github.com/dajiaji/hpke-js/security/advisories/GHSA-73g8-5h73-26h4). Thanks [@r-n-o](https://github.com/r-n-o) for the bump, and thank you to [@dajiaji](https://github.com/dajiaji) for the disclosure and the underlying fix! ## 5.13.1 ### Patch Changes * Updated dependencies \[[`2fd1d55`](https://github.com/tkhq/sdk/commit/2fd1d5555dd358a1c0210ca65fd6ca70ff172058)]: * @turnkey/iframe-stamper\@2.7.1 ## 5.13.0 ### Minor Changes * [#1072](https://github.com/tkhq/sdk/pull/1072) [`67b03a5`](https://github.com/tkhq/sdk/commit/67b03a5d9ab1b6eabfb0b41938ac91365b5dcd9b) Thanks [@moe-dev](https://github.com/moe-dev)! - Bump packages as per mono v2025.11.0 ### Patch Changes * Updated dependencies \[[`5f829c6`](https://github.com/tkhq/sdk/commit/5f829c67af03bb85c3806acd202b2debf8274e78), [`084acce`](https://github.com/tkhq/sdk/commit/084acce85fe7c15513a025e77c1571012ac82e4b), [`67b03a5`](https://github.com/tkhq/sdk/commit/67b03a5d9ab1b6eabfb0b41938ac91365b5dcd9b)]: * @turnkey/crypto\@2.8.5 * @turnkey/sdk-types\@0.8.0 * @turnkey/http\@3.15.0 * @turnkey/wallet-stamper\@1.1.7 ## 5.12.0 ### Minor Changes * [#1058](https://github.com/tkhq/sdk/pull/1058) [`9fbd5c4`](https://github.com/tkhq/sdk/commit/9fbd5c459782dc3721dd0935d0a4458babce258b) Author [@moeodeh3](https://github.com/moeodeh3) - Update per mono release `v2025.10.10-hotfix.2` ### Patch Changes * Updated dependencies \[[`9fbd5c4`](https://github.com/tkhq/sdk/commit/9fbd5c459782dc3721dd0935d0a4458babce258b)]: * @turnkey/http\@3.14.0 * @turnkey/crypto\@2.8.4 * @turnkey/wallet-stamper\@1.1.6 ## 5.11.6 ### Patch Changes * Updated dependencies \[[`c745646`](https://github.com/tkhq/sdk/commit/c745646ae4b2a275e116abca07c6e108f89beb04)]: * @turnkey/crypto\@2.8.4 * @turnkey/wallet-stamper\@1.1.6 ## 5.11.5 ### Patch Changes * Updated dependencies \[[`5c4495b`](https://github.com/tkhq/sdk/commit/5c4495bff1b0abfe3c427ead1b8e1a8d510c8186), [`5c4495b`](https://github.com/tkhq/sdk/commit/5c4495bff1b0abfe3c427ead1b8e1a8d510c8186)]: * @turnkey/crypto\@2.8.3 * @turnkey/sdk-types\@0.6.3 * @turnkey/wallet-stamper\@1.1.5 ## 5.11.4 ### Patch Changes * [#1016](https://github.com/tkhq/sdk/pull/1016) [`9df42ad`](https://github.com/tkhq/sdk/commit/9df42adc02c7ff77afba3b938536e79b57882ef1) Author [@amircheikh](https://github.com/amircheikh) - Synced API as per mono v2025.10.2 * Updated dependencies \[[`9df42ad`](https://github.com/tkhq/sdk/commit/9df42adc02c7ff77afba3b938536e79b57882ef1)]: * @turnkey/sdk-types\@0.6.2 * @turnkey/http\@3.13.1 * @turnkey/crypto\@2.8.2 * @turnkey/wallet-stamper\@1.1.4 ## 5.11.3 ### Patch Changes * Updated dependencies \[[`e76d2bf`](https://github.com/tkhq/sdk/commit/e76d2bfbe3fb481aedac9b992260c50217823e8a)]: * @turnkey/iframe-stamper\@2.7.0 ## 5.11.2 ### Patch Changes * Updated dependencies \[[`68631c4`](https://github.com/tkhq/sdk/commit/68631c4008387f845dfe4f1a139981011727f6c9)]: * @turnkey/sdk-types\@0.6.1 * @turnkey/crypto\@2.8.1 * @turnkey/wallet-stamper\@1.1.3 ## 5.11.1 ### Patch Changes * Updated dependencies \[[`3997c0f`](https://github.com/tkhq/sdk/commit/3997c0fd08a8a85108acf904c0bf39d69f8dc79c), [`3997c0f`](https://github.com/tkhq/sdk/commit/3997c0fd08a8a85108acf904c0bf39d69f8dc79c)]: * @turnkey/crypto\@2.8.0 * @turnkey/sdk-types\@0.6.0 * @turnkey/wallet-stamper\@1.1.2 ## 5.11.0 ### Minor Changes * [#977](https://github.com/tkhq/sdk/pull/977) [`4567059`](https://github.com/tkhq/sdk/commit/45670598f102223925b87a5295edca15a6ce8241) Author [@besler613](https://github.com/besler613) - OAuth2Authenticate now supports returning the encrypted bearer token via the optional `bearerTokenTargetPublicKey` request parameter (mono release v2025.9.5) ### Patch Changes * Updated dependencies \[[`4567059`](https://github.com/tkhq/sdk/commit/45670598f102223925b87a5295edca15a6ce8241)]: * @turnkey/sdk-types\@0.5.0 * @turnkey/http\@3.13.0 * @turnkey/crypto\@2.7.0 * @turnkey/wallet-stamper\@1.1.1 ## 5.10.1 ### Patch Changes * [#958](https://github.com/tkhq/sdk/pull/958) [`5a96fe8`](https://github.com/tkhq/sdk/commit/5a96fe80db4c4c45e09ad8c613695ee4c2b8e51f) Author [@amircheikh](https://github.com/amircheikh) - - Synced api with mono * Updated dependencies \[[`2191a1b`](https://github.com/tkhq/sdk/commit/2191a1b201fb17dea4c79cf9e02b3a493b18f97a), [`5a96fe8`](https://github.com/tkhq/sdk/commit/5a96fe80db4c4c45e09ad8c613695ee4c2b8e51f)]: * @turnkey/crypto\@2.7.0 * @turnkey/sdk-types\@0.4.1 * @turnkey/http\@3.12.1 * @turnkey/wallet-stamper\@1.1.1 ## 5.10.0 ### Minor Changes * Updated dependencies \[[`fc1d6e2`](https://github.com/tkhq/sdk/commit/fc1d6e2d26f4a53116633e9e8cccccd792267f4e), [`fc1d6e2`](https://github.com/tkhq/sdk/commit/fc1d6e2d26f4a53116633e9e8cccccd792267f4e), [`4880f26`](https://github.com/tkhq/sdk/commit/4880f26a4dd324c049bff7f35284098ccfc55823), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`06347ad`](https://github.com/tkhq/sdk/commit/06347adfa08fb0867c350e43821d0fed06c49624), [`6bfcbc5`](https://github.com/tkhq/sdk/commit/6bfcbc5c098e64ab1d115518733b87cfc1653e17)]: * @turnkey/sdk-types\@0.4.0 * @turnkey/encoding\@0.6.0 * @turnkey/http\@3.12.0 * @turnkey/crypto\@2.6.0 * @turnkey/indexed-db-stamper\@1.2.0 * @turnkey/webauthn-stamper\@0.6.0 * @turnkey/api-key-stamper\@0.5.0 * @turnkey/iframe-stamper\@2.6.0 * @turnkey/wallet-stamper\@1.1.0 ## 5.9.0-beta.1 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-types\@0.4.0-beta.6 * @turnkey/encoding\@0.6.0-beta.6 * @turnkey/crypto\@2.6.0-beta.6 * @turnkey/api-key-stamper\@0.5.0-beta.6 * @turnkey/http\@3.11.1-beta.0 * @turnkey/indexed-db-stamper\@1.2.0-beta.6 * @turnkey/wallet-stamper\@1.1.0-beta.6 ## 5.9.0-beta.0 ### Minor Changes * SDK beta release @turnkey/react-wallet-kit @turnkey/core ### Patch Changes * Updated dependencies \[]: * @turnkey/indexed-db-stamper\@1.2.0-beta.5 * @turnkey/webauthn-stamper\@0.6.0-beta.0 * @turnkey/api-key-stamper\@0.5.0-beta.5 * @turnkey/iframe-stamper\@2.6.0-beta.0 * @turnkey/wallet-stamper\@1.1.0-beta.5 * @turnkey/sdk-types\@0.4.0-beta.5 * @turnkey/encoding\@0.6.0-beta.5 * @turnkey/crypto\@2.6.0-beta.5 * @turnkey/http\@3.10.0-beta.2 ## 5.9.0 ### Minor Changes * [#879](https://github.com/tkhq/sdk/pull/879) [`026264c`](https://github.com/tkhq/sdk/commit/026264c55aa16342c8925af0bdcdf72dc00e5158) Author [@zkharit](https://github.com/zkharit) - Update packages to include new activities as of the newest release (mono v2025.8.10) ### Patch Changes * Updated dependencies \[[`026264c`](https://github.com/tkhq/sdk/commit/026264c55aa16342c8925af0bdcdf72dc00e5158), [`d7420e6`](https://github.com/tkhq/sdk/commit/d7420e6c3559efc1024b58749b31d253150cb189)]: * @turnkey/http\@3.11.0 * @turnkey/crypto\@2.6.0 * @turnkey/wallet-stamper\@1.0.9 ## 5.8.0 ### Minor Changes * [#861](https://github.com/tkhq/sdk/pull/861) [`5d8be2d`](https://github.com/tkhq/sdk/commit/5d8be2d0329070c7aa025dddb1b28f04257ae4e6) Author [@amircheikh](https://github.com/amircheikh) - Synced as per mono 2025.8.4 ### Patch Changes * Updated dependencies \[[`5d8be2d`](https://github.com/tkhq/sdk/commit/5d8be2d0329070c7aa025dddb1b28f04257ae4e6)]: * @turnkey/http\@3.10.0 * @turnkey/crypto\@2.5.0 * @turnkey/wallet-stamper\@1.0.8 ## 5.7.1-beta.1 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-types\@0.4.0-beta.4 * @turnkey/encoding\@0.6.0-beta.4 * @turnkey/http\@3.10.0-beta.1 * @turnkey/api-key-stamper\@0.4.8-beta.4 * @turnkey/crypto\@2.5.1-beta.4 * @turnkey/indexed-db-stamper\@1.1.2-beta.4 * @turnkey/wallet-stamper\@1.0.9-beta.4 ## 5.7.1-beta.0 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-types\@0.4.0-beta.3 * @turnkey/encoding\@0.6.0-beta.3 * @turnkey/http\@3.10.0-beta.0 * @turnkey/api-key-stamper\@0.4.8-beta.3 * @turnkey/crypto\@2.5.1-beta.3 * @turnkey/indexed-db-stamper\@1.1.2-beta.3 * @turnkey/wallet-stamper\@1.0.9-beta.3 ## 5.7.0 ### Minor Changes * [#834](https://github.com/tkhq/sdk/pull/834) [`8b39dba`](https://github.com/tkhq/sdk/commit/8b39dbabf68d3e376b5b07f26960d5b61ae87fa9) Author [@moeodeh3](https://github.com/moeodeh3) - Update per mono release v2025.8.3-hotfix.0 ### Patch Changes * Updated dependencies \[[`8b39dba`](https://github.com/tkhq/sdk/commit/8b39dbabf68d3e376b5b07f26960d5b61ae87fa9)]: * @turnkey/http\@3.9.0 * @turnkey/crypto\@2.5.0 * @turnkey/wallet-stamper\@1.0.8 ## 5.6.1-beta.2 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-types\@0.4.0-beta.2 * @turnkey/encoding\@0.6.0-beta.2 * @turnkey/api-key-stamper\@0.4.8-beta.2 * @turnkey/crypto\@2.5.1-beta.2 * @turnkey/http\@3.8.1-beta.2 * @turnkey/indexed-db-stamper\@1.1.2-beta.2 * @turnkey/wallet-stamper\@1.0.9-beta.2 ## 5.6.1-beta.0 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-types\@1.0.0-beta.0 * @turnkey/encoding\@1.0.0-beta.0 * @turnkey/api-key-stamper\@0.4.8-beta.0 * @turnkey/crypto\@2.5.1-beta.0 * @turnkey/http\@3.8.1-beta.0 * @turnkey/indexed-db-stamper\@1.1.2-beta.0 * @turnkey/wallet-stamper\@1.0.9-beta.0 ## 5.6.0 ### Minor Changes * [#826](https://github.com/tkhq/sdk/pull/826) [`f83f25b`](https://github.com/tkhq/sdk/commit/f83f25ba33ef15dbd66723531eebe2fd00f43ac0) Author [@turnekybc](https://github.com/turnekybc) - Update per mono release v2025.8.1 ### Patch Changes * Updated dependencies \[[`f83f25b`](https://github.com/tkhq/sdk/commit/f83f25ba33ef15dbd66723531eebe2fd00f43ac0)]: * @turnkey/http\@3.8.0 * @turnkey/crypto\@2.5.0 * @turnkey/wallet-stamper\@1.0.8 ## 5.5.0 ### Minor Changes * [#651](https://github.com/tkhq/sdk/pull/651) [`81e355c`](https://github.com/tkhq/sdk/commit/81e355c9a8321feffcac056916b65139cf35eeed) Author [@turnekybc](https://github.com/turnekybc) - Add Coinbase & MoonPay Fiat Onramp. View the [Fiat Onramp feature docs](https://docs.turnkey.com/wallets/fiat-on-ramp). ### Patch Changes * Updated dependencies \[[`81e355c`](https://github.com/tkhq/sdk/commit/81e355c9a8321feffcac056916b65139cf35eeed), [`6cde41c`](https://github.com/tkhq/sdk/commit/6cde41cfecdfb7d54abf52cc65e28ef0e2ad6ba3)]: * @turnkey/http\@3.7.0 * @turnkey/sdk-types\@0.3.0 * @turnkey/crypto\@2.5.0 * @turnkey/wallet-stamper\@1.0.8 ## 5.4.1 ### Patch Changes * [#787](https://github.com/tkhq/sdk/pull/787) [`0d1eb2c`](https://github.com/tkhq/sdk/commit/0d1eb2c464bac3cf6f4386f402604ecf8f373f15) Author [@andrewkmin](https://github.com/andrewkmin) - Add optional `organizationId` parameter to `loginWithPasskey()` and `loginWithWallet()` to allow targeting a specific organization. ## 5.4.0 ### Minor Changes * [#782](https://github.com/tkhq/sdk/pull/782) [`e90a478`](https://github.com/tkhq/sdk/commit/e90a478c9208d858b1144df9b2c2c7ba956c406e) Thanks [@r-n-o](https://github.com/r-n-o)! - Release v2025.7.16 ### Patch Changes * Updated dependencies \[[`e90a478`](https://github.com/tkhq/sdk/commit/e90a478c9208d858b1144df9b2c2c7ba956c406e)]: * @turnkey/http\@3.6.0 * @turnkey/crypto\@2.4.3 * @turnkey/wallet-stamper\@1.0.7 ## 5.3.4 ### Patch Changes * [#763](https://github.com/tkhq/sdk/pull/763) [`cb13c26`](https://github.com/tkhq/sdk/commit/cb13c26edb79a01ab651e3b2897334fd154b436a) Author [@andrewkmin](https://github.com/andrewkmin) - Release per mono v2025.7.1. This release contains the following API changes: * Introduction of `SmartContractInterfaces`: we've now exposed endpoints for uploading ABIs and IDLs to help secure EVM and Solana signing flows. For more information, see our docs [here](https://docs.turnkey.com/concepts/policies/smart-contract-interfaces) * Updated dependencies \[[`cb13c26`](https://github.com/tkhq/sdk/commit/cb13c26edb79a01ab651e3b2897334fd154b436a)]: * @turnkey/http\@3.5.1 * @turnkey/crypto\@2.4.3 * @turnkey/wallet-stamper\@1.0.7 ## 5.3.3 ### Patch Changes * [#750](https://github.com/tkhq/sdk/pull/750) [`2c4f42c`](https://github.com/tkhq/sdk/commit/2c4f42c747ac8017cf17e86b0ca0c3fa6f593bbf) Thanks [@moe-dev](https://github.com/moe-dev)! - Surface keyFormat for extractKeyEncryptedBundle in iframe client abstraction ## 5.3.2 ### Patch Changes * Updated dependencies \[[`6cbff7a`](https://github.com/tkhq/sdk/commit/6cbff7a0c0b3a9a05586399e5cef476154d3bdca)]: * @turnkey/crypto\@2.4.3 * @turnkey/wallet-stamper\@1.0.7 ## 5.3.1 ### Patch Changes * [#716](https://github.com/tkhq/sdk/pull/716) [`fa46701`](https://github.com/tkhq/sdk/commit/fa467019eef34b5199372248edff1e7a64934e79) Author [@moeodeh3](https://github.com/moeodeh3) - Updated dependencies * bs58check\@4.0.0 * Updated dependencies \[[`c5cdf82`](https://github.com/tkhq/sdk/commit/c5cdf8229da5da1bd6d52db06b2fe42826e96d57), [`fa46701`](https://github.com/tkhq/sdk/commit/fa467019eef34b5199372248edff1e7a64934e79)]: * @turnkey/crypto\@2.4.2 * @turnkey/wallet-stamper\@1.0.6 ## 5.3.0 ### Minor Changes * [#704](https://github.com/tkhq/sdk/pull/704) [`5f3dd98`](https://github.com/tkhq/sdk/commit/5f3dd9814650308b3bf3198168c453e7b1a98efd) Author [@amircheikh](https://github.com/amircheikh) - Synced with mono 2025.6.10 to include the following endpoints: `update_user_email`: Update a User's email in an existing Organization `update_user_name`: Update a User's name in an existing Organization `update_user_phone_number`: Update a User's phone number in an existing Organization ### Patch Changes * Updated dependencies \[[`5f3dd98`](https://github.com/tkhq/sdk/commit/5f3dd9814650308b3bf3198168c453e7b1a98efd), [`7625df0`](https://github.com/tkhq/sdk/commit/7625df0538002c3455bd5862211210e38472e164), [`878e039`](https://github.com/tkhq/sdk/commit/878e03973856cfec83e6e3fda5b76d1b64943628)]: * @turnkey/http\@3.5.0 * @turnkey/api-key-stamper\@0.4.7 * @turnkey/crypto\@2.4.1 * @turnkey/wallet-stamper\@1.0.5 * @turnkey/indexed-db-stamper\@1.1.1 ## 5.2.3 ### Patch Changes * Updated dependencies \[[`039602a`](https://github.com/tkhq/sdk/commit/039602a015d20783952b992d1d339f5fc003f658)]: * @turnkey/sdk-types\@0.2.1 ## 5.2.2 ### Patch Changes * Updated dependencies \[[`0dd3fc3`](https://github.com/tkhq/sdk/commit/0dd3fc31956992c5b449da5868f6eef8b0bb194c)]: * @turnkey/sdk-types\@0.2.0 ## 5.2.1 ### Patch Changes * Updated dependencies \[[`be0a621`](https://github.com/tkhq/sdk/commit/be0a621fb962bd51d2df1a1e79f5260d7c696772)]: * @turnkey/http\@3.4.2 * @turnkey/crypto\@2.4.0 * @turnkey/wallet-stamper\@1.0.4 ## 5.2.0 ### Minor Changes * [#659](https://github.com/tkhq/sdk/pull/659) [`5afbe51`](https://github.com/tkhq/sdk/commit/5afbe51949bdd1997fad083a4c1e4272ff7409dc) Author [@turnekybc](https://github.com/turnekybc) - export types and models from @turnkey/sdk-browser ### Patch Changes * [#653](https://github.com/tkhq/sdk/pull/653) [`40c4035`](https://github.com/tkhq/sdk/commit/40c40359ec7096d0bca39ffc93e89361b3b11a1a) Thanks [@moe-dev](https://github.com/moe-dev)! - Allow external keys to be passed to resetKeyPair in the indexedDbClient/Stamper enabling refreshing RW sessions * [#663](https://github.com/tkhq/sdk/pull/663) [`593de2d`](https://github.com/tkhq/sdk/commit/593de2d9404ec8cf53426f9cf832c13eefa3fbf2) Thanks [@moe-dev](https://github.com/moe-dev)! - Update to endpoints as per mono v2025.5.7. Add V5 TON address format generation. Non breaking * Updated dependencies \[[`5afbe51`](https://github.com/tkhq/sdk/commit/5afbe51949bdd1997fad083a4c1e4272ff7409dc), [`40c4035`](https://github.com/tkhq/sdk/commit/40c40359ec7096d0bca39ffc93e89361b3b11a1a), [`10ee5c5`](https://github.com/tkhq/sdk/commit/10ee5c524b477ce998e4fc635152cd101ae5a9cc), [`40c4035`](https://github.com/tkhq/sdk/commit/40c40359ec7096d0bca39ffc93e89361b3b11a1a), [`593de2d`](https://github.com/tkhq/sdk/commit/593de2d9404ec8cf53426f9cf832c13eefa3fbf2)]: * @turnkey/wallet-stamper\@1.0.4 * @turnkey/webauthn-stamper\@0.5.1 * @turnkey/encoding\@0.5.0 * @turnkey/crypto\@2.4.0 * @turnkey/indexed-db-stamper\@1.1.0 * @turnkey/http\@3.4.1 * @turnkey/api-key-stamper\@0.4.6 ## 5.1.0 ### Minor Changes * Update @turnkey/sdk-types readme and install dependency in packages with common types * [#650](https://github.com/tkhq/sdk/pull/650) [`27fe590`](https://github.com/tkhq/sdk/commit/27fe590cdc3eb6a8cde093eeefda2ee1cdc79412) Author [@turnekybc](https://github.com/turnekybc) - Update @turnkey/sdk-types readme and install dependency in packages with common types ### Patch Changes * Updated dependencies \[[`27fe590`](https://github.com/tkhq/sdk/commit/27fe590cdc3eb6a8cde093eeefda2ee1cdc79412)]: * @turnkey/sdk-types\@0.1.0 ## 5.0.0 ### Major Changes * [#601](https://github.com/tkhq/sdk/pull/601) [`07dfd33`](https://github.com/tkhq/sdk/commit/07dfd3397472687092e1c73b1d68714f421b9ca0) Author [@moe-dev](https://github.com/moe-dev) This release introduces the new `indexedDbClient`, leveraging the `indexedDbStamper` to securely store cryptographic keys directly in IndexedDB. It provides persistent, secure, non-extractable authentication, replacing legacy iframe-based flows for OTP, passkey, external wallet, and OAuth authentications. ### Key Changes: * **IndexedDB Client (`indexedDbClient`)**: * Offers persistent, tamper-resistant authentication using P-256 keys stored securely in IndexedDB. * Eliminates the need for credential injection via iframes, significantly improving the DevEx and UX of session management. * Provides human-readable sessions through `getSession()`. * **Deprecation Notice**: * Authentication via the `iframeClient` (e.g., `auth.turnkey.com`) is deprecated. Developers should migrate authentication flows to the new IndexedDB-based client. * Existing iframe-based wallet flows (Email Recovery, Import, and Export) remain supported. These enhancements simplify integrations, improve UX, and deliver a more robust client-side experience. ### Patch Changes * Updated dependencies \[[`07dfd33`](https://github.com/tkhq/sdk/commit/07dfd3397472687092e1c73b1d68714f421b9ca0)]: * @turnkey/indexed-db-stamper\@1.0.0 * @turnkey/http\@3.4.0 * @turnkey/crypto\@2.3.1 * @turnkey/wallet-stamper\@1.0.3 ## 4.3.0 ### Minor Changes * 25ca339: Adding replyToEmailAddress field for specifying reply-to when using a customer sender ### Patch Changes * Updated dependencies \[25ca339] * @turnkey/http\@3.3.0 * @turnkey/crypto\@2.3.1 * @turnkey/wallet-stamper\@1.0.3 ## 4.2.0 ### Minor Changes * 3f6e415: Update per mono v2025.4.5 ### Patch Changes * Updated dependencies \[3f6e415] * Updated dependencies \[4d1d775] * @turnkey/http\@3.2.0 * @turnkey/api-key-stamper\@0.4.5 * @turnkey/crypto\@2.3.1 * @turnkey/wallet-stamper\@1.0.3 ## 4.1.0 ### Minor Changes * 3e4a482: Release per mono v2025.4.4 ### Patch Changes * Updated dependencies \[3e4a482] * @turnkey/http\@3.1.0 * @turnkey/crypto\@2.3.1 * @turnkey/wallet-stamper\@1.0.3 ## 4.0.0 ### Major Changes * d1083bd: initOtpAuth now defaults to v2 (breaking) which allows alphanumeric boolean and otpLength (6-9) to be passed. More details below. * This release introduces the `INIT_OTP_AUTH_V2` activity. The difference between it and `INIT_OTP_AUTH` is that it can now accept `alphanumeric` and `otpLength` for selecting crockford bech32 alphanumeric codes and the length of those codes. By default alphanumeric = true, otpLength = 9 * This release introduces `sendFromEmailSenderName` to `INIT_OTP_AUTH`, `INIT_OTP_AUTH_V2`, `EMAIL_AUTH` and `EMAIL_AUTH_V2`. This is an optional custom sender name for use with sendFromEmailAddress; if left empty, will default to 'Notifications'. ### Minor Changes * e501690: Add new utility functions: * Add `clearEmbeddedKey()` async function, which clears the embedded key within an iframe * Add `initEmbeddedKey()` async function, which reinitializes the embedded key within an iframe These can be used in tandem to reset the embedded key within an iframe. See demo video in this PR's description: [https://github.com/tkhq/sdk/pull/571](https://github.com/tkhq/sdk/pull/571) Usage may look like the following: ```javascript theme={"system"} import { Turnkey } from "@turnkey/sdk-browser"; ... // create an instance of TurnkeyBrowserSDK const turnkeyBrowserSDK = new Turnkey(config); // create an instance of TurnkeyIframeClient const iframeClient = await turnkeyBrowserSDK.iframeClient({ iframeContainer: document.getElementById( "turnkey-auth-iframe-container-id", ), iframeUrl: "https://auth.turnkey.com", iframeElementId: "turnkey-auth-iframe-element-id", }); ... // Clear the existing embedded key await iframeClient.clearEmbeddedKey(); const newPublicKey = await iframeClient.initEmbeddedKey(); ``` ### Patch Changes * Updated dependencies \[e501690] * Updated dependencies \[d1083bd] * Updated dependencies \[f94d36e] * @turnkey/iframe-stamper\@2.5.0 * @turnkey/http\@3.0.0 * @turnkey/crypto\@2.3.1 * @turnkey/wallet-stamper\@1.0.3 ## 3.1.0 ### Minor Changes * bf87774: Expose `getEmbeddedPublicKey()` via `TurnkeyIframeClient`. This can be used to fetch the live public key of the target embedded key living within an iframe. Usage may look like the following: ```javascript theme={"system"} import { Turnkey } from "@turnkey/sdk-browser"; // create an instance of TurnkeyBrowserSDK const turnkeyBrowserSDK = new Turnkey(config); // create an instance of TurnkeyIframeClient const iframeClient = await turnkeyBrowserSDK.iframeClient({ iframeContainer: document.getElementById( "turnkey-auth-iframe-container-id", ), iframeUrl: "https://auth.turnkey.com", iframeElementId: "turnkey-auth-iframe-element-id", }); ... const publicKey = await iframeClient.getEmbeddedPublicKey(); ``` Functionally, this can be useful for scenarios where the developer would like to verify whether an iframe has a live embedded key within it. This contrasts from the static `iframeStamper.iframePublicKey` exposed by `@turnkey/iframe-stamper`'s `publicKey()` method. ### Patch Changes * Updated dependencies \[a833088] * @turnkey/iframe-stamper\@2.4.0 ## 3.0.1 ### Patch Changes * 5ec5187: Fix initOtpAuth bug with improper version result (to be updated to V2 following release r2025.3.8) ## 3.0.0 ### Major Changes * 72890f5: ### @turnkey/sdk-browser * Move all type definitions to [`./__types__/base.ts`](https://github.com/tkhq/sdk/blob/494911d948d0a53c0d00aa01e9821aefd5e3f80d/packages/sdk-browser/src/__types__/base.ts) * `TurnkeyBrowserClient` * `refereshSession()` now consumes a [RefreshSessionParams](https://github.com/tkhq/sdk/blob/494911d948d0a53c0d00aa01e9821aefd5e3f80d/packages/sdk-browser/src/__types__/base.ts#L213) parameter * `loginWithBundle()` now consumes a [LoginWithBundleParams](https://github.com/tkhq/sdk/blob/494911d948d0a53c0d00aa01e9821aefd5e3f80d/packages/sdk-browser/src/__types__/base.ts#L219) parameter * `loginWithPasskey()` now consumes a [LoginWithPasskeyParams](https://github.com/tkhq/sdk/blob/494911d948d0a53c0d00aa01e9821aefd5e3f80d/packages/sdk-browser/src/__types__/base.ts#L224) parameter * `loginWithWallet()` now consumes a [LoginWithWalletParams](https://github.com/tkhq/sdk/blob/494911d948d0a53c0d00aa01e9821aefd5e3f80d/packages/sdk-browser/src/__types__/base.ts#L231) parameter ### @turnkey/sdk-react * `Auth.tsx` * updated `passkeyClient?.loginWithPasskey()` to implement new method signature * updated `walletClient?.loginWithWallet()` to implement new method signature ### @turnkey/sdk-server * Move all type definitions to [`./__types__/base.ts`](https://github.com/tkhq/sdk/blob/494911d948d0a53c0d00aa01e9821aefd5e3f80d/packages/sdk-server/src/__types__/base.ts) ### Minor Changes * ecdb29a: Update API as per mono v2025.3.2 - Add CREATE\_USERS\_V3 ### Patch Changes * 0e4e959: bump update policy activity to v2 * 856f449: update `TurnkeyBrowserClient.login()` to align with other functions like `loginWithPasskey()` and `loginWithWallet()` * d4ce5fa: fix unexpected error when using read-only session type when calling loginWithPasskey & loginWithWallet * Updated dependencies \[ecdb29a] * @turnkey/http\@2.22.0 * @turnkey/crypto\@2.3.1 * @turnkey/wallet-stamper\@1.0.3 ## 2.0.0 ### Major Changes * 93540e7: ## Major Package Updates ### @turnkey/sdk-browser * create abstract `TurnkeyBaseClient` class which extends `TurnkeySDKClientBase` * `TurnkeyBrowserClient`, `TurnkeyIframeClient`, `TurnkeyPasskeyClient`, and `TurnkeyWalletClient` all extend `TurnkeyBaseClient` * TurnkeyBrowserClient * Session Management * `refreshSession` - attempts to refresh an existing, active session and will extend the session expiry using the `expirationSeconds` parameter * loginWithBundle - authenticate a user via a credential bundle and creates a read-write session * loginWithPasskey - attempts to authenticate a user via passkey and create a read-only or read-write session * loginWithSession - takes a `Session`, which can be either read-only or read-write, created via a server action and attempts to authenticate the user * TurnkeyPasskeyClient * Session Management * createPasskeySession - leverages passkey authentication to create a read-write session. Once authenticated, the user will not be prompted for additional passkey taps. ### @turnkey/sdk-react * update `TurnkeyContext` to use new `.getSession()` method to check if there is an active session * `OTPVerification` component no longer receives `authIframeClient` or `onValidateSuccess` props ## Minor Package Updates ### @turnkey/sdk-server * expose `sendCredential` server action * add `SessionType` enum * `READ_ONLY` & `READ_WRITE` ### @turnkey/eip-1193-provider * update dependencies in `package.json` * moved from `peerDependencies` to `dependencies` * `"@turnkey/http": "workspace:*"` * `"@turnkey/sdk-browser": "workspace:*"` * moved from `devDependencies` to `dependencies` * `"@turnkey/api-key-stamper": "workspace:*"` * specify TypeScript version ^5.1.5 ### Minor Changes * 9147962: add dangerouslyOverrideIframeKeyTtl option to override iframe embedded key TTL (for longer lived read/write sessions) ### Patch Changes * Updated dependencies \[9147962] * @turnkey/iframe-stamper\@2.3.0 * @turnkey/crypto\@2.3.1 ## 1.16.0 ### Minor Changes * 233ae71: Add updateUserAuth, addUserAuth, deleteUserAuth helper functions ### Patch Changes * @turnkey/crypto\@2.3.1 ## 1.15.0 ### Minor Changes * 56a307e: Update api to mono v2025.3.0 ### Patch Changes * Updated dependencies \[56a307e] * @turnkey/http\@2.21.0 * @turnkey/crypto\@2.3.1 * @turnkey/wallet-stamper\@1.0.3 ## 1.14.0 ### Minor Changes * 3c44c4a: Updates per mono release v2025.2.2 ### Patch Changes * Updated dependencies \[3c44c4a] * @turnkey/http\@2.20.0 * @turnkey/crypto\@2.3.1 * @turnkey/wallet-stamper\@1.0.3 ## 1.13.0 ### Minor Changes * 57f9cb0: Update endpoints - surface GetWalletAccount ### Patch Changes * 69d2571: Upgrade elliptic * Updated dependencies \[57f9cb0] * @turnkey/http\@2.19.0 * @turnkey/crypto\@2.3.1 * @turnkey/wallet-stamper\@1.0.3 ## 1.12.1 ### Patch Changes * 755833b: refactor stamper out of config object and move it directly onto the client to match @turnkey/http * Updated dependencies \[2bc0046] * @turnkey/crypto\@2.3.1 * @turnkey/wallet-stamper\@1.0.3 ## 1.12.0 ### Minor Changes * 6695af2: Update per mono release v2025.1.11 ### Patch Changes * Updated dependencies \[6695af2] * @turnkey/http\@2.18.0 * @turnkey/crypto\@2.3.0 * @turnkey/wallet-stamper\@1.0.2 ## 1.11.2 ### Patch Changes * 053fbfb: Update mono dependencies * Updated dependencies \[053fbfb] * Updated dependencies \[a216a47] * @turnkey/http\@2.17.3 * @turnkey/iframe-stamper\@2.2.0 * @turnkey/crypto\@2.3.0 * @turnkey/wallet-stamper\@1.0.2 ## 1.11.1 ### Patch Changes * 328d6aa: Add defaultXrpAccountAtIndex helper * b90947e: Update default account exports, surface WalletAccount type * 2d5977b: Update error messaging around api key and target public key usage * fad7c37: @turnkey/iframe-stamper - Implemented MessageChannel API for secure communication between the parent and iframe. @turnkey/sdk-browser - fixed spelling in package.json @turnkey/sdk-server - fixed spelling in package.json * Updated dependencies \[2d5977b] * Updated dependencies \[fad7c37] * @turnkey/api-key-stamper\@0.4.4 * @turnkey/iframe-stamper\@2.1.0 * @turnkey/crypto\@2.3.0 * @turnkey/http\@2.17.2 * @turnkey/wallet-stamper\@1.0.2 ## 1.11.0 ### Minor Changes * 7988bc1: Fix readWrite session to use credentialBundle and add loginWithAuthBundle to create a session when you already have a credentialBundle ### Patch Changes * 538d4fc: Update api endpoints - NEW: User verification, SMS customization params * 12d5aaa: Update TurnkeySDKBrowserConfig type with an optional iframeUrl field. The TurnkeyContext provider will check for an iframeUrl otherwise it will fallback to the default. * Updated dependencies \[c895c8f] * Updated dependencies \[538d4fc] * @turnkey/wallet-stamper\@1.0.2 * @turnkey/http\@2.17.1 * @turnkey/crypto\@2.3.0 ## 1.10.2 ### Patch Changes * Updated dependencies \[668edfa] * @turnkey/crypto\@2.3.0 * @turnkey/wallet-stamper\@1.0.1 ## 1.10.1 ### Patch Changes * Updated dependencies \[78bc39c] * @turnkey/http\@2.17.0 * @turnkey/crypto\@2.2.0 * @turnkey/wallet-stamper\@1.0.0 ## 1.10.0 ### Minor Changes ##### `TurnkeyWalletClient` * Added new `TurnkeyWalletClient` to the `@turnkey/sdk-browser` **Reason**: Allows using the `WalletStamper` with the browser sdk * Added `getPublicKey` method to `TurnkeyWalletClient` **Reason**: Enables easy access to wallet public key for sub-organization creation and future authentication flows * Updated `TurnkeyWalletClient` to use new `WalletInterface` **Reason**: Ensures compatibility with the updated Wallet Stamper interfaces ##### `AuthClient` (new enum) * Introduced a new enum to track which client is authenticated (Passkey, Wallet, Iframe) ##### `TurnkeyBrowserClient`, `TurnkeyIframeClient`, `TurnkeyPasskeyClient`, `TurnkeyWalletClient` * Added a static `authClient` property to base `TurnkeyBrowserClient` to be used by the child classes to track which client was used for the initial authentication ##### `UserSession` interface * Added a new `UserSession` interface which is to be stored in local storage to track the authentication state of the user and to eliminate the need to store the write and read sessions separately. * Added `authClient` in the session object to store the authentication method used in the user's session data. Will be used in the `@turnkey/sdk-react` to determine which client to return. * Added new versioned `UserSession` key: `"@turnkey/session/v1"` ##### `login` and `loginWithReadWriteSession` methods * Updated to use the new `authClient` property to track and store the authentication method used during login ### Patch Changes * Updated dependencies \[8bea78f] * @turnkey/wallet-stamper\@2.0.0 * @turnkey/crypto\@2.2.0 ## 1.9.0 ### Minor Changes * 3dd74ac: Added functionality for constructing and returning stamped requests for all packages * 1e36edf: Support RS256 by default when invoking createUserPasskey * 4df8914: Version bump corresponding to mono release v2024.10.10. More detailed changelog to follow * 11a9e2f: Allow override of WebauthnStamper configuration ### Patch Changes * Updated dependencies \[33e8e03] * Updated dependencies \[d989d46] * Updated dependencies \[4df8914] * @turnkey/crypto\@2.1.0 * @turnkey/http\@2.16.0 ## 1.8.0 ### Minor Changes * 9ebd062: Release OTP functionality ### Patch Changes * Updated dependencies \[9ebd062] * @turnkey/http\@2.15.0 ## 1.7.1 ### Patch Changes * 96d7f99: Update dependencies * Updated dependencies \[e5c4fe9] * Updated dependencies \[96d7f99] * @turnkey/crypto\@2.0.0 * @turnkey/encoding\@0.4.0 * @turnkey/http\@2.14.2 * @turnkey/api-key-stamper\@0.4.3 ## 1.7.0 ### Minor Changes * ff059d5: Add ability to create a read + write session ### Patch Changes * Updated dependencies \[ff059d5] * Updated dependencies \[93666ff] * @turnkey/http\@2.14.1 * @turnkey/crypto\@1.0.0 * @turnkey/encoding\@0.3.0 * @turnkey/api-key-stamper\@0.4.2 ## 1.6.0 ### Minor Changes * c988ed0: Support activity polling (e.g. for awaiting consensus) * \[Breaking] Update the `activityPoller` parameter for configuring polling behavior * Polling continues until either a max number of retries is reached, or if the activity hits a terminal status The shape of the parameter has gone from: ``` { duration: number; timeout: number; } ``` to ``` { intervalMs: number; numRetries: number; } ``` ### Patch Changes * Updated dependencies \[848f8d3] * @turnkey/http\@2.14.0 ## 1.5.0 ### Minor Changes * 1813ed5: Allow `organizationId` override for `TurnkeyBrowserClient.login` with an extra `config` argument ## 1.4.0 ### Minor Changes * bab5393: Add keyformat to key export bundle injection ### Patch Changes * a16073c: Exposes storage APIs used by the sdk for managing users & sessions * 7e7d209: Add authenticatorAttachment option ## 1.3.0 ### Minor Changes * 93dee46: Add create read write session v2 which allows for user targeting directly from stamp or optional userId in intent ### Patch Changes * Updated dependencies \[93dee46] * @turnkey/http\@2.13.0 ## 1.2.4 ### Patch Changes * Updated dependencies \[e2f2e0b] * @turnkey/http\@2.12.3 ## 1.2.3 ### Patch Changes * Fix activity versioning for CREATE\_SUB\_ORGANIZATION (V5=>V6) ## 1.2.2 ### Patch Changes * f4b607f: Verify and pad uncompressed public keys while creating passkey sessions * Updated dependencies * @turnkey/api-key-stamper\@0.4.1 * @turnkey/encoding\@0.2.1 * @turnkey/http\@2.12.2 * @turnkey/crypto\@0.2.1 ## 1.2.1 ### Patch Changes * f17a229: Update to oauth related endpoints to drop jwks uri from oauth providers * Updated dependencies \[f17a229] * @turnkey/http\@2.12.1 ## 1.2.0 ### Minor Changes * Add Email Auth V2 - Optional invalidate exisiting Email Authentication API keys ### Patch Changes * Updated dependencies * @turnkey/http\@2.12.0 ## 1.1.0 ### Minor Changes * Update to use new endpoints. Including CREATE\_READ\_WRITE\_SESSION which allows one shot passkey sessions (returns org information and a credential bundle) and CREATE\_API\_KEYS\_V2 which allows a curve type to be passed (SECP256K1 or P256) ### Patch Changes * Updated dependencies * @turnkey/http\@2.11.0 ## 1.0.0 ### Major Changes * Stable Release: Add Oauth integration. New suborg creation version will now require an oauthProviders field under root users. ## 0.4.1 ### Patch Changes * Updated dependencies * @turnkey/crypto\@0.2.0 ## 0.4.0 ### Minor Changes * e4b29da: Deprecate the `getAuthBundle()` path for passkey sessions and replace it with `getReadWriteSession()` to store authBundles with their expirationTimestamps so applications can better manually manage active writing sessions ## 0.3.0 ### Minor Changes * d409d81: Add support for Passkey Sessions ## 0.2.1 ### Patch Changes * Updated dependencies \[5d0bfde] * Updated dependencies \[2f2d09a] * Updated dependencies \[976663e] * @turnkey/iframe-stamper\@2.0.0 ## 0.2.0 ### Minor Changes * updated syntax ### Patch Changes * Updated dependencies \[5d0bfde] * Updated dependencies \[2f2d09a] * Updated dependencies \[976663e] * @turnkey/iframe-stamper\@2.0.0 ## 0.1.0 ### Minor Changes * Ready for 0.1.0 ## 0.0.1 Initial (experimental) release! This is an alpha release and subject to change. # SDK React Native Source: https://docs.turnkey.com/changelogs/sdk-react-native/readme # @turnkey/sdk-react-native ## 1.5.18 ### Patch Changes * Updated dependencies \[]: * @turnkey/crypto\@2.8.12 * @turnkey/api-key-stamper\@0.6.3 * @turnkey/http\@3.17.1 * @turnkey/react-native-passkey-stamper\@1.2.11 ## 1.5.17 ### Patch Changes * Updated dependencies \[[`1f6e240`](https://github.com/tkhq/sdk/commit/1f6e2403fca1fd9cbca646f88c88dbc49ddb0c34), [`58e04e5`](https://github.com/tkhq/sdk/commit/58e04e5856626d9d2593abb61d8ca32d8ccbb833), [`7458b7c`](https://github.com/tkhq/sdk/commit/7458b7cd6fc64796b376e3374b7c2ed79467459c)]: * @turnkey/http\@3.17.0 * @turnkey/crypto\@2.8.11 * @turnkey/react-native-passkey-stamper\@1.2.10 * @turnkey/api-key-stamper\@0.6.2 ## 1.5.16 ### Patch Changes * Updated dependencies \[[`dced9db`](https://github.com/tkhq/sdk/commit/dced9dbbd8ea533442e19e45ce36e6a05a45a555)]: * @turnkey/http\@3.16.3 * @turnkey/react-native-passkey-stamper\@1.2.9 ## 1.5.15 ### Patch Changes * Updated dependencies \[]: * @turnkey/crypto\@2.8.10 * @turnkey/api-key-stamper\@0.6.1 * @turnkey/http\@3.16.2 * @turnkey/react-native-passkey-stamper\@1.2.8 ## 1.5.14 ### Patch Changes * Updated dependencies \[[`d0dba04`](https://github.com/tkhq/sdk/commit/d0dba0412fa7b0c7c9b135e73cc0ef6f55187314), [`91d6a9e`](https://github.com/tkhq/sdk/commit/91d6a9eb1b9ac9e21745749615ac7a7be66f5cf6)]: * @turnkey/crypto\@2.8.9 * @turnkey/api-key-stamper\@0.6.0 * @turnkey/http\@3.16.1 * @turnkey/react-native-passkey-stamper\@1.2.7 ## 1.5.13 ### Patch Changes * Updated dependencies \[[`78ec1d9`](https://github.com/tkhq/sdk/commit/78ec1d9afcafde3ca7107fc720323d486d6afaea)]: * @turnkey/http\@3.16.0 * @turnkey/crypto\@2.8.8 * @turnkey/react-native-passkey-stamper\@1.2.6 ## 1.5.12 ### Patch Changes * Updated dependencies \[]: * @turnkey/crypto\@2.8.7 ## 1.5.11 ### Patch Changes * Updated dependencies \[]: * @turnkey/crypto\@2.8.6 ## 1.5.10 ### Patch Changes * Updated dependencies \[[`5f829c6`](https://github.com/tkhq/sdk/commit/5f829c67af03bb85c3806acd202b2debf8274e78), [`67b03a5`](https://github.com/tkhq/sdk/commit/67b03a5d9ab1b6eabfb0b41938ac91365b5dcd9b)]: * @turnkey/crypto\@2.8.5 * @turnkey/http\@3.15.0 * @turnkey/react-native-passkey-stamper\@1.2.5 ## 1.5.9 ### Patch Changes * Updated dependencies \[[`9fbd5c4`](https://github.com/tkhq/sdk/commit/9fbd5c459782dc3721dd0935d0a4458babce258b)]: * @turnkey/http\@3.14.0 * @turnkey/crypto\@2.8.4 * @turnkey/react-native-passkey-stamper\@1.2.4 ## 1.5.8 ### Patch Changes * Updated dependencies \[[`c745646`](https://github.com/tkhq/sdk/commit/c745646ae4b2a275e116abca07c6e108f89beb04)]: * @turnkey/crypto\@2.8.4 ## 1.5.7 ### Patch Changes * [#1027](https://github.com/tkhq/sdk/pull/1027) [`6e25b17`](https://github.com/tkhq/sdk/commit/6e25b171365707a2653dcf171dd4b14d4291838e) Author [@moeodeh3](https://github.com/moeodeh3) - Expand peer dependency range to include newer versions of `react-native-keychain` ## 1.5.6 ### Patch Changes * Updated dependencies \[[`5c4495b`](https://github.com/tkhq/sdk/commit/5c4495bff1b0abfe3c427ead1b8e1a8d510c8186)]: * @turnkey/crypto\@2.8.3 ## 1.5.5 ### Patch Changes * [#1015](https://github.com/tkhq/sdk/pull/1015) [`429e4c4`](https://github.com/tkhq/sdk/commit/429e4c4b5d897a7233584d4ec429b21bba7a1f2b) Author [@moeodeh3](https://github.com/moeodeh3) - Update react-native-passkey to the latest version for Expo 54 compatibility * Updated dependencies \[[`9df42ad`](https://github.com/tkhq/sdk/commit/9df42adc02c7ff77afba3b938536e79b57882ef1), [`429e4c4`](https://github.com/tkhq/sdk/commit/429e4c4b5d897a7233584d4ec429b21bba7a1f2b)]: * @turnkey/http\@3.13.1 * @turnkey/react-native-passkey-stamper\@1.2.3 * @turnkey/crypto\@2.8.2 ## 1.5.4 ### Patch Changes * Updated dependencies \[]: * @turnkey/crypto\@2.8.1 ## 1.5.3 ### Patch Changes * Updated dependencies \[[`3997c0f`](https://github.com/tkhq/sdk/commit/3997c0fd08a8a85108acf904c0bf39d69f8dc79c)]: * @turnkey/crypto\@2.8.0 ## 1.5.2 ### Patch Changes * Updated dependencies \[[`4567059`](https://github.com/tkhq/sdk/commit/45670598f102223925b87a5295edca15a6ce8241)]: * @turnkey/http\@3.13.0 * @turnkey/crypto\@2.7.0 * @turnkey/react-native-passkey-stamper\@1.2.2 ## 1.5.1 ### Patch Changes * Updated dependencies \[[`2191a1b`](https://github.com/tkhq/sdk/commit/2191a1b201fb17dea4c79cf9e02b3a493b18f97a), [`5a96fe8`](https://github.com/tkhq/sdk/commit/5a96fe80db4c4c45e09ad8c613695ee4c2b8e51f)]: * @turnkey/crypto\@2.7.0 * @turnkey/http\@3.12.1 * @turnkey/react-native-passkey-stamper\@1.2.1 ## 1.5.0 ### Minor Changes * Updated dependencies \[[`fc1d6e2`](https://github.com/tkhq/sdk/commit/fc1d6e2d26f4a53116633e9e8cccccd792267f4e), [`fc1d6e2`](https://github.com/tkhq/sdk/commit/fc1d6e2d26f4a53116633e9e8cccccd792267f4e), [`4880f26`](https://github.com/tkhq/sdk/commit/4880f26a4dd324c049bff7f35284098ccfc55823), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`06347ad`](https://github.com/tkhq/sdk/commit/06347adfa08fb0867c350e43821d0fed06c49624), [`6bfcbc5`](https://github.com/tkhq/sdk/commit/6bfcbc5c098e64ab1d115518733b87cfc1653e17)]: * @turnkey/encoding\@0.6.0 * @turnkey/http\@3.12.0 * @turnkey/crypto\@2.6.0 * @turnkey/react-native-passkey-stamper\@1.2.0 * @turnkey/api-key-stamper\@0.5.0 ## 1.5.0-beta.1 ### Patch Changes * Updated dependencies \[]: * @turnkey/encoding\@0.6.0-beta.6 * @turnkey/crypto\@2.6.0-beta.6 * @turnkey/api-key-stamper\@0.5.0-beta.6 * @turnkey/http\@3.11.1-beta.0 * @turnkey/react-native-passkey-stamper\@1.2.0-beta.1 ## 1.5.0-beta.0 ### Minor Changes * SDK beta release @turnkey/react-wallet-kit @turnkey/core ### Patch Changes * Updated dependencies \[]: * @turnkey/react-native-passkey-stamper\@1.2.0-beta.0 * @turnkey/api-key-stamper\@0.5.0-beta.5 * @turnkey/encoding\@0.6.0-beta.5 * @turnkey/crypto\@2.6.0-beta.5 * @turnkey/http\@3.10.0-beta.2 ## 1.4.4 ### Patch Changes * Updated dependencies \[[`026264c`](https://github.com/tkhq/sdk/commit/026264c55aa16342c8925af0bdcdf72dc00e5158), [`d7420e6`](https://github.com/tkhq/sdk/commit/d7420e6c3559efc1024b58749b31d253150cb189)]: * @turnkey/http\@3.11.0 * @turnkey/crypto\@2.6.0 * @turnkey/react-native-passkey-stamper\@1.1.4 ## 1.4.3 ### Patch Changes * Updated dependencies \[[`5d8be2d`](https://github.com/tkhq/sdk/commit/5d8be2d0329070c7aa025dddb1b28f04257ae4e6)]: * @turnkey/http\@3.10.0 * @turnkey/crypto\@2.5.0 * @turnkey/react-native-passkey-stamper\@1.1.3 ## 1.4.2-beta.4 ### Patch Changes * Updated dependencies \[]: * @turnkey/encoding\@0.6.0-beta.4 * @turnkey/http\@3.10.0-beta.1 * @turnkey/api-key-stamper\@0.4.8-beta.4 * @turnkey/crypto\@2.5.1-beta.4 * @turnkey/react-native-passkey-stamper\@1.1.2-beta.4 ## 1.4.2-beta.3 ### Patch Changes * Updated dependencies \[]: * @turnkey/encoding\@0.6.0-beta.3 * @turnkey/http\@3.10.0-beta.0 * @turnkey/api-key-stamper\@0.4.8-beta.3 * @turnkey/crypto\@2.5.1-beta.3 * @turnkey/react-native-passkey-stamper\@1.1.2-beta.3 ## 1.4.2-beta.2 ### Patch Changes * Updated dependencies \[]: * @turnkey/encoding\@0.6.0-beta.2 * @turnkey/api-key-stamper\@0.4.8-beta.2 * @turnkey/crypto\@2.5.1-beta.2 * @turnkey/http\@3.8.1-beta.2 * @turnkey/react-native-passkey-stamper\@1.1.2-beta.2 ## 1.4.2-beta.1 ### Patch Changes * Updated dependencies \[]: * @turnkey/encoding\@0.6.0-beta.1 * @turnkey/api-key-stamper\@0.4.8-beta.1 * @turnkey/crypto\@2.5.1-beta.1 * @turnkey/http\@3.8.1-beta.1 * @turnkey/react-native-passkey-stamper\@1.1.2-beta.1 ## 1.4.2-beta.0 ### Patch Changes * Updated dependencies \[]: * @turnkey/encoding\@1.0.0-beta.0 * @turnkey/api-key-stamper\@0.4.8-beta.0 * @turnkey/crypto\@2.5.1-beta.0 * @turnkey/http\@3.8.1-beta.0 * @turnkey/react-native-passkey-stamper\@1.1.2-beta.0 ## 1.4.2 ### Patch Changes * Updated dependencies \[[`8b39dba`](https://github.com/tkhq/sdk/commit/8b39dbabf68d3e376b5b07f26960d5b61ae87fa9)]: * @turnkey/http\@3.9.0 * @turnkey/crypto\@2.5.0 * @turnkey/react-native-passkey-stamper\@1.1.2 ## 1.4.1 ### Patch Changes * Updated dependencies \[[`f83f25b`](https://github.com/tkhq/sdk/commit/f83f25ba33ef15dbd66723531eebe2fd00f43ac0)]: * @turnkey/http\@3.8.0 * @turnkey/crypto\@2.5.0 * @turnkey/react-native-passkey-stamper\@1.1.1 ## 1.4.0 ### Minor Changes * [#651](https://github.com/tkhq/sdk/pull/651) [`81e355c`](https://github.com/tkhq/sdk/commit/81e355c9a8321feffcac056916b65139cf35eeed) Author [@turnekybc](https://github.com/turnekybc) - Add Coinbase & MoonPay Fiat Onramp. View the [Fiat Onramp feature docs](https://docs.turnkey.com/wallets/fiat-on-ramp). ### Patch Changes * Updated dependencies \[[`81e355c`](https://github.com/tkhq/sdk/commit/81e355c9a8321feffcac056916b65139cf35eeed), [`6cde41c`](https://github.com/tkhq/sdk/commit/6cde41cfecdfb7d54abf52cc65e28ef0e2ad6ba3)]: * @turnkey/react-native-passkey-stamper\@1.1.0 * @turnkey/http\@3.7.0 * @turnkey/crypto\@2.5.0 ## 1.3.7 ### Patch Changes * Updated dependencies \[[`e90a478`](https://github.com/tkhq/sdk/commit/e90a478c9208d858b1144df9b2c2c7ba956c406e)]: * @turnkey/http\@3.6.0 * @turnkey/crypto\@2.4.3 * @turnkey/react-native-passkey-stamper\@1.0.19 ## 1.3.6 ### Patch Changes * Updated dependencies \[[`cb13c26`](https://github.com/tkhq/sdk/commit/cb13c26edb79a01ab651e3b2897334fd154b436a)]: * @turnkey/http\@3.5.1 * @turnkey/crypto\@2.4.3 * @turnkey/react-native-passkey-stamper\@1.0.18 ## 1.3.5 ### Patch Changes * Updated dependencies \[[`6cbff7a`](https://github.com/tkhq/sdk/commit/6cbff7a0c0b3a9a05586399e5cef476154d3bdca)]: * @turnkey/crypto\@2.4.3 ## 1.3.4 ### Patch Changes * [#711](https://github.com/tkhq/sdk/pull/711) [`22dc1aa`](https://github.com/tkhq/sdk/commit/22dc1aa3f289ddc5818fb7328235eaa873f8f367) Author [@moeodeh3](https://github.com/moeodeh3) - Added `onInitialized`. A callback function that runs when context initialization is complete, useful for notifying connected apps. * Updated dependencies \[[`c5cdf82`](https://github.com/tkhq/sdk/commit/c5cdf8229da5da1bd6d52db06b2fe42826e96d57), [`fa46701`](https://github.com/tkhq/sdk/commit/fa467019eef34b5199372248edff1e7a64934e79)]: * @turnkey/crypto\@2.4.2 ## 1.3.3 ### Patch Changes * Updated dependencies \[[`5f3dd98`](https://github.com/tkhq/sdk/commit/5f3dd9814650308b3bf3198168c453e7b1a98efd), [`7625df0`](https://github.com/tkhq/sdk/commit/7625df0538002c3455bd5862211210e38472e164), [`878e039`](https://github.com/tkhq/sdk/commit/878e03973856cfec83e6e3fda5b76d1b64943628)]: * @turnkey/http\@3.5.0 * @turnkey/api-key-stamper\@0.4.7 * @turnkey/crypto\@2.4.1 * @turnkey/react-native-passkey-stamper\@1.0.17 ## 1.3.2 ### Patch Changes * Updated dependencies \[[`be0a621`](https://github.com/tkhq/sdk/commit/be0a621fb962bd51d2df1a1e79f5260d7c696772)]: * @turnkey/http\@3.4.2 * @turnkey/crypto\@2.4.0 * @turnkey/react-native-passkey-stamper\@1.0.16 ## 1.3.1 ### Patch Changes * Updated dependencies \[[`40c4035`](https://github.com/tkhq/sdk/commit/40c40359ec7096d0bca39ffc93e89361b3b11a1a), [`10ee5c5`](https://github.com/tkhq/sdk/commit/10ee5c524b477ce998e4fc635152cd101ae5a9cc), [`593de2d`](https://github.com/tkhq/sdk/commit/593de2d9404ec8cf53426f9cf832c13eefa3fbf2)]: * @turnkey/encoding\@0.5.0 * @turnkey/crypto\@2.4.0 * @turnkey/http\@3.4.1 * @turnkey/api-key-stamper\@0.4.6 * @turnkey/react-native-passkey-stamper\@1.0.15 ## 1.3.0 ### Minor Changes * [#622](https://github.com/tkhq/sdk/pull/622) [`59f8941`](https://github.com/tkhq/sdk/commit/59f8941f77e548e248b2fdafcad36f5f0c2a5d29) Author [@moeodeh3](https://github.com/moeodeh3) - Added support for React 19 Renamed `sessionKey` parameter to `storageKey` in `createEmbeddedKey` `saveEmbeddedKey` and `getEmbeddedKey`. Added optional `embeddedStorageKey` parameter to `createSession`. This allows for retrieval of the embedded key from a custom location in secure storage. ### Patch Changes * [#641](https://github.com/tkhq/sdk/pull/641) [`77611c8`](https://github.com/tkhq/sdk/commit/77611c8f15aa16b316d81ee6addab62d86f2f3bc) Author [@amircheikh](https://github.com/amircheikh) - Added `onSessionEmpty`. A callback function that runs when there is no active session on app launch. * Updated dependencies \[[`07dfd33`](https://github.com/tkhq/sdk/commit/07dfd3397472687092e1c73b1d68714f421b9ca0)]: * @turnkey/http\@3.4.0 * @turnkey/crypto\@2.3.1 * @turnkey/react-native-passkey-stamper\@1.0.14 ## 1.2.3 ### Patch Changes * Updated dependencies \[25ca339] * @turnkey/http\@3.3.0 * @turnkey/crypto\@2.3.1 * @turnkey/react-native-passkey-stamper\@1.0.13 ## 1.2.2 ### Patch Changes * ef399e1: - Eliminated a race condition in `refreshSession` that could throw: `TurnkeyReactNativeError: Embedded key not found when refreshing the session` * The embedded key is now generated entirely in memory using `generateP256KeyPair` * Removed the need to store and immediately retrieve the private key from secure storage * `refreshSession` now accepts a single optional parameter object * `StorageKeys.RefreshEmbeddedKey` is now deprecated and no longer used during session refresh * Updated dependencies \[3f6e415] * Updated dependencies \[4d1d775] * @turnkey/http\@3.2.0 * @turnkey/api-key-stamper\@0.4.5 * @turnkey/crypto\@2.3.1 * @turnkey/react-native-passkey-stamper\@1.0.12 ## 1.2.1 ### Patch Changes * Updated dependencies \[3e4a482] * @turnkey/http\@3.1.0 * @turnkey/crypto\@2.3.1 * @turnkey/react-native-passkey-stamper\@1.0.11 ## 1.2.0 ### Minor Changes * ab45d29: Added `createSessionFromEmbeddedKey` function. This allows creation of a session using a compressed embedded key stored by calling `createEmbeddedKey`. You may also optionally pass in an embedded key created seperately. Utilizing these two functions with a `createSuborg` api call allows for a '1 tap' passkey sign up flow [(example)](https://github.com/tkhq/react-native-demo-wallet/blob/ccf2d6c182b9e5c5ce98014a56b0b9f4282277c2/providers/auth-provider.tsx#L186). Added optional `isCompressed` boolean field to the `createEmbeddedKey` function. This field is necessary for calling `createSessionFromEmbeddedKey`. ## 1.1.0 ### Minor Changes * e8bc05b: Introduces handleGoogleOAuth(): Adds a utility function to handle the Google OAuth authentication flow in React Native. **Usage Summary**:\ `handleGoogleOAuth` launches an InAppBrowser to initiate the OAuth flow using your client ID, nonce, and app scheme. After a successful login, it extracts the `oidcToken` from the redirect URL and calls your `onSuccess` callback with the token. ```ts theme={"system"} handleGoogleOAuth({ clientId: string, // Google OAuth client ID nonce: string, // Random nonce scheme: string, // App’s custom URL scheme (e.g., "myapp") originUri?: string, // Optional custom origin URI - defaults to Turnkey proxies redirectUri?: string, // Optional custom redirect URI - defaults to Turnkey proxies onSuccess: (oidcToken: string) => void, // Called with token on success }); ``` ## 1.0.5 ### Patch Changes * 3b5b360: - Adds optional parameter for createEmbeddedKey(): * You can now pass a sessionKey to createEmbeddedKey() to generate separate embedded keys for different sessions, which is helpful when running multiple authentication flows concurrently. * Introduces onSessionExpiryWarning(): * You can now add a callback via the provider config that triggers 15 seconds before a session expires. * Introduces refreshSession(): * You now can refresh an active session that is about to expire. ## 1.0.4 ### Patch Changes * Updated dependencies \[d1083bd] * Updated dependencies \[f94d36e] * @turnkey/http\@3.0.0 * @turnkey/crypto\@2.3.1 ## 1.0.3 ### Minor Changes * a7e7de0: Fixed compatibility issue with `@turnkey/viem` ## 1.0.2 ### Patch Changes * Updated dependencies \[ecdb29a] * @turnkey/http\@2.22.0 * @turnkey/crypto\@2.3.1 ## 1.0.1 ### Patch Changes * Updated dependencies \[56a307e] * @turnkey/http\@2.21.0 * @turnkey/crypto\@2.3.1 ## 1.0.0 ### Major Changes * fcf9503: This breaking change adds support for multiple sessions: * The concept of a **selected session** has been introduced: * Users can switch between sessions using `setSelectedSession({ sessionKey: })`. * The selected session determines the active `client`, `user`, and `session` state. * API calls such as `updateUser`, `createWallet`, and `signRawPayload` now apply to the selected session. * A session limit of **15 active sessions** has been enforced: * If the limit is reached, users must remove an existing session before creating a new one. * Expired or invalid sessions are automatically cleaned up. ## 0.1.1 ### Patch Changes * Updated dependencies \[3c44c4a] * @turnkey/http\@2.20.0 * @turnkey/crypto\@2.3.1 # SDK React Source: https://docs.turnkey.com/changelogs/sdk-react/readme # @turnkey/sdk-react ## 5.5.6 ### Patch Changes * Updated dependencies \[[`dfdd864`](https://github.com/tkhq/sdk/commit/dfdd8647266fdd0297aaea32046ee815ae8fc27c)]: * @turnkey/sdk-types\@0.12.1 * @turnkey/crypto\@2.8.12 * @turnkey/sdk-browser\@5.15.2 * @turnkey/wallet-stamper\@1.1.14 * @turnkey/sdk-server\@5.1.1 ## 5.5.5 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-browser\@5.15.1 ## 5.5.4 ### Patch Changes * Updated dependencies \[[`1f6e240`](https://github.com/tkhq/sdk/commit/1f6e2403fca1fd9cbca646f88c88dbc49ddb0c34), [`58e04e5`](https://github.com/tkhq/sdk/commit/58e04e5856626d9d2593abb61d8ca32d8ccbb833), [`7458b7c`](https://github.com/tkhq/sdk/commit/7458b7cd6fc64796b376e3374b7c2ed79467459c)]: * @turnkey/sdk-browser\@5.15.0 * @turnkey/sdk-server\@5.1.0 * @turnkey/sdk-types\@0.12.0 * @turnkey/crypto\@2.8.11 * @turnkey/wallet-stamper\@1.1.13 ## 5.5.3 ### Patch Changes * Updated dependencies \[[`dced9db`](https://github.com/tkhq/sdk/commit/dced9dbbd8ea533442e19e45ce36e6a05a45a555)]: * @turnkey/sdk-browser\@5.14.3 * @turnkey/sdk-server\@5.0.3 * @turnkey/wallet-stamper\@1.1.12 ## 5.5.2 ### Patch Changes * [#1185](https://github.com/tkhq/sdk/pull/1185) [`9ac70dd`](https://github.com/tkhq/sdk/commit/9ac70ddbf89b30f339085f86a95e9bacb294b5a4) Author [@moeodeh3](https://github.com/moeodeh3) - Bump `NextJS` to 15.5.10 to address [https://github.com/advisories/GHSA-h25m-26qc-wcjf](https://github.com/advisories/GHSA-h25m-26qc-wcjf) * Updated dependencies \[[`8e075b7`](https://github.com/tkhq/sdk/commit/8e075b7161ccc68cb446b10b54737856fa0c6d31), [`4742eaf`](https://github.com/tkhq/sdk/commit/4742eafbfdcc6fe6b6d3aab01569ad94a5198571)]: * @turnkey/sdk-types\@0.11.2 * @turnkey/sdk-server\@5.0.2 * @turnkey/crypto\@2.8.10 * @turnkey/sdk-browser\@5.14.2 * @turnkey/wallet-stamper\@1.1.12 ## 5.5.1 ### Patch Changes * Updated dependencies \[[`d0dba04`](https://github.com/tkhq/sdk/commit/d0dba0412fa7b0c7c9b135e73cc0ef6f55187314), [`91d6a9e`](https://github.com/tkhq/sdk/commit/91d6a9eb1b9ac9e21745749615ac7a7be66f5cf6)]: * @turnkey/crypto\@2.8.9 * @turnkey/sdk-types\@0.11.1 * @turnkey/sdk-browser\@5.14.1 * @turnkey/wallet-stamper\@1.1.11 * @turnkey/sdk-server\@5.0.1 ## 5.5.0 ### Minor Changes * [#1153](https://github.com/tkhq/sdk/pull/1153) [`78ec1d9`](https://github.com/tkhq/sdk/commit/78ec1d9afcafde3ca7107fc720323d486d6afaea) Thanks [@moe-dev](https://github.com/moe-dev)! - Deprecated auth component. Developers should use @turnkey/react-wallet-kit instead ### Patch Changes * Updated dependencies \[[`78ec1d9`](https://github.com/tkhq/sdk/commit/78ec1d9afcafde3ca7107fc720323d486d6afaea), [`dbd4d8e`](https://github.com/tkhq/sdk/commit/dbd4d8e4ea567240c4d287452dd0d8f53050beca), [`cfd34ab`](https://github.com/tkhq/sdk/commit/cfd34ab14ff2abed0e22dca9a802c58a96b9e8e1), [`78ec1d9`](https://github.com/tkhq/sdk/commit/78ec1d9afcafde3ca7107fc720323d486d6afaea)]: * @turnkey/sdk-server\@5.0.0 * @turnkey/sdk-browser\@5.14.0 * @turnkey/sdk-types\@0.11.0 * @turnkey/crypto\@2.8.8 * @turnkey/wallet-stamper\@1.1.10 ## 5.4.19 ### Patch Changes * Updated dependencies \[[`29a42db`](https://github.com/tkhq/sdk/commit/29a42db8f5f3ef8b9c23c90cd00f4c21027aac2e)]: * @turnkey/sdk-types\@0.10.0 * @turnkey/crypto\@2.8.7 * @turnkey/sdk-browser\@5.13.6 * @turnkey/wallet-stamper\@1.1.9 * @turnkey/sdk-server\@4.12.2 ## 5.4.18 ### Patch Changes * [#1142](https://github.com/tkhq/sdk/pull/1142) [`e8bc3d3`](https://github.com/tkhq/sdk/commit/e8bc3d381734dbf12cac1e6317e1a251a9600114) Author [@andrewkmin](https://github.com/andrewkmin) - Bump `NextJS` to 15.5.9 to address [https://github.com/advisories/GHSA-5j59-xgg2-r9c4](https://github.com/advisories/GHSA-5j59-xgg2-r9c4) ## 5.4.17 ### Patch Changes * [#1140](https://github.com/tkhq/sdk/pull/1140) [`28c0e5c`](https://github.com/tkhq/sdk/commit/28c0e5c52a5b55a3459d43493c3fab3dcf70f8de) Author [@andrewkmin](https://github.com/andrewkmin) - Bump `Next.js` to `15.5.8` to address [https://github.com/advisories/GHSA-mwv6-3258-q52c](https://github.com/advisories/GHSA-mwv6-3258-q52c). ## 5.4.16 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-browser\@5.13.5 ## 5.4.15 ### Patch Changes * [#1120](https://github.com/tkhq/sdk/pull/1120) [`84a9689`](https://github.com/tkhq/sdk/commit/84a96893bd2a0c73496d934499e1645ba4a33b41) Author [@moeodeh3](https://github.com/moeodeh3) - Bump `Next.js` dependency to `15.5.7` to address [Next.js RCE vulnerability in React flight protocol](https://github.com/advisories/GHSA-9qr9-h5gf-34mp) ## 5.4.14 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-browser\@5.13.4 ## 5.4.13 ### Patch Changes * Updated dependencies \[[`80ea306`](https://github.com/tkhq/sdk/commit/80ea306025a2161ff575a5e2b45794460eafdf1b)]: * @turnkey/sdk-types\@0.9.0 * @turnkey/crypto\@2.8.6 * @turnkey/sdk-browser\@5.13.3 * @turnkey/wallet-stamper\@1.1.8 * @turnkey/sdk-server\@4.12.1 ## 5.4.12 ### Patch Changes * Updated dependencies \[[`4d29af2`](https://github.com/tkhq/sdk/commit/4d29af2dd7c735916c650d697f18f66dd76c1b79)]: * @turnkey/sdk-browser\@5.13.2 ## 5.4.11 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-browser\@5.13.1 ## 5.4.10 ### Patch Changes * Updated dependencies \[[`5f829c6`](https://github.com/tkhq/sdk/commit/5f829c67af03bb85c3806acd202b2debf8274e78), [`084acce`](https://github.com/tkhq/sdk/commit/084acce85fe7c15513a025e77c1571012ac82e4b), [`67b03a5`](https://github.com/tkhq/sdk/commit/67b03a5d9ab1b6eabfb0b41938ac91365b5dcd9b)]: * @turnkey/crypto\@2.8.5 * @turnkey/sdk-types\@0.8.0 * @turnkey/sdk-browser\@5.13.0 * @turnkey/sdk-server\@4.12.0 * @turnkey/wallet-stamper\@1.1.7 ## 5.4.9 ### Patch Changes * Updated dependencies \[[`71cdca3`](https://github.com/tkhq/sdk/commit/71cdca3b97ba520dc5327410a1e82cf9ad85fb0e), [`9fbd5c4`](https://github.com/tkhq/sdk/commit/9fbd5c459782dc3721dd0935d0a4458babce258b)]: * @turnkey/sdk-server\@4.11.0 * @turnkey/sdk-browser\@5.12.0 * @turnkey/crypto\@2.8.4 * @turnkey/wallet-stamper\@1.1.6 ## 5.4.8 ### Patch Changes * Updated dependencies \[[`c745646`](https://github.com/tkhq/sdk/commit/c745646ae4b2a275e116abca07c6e108f89beb04)]: * @turnkey/crypto\@2.8.4 * @turnkey/sdk-browser\@5.11.6 * @turnkey/wallet-stamper\@1.1.6 * @turnkey/sdk-server\@4.10.5 ## 5.4.7 ### Patch Changes * Updated dependencies \[[`5c4495b`](https://github.com/tkhq/sdk/commit/5c4495bff1b0abfe3c427ead1b8e1a8d510c8186), [`5c4495b`](https://github.com/tkhq/sdk/commit/5c4495bff1b0abfe3c427ead1b8e1a8d510c8186)]: * @turnkey/crypto\@2.8.3 * @turnkey/sdk-types\@0.6.3 * @turnkey/sdk-browser\@5.11.5 * @turnkey/wallet-stamper\@1.1.5 * @turnkey/sdk-server\@4.10.4 ## 5.4.6 ### Patch Changes * Updated dependencies \[[`9df42ad`](https://github.com/tkhq/sdk/commit/9df42adc02c7ff77afba3b938536e79b57882ef1)]: * @turnkey/sdk-browser\@5.11.4 * @turnkey/sdk-server\@4.10.3 * @turnkey/sdk-types\@0.6.2 * @turnkey/crypto\@2.8.2 * @turnkey/wallet-stamper\@1.1.4 ## 5.4.5 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-browser\@5.11.3 ## 5.4.4 ### Patch Changes * Updated dependencies \[[`68631c4`](https://github.com/tkhq/sdk/commit/68631c4008387f845dfe4f1a139981011727f6c9)]: * @turnkey/sdk-types\@0.6.1 * @turnkey/crypto\@2.8.1 * @turnkey/sdk-browser\@5.11.2 * @turnkey/wallet-stamper\@1.1.3 * @turnkey/sdk-server\@4.10.2 ## 5.4.3 ### Patch Changes * Updated dependencies \[[`3997c0f`](https://github.com/tkhq/sdk/commit/3997c0fd08a8a85108acf904c0bf39d69f8dc79c), [`3997c0f`](https://github.com/tkhq/sdk/commit/3997c0fd08a8a85108acf904c0bf39d69f8dc79c)]: * @turnkey/crypto\@2.8.0 * @turnkey/sdk-types\@0.6.0 * @turnkey/sdk-browser\@5.11.1 * @turnkey/wallet-stamper\@1.1.2 * @turnkey/sdk-server\@4.10.1 ## 5.4.2 ### Patch Changes * Updated dependencies \[[`4567059`](https://github.com/tkhq/sdk/commit/45670598f102223925b87a5295edca15a6ce8241)]: * @turnkey/sdk-browser\@5.11.0 * @turnkey/sdk-server\@4.10.0 * @turnkey/sdk-types\@0.5.0 * @turnkey/crypto\@2.7.0 * @turnkey/wallet-stamper\@1.1.1 ## 5.4.1 ### Patch Changes * Updated dependencies \[[`2191a1b`](https://github.com/tkhq/sdk/commit/2191a1b201fb17dea4c79cf9e02b3a493b18f97a), [`5a96fe8`](https://github.com/tkhq/sdk/commit/5a96fe80db4c4c45e09ad8c613695ee4c2b8e51f)]: * @turnkey/crypto\@2.7.0 * @turnkey/sdk-browser\@5.10.1 * @turnkey/sdk-server\@4.9.1 * @turnkey/sdk-types\@0.4.1 * @turnkey/wallet-stamper\@1.1.1 ## 5.4.0 ### Minor Changes * Updated dependencies \[[`fc1d6e2`](https://github.com/tkhq/sdk/commit/fc1d6e2d26f4a53116633e9e8cccccd792267f4e), [`fc1d6e2`](https://github.com/tkhq/sdk/commit/fc1d6e2d26f4a53116633e9e8cccccd792267f4e), [`4880f26`](https://github.com/tkhq/sdk/commit/4880f26a4dd324c049bff7f35284098ccfc55823), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`06347ad`](https://github.com/tkhq/sdk/commit/06347adfa08fb0867c350e43821d0fed06c49624)]: * @turnkey/sdk-server\@4.9.0 * @turnkey/sdk-types\@0.4.0 * @turnkey/crypto\@2.6.0 * @turnkey/wallet-stamper\@1.1.0 * @turnkey/sdk-browser\@5.10.0 ## 5.4.0-beta.6 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-types\@0.4.0-beta.6 * @turnkey/crypto\@2.6.0-beta.6 * @turnkey/sdk-browser\@5.9.0-beta.1 * @turnkey/wallet-stamper\@1.1.0-beta.6 * @turnkey/sdk-server\@4.8.1-beta.0 ## 5.4.0-beta.5 ### Minor Changes * SDK beta release @turnkey/react-wallet-kit @turnkey/core ### Patch Changes * Updated dependencies \[]: * @turnkey/wallet-stamper\@1.1.0-beta.5 * @turnkey/sdk-browser\@5.9.0-beta.0 * @turnkey/sdk-server\@4.7.0-beta.2 * @turnkey/sdk-types\@0.4.0-beta.5 * @turnkey/crypto\@2.6.0-beta.5 ## 5.4.0-beta.4 ### Minor Changes * @turnkey/react-wallet-kit and @turnkey/core beta-3 release ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-server\@4.7.0-beta.1 * @turnkey/sdk-types\@0.4.0-beta.4 * @turnkey/sdk-browser\@5.7.1-beta.1 * @turnkey/crypto\@2.5.1-beta.4 * @turnkey/wallet-stamper\@1.0.9-beta.4 ## 5.4.0-beta.3 ### Minor Changes * @turnkey/react-wallet-kit and @turnkey/core beta-3 release ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-server\@4.7.0-beta.0 * @turnkey/sdk-types\@0.4.0-beta.3 * @turnkey/sdk-browser\@5.7.1-beta.0 * @turnkey/crypto\@2.5.1-beta.3 * @turnkey/wallet-stamper\@1.0.9-beta.3 ## 5.3.4 ### Patch Changes * Updated dependencies \[[`026264c`](https://github.com/tkhq/sdk/commit/026264c55aa16342c8925af0bdcdf72dc00e5158), [`d7420e6`](https://github.com/tkhq/sdk/commit/d7420e6c3559efc1024b58749b31d253150cb189)]: * @turnkey/sdk-browser\@5.9.0 * @turnkey/sdk-server\@4.8.0 * @turnkey/crypto\@2.6.0 * @turnkey/wallet-stamper\@1.0.9 ## 5.3.3 ### Patch Changes * Updated dependencies \[[`5d8be2d`](https://github.com/tkhq/sdk/commit/5d8be2d0329070c7aa025dddb1b28f04257ae4e6)]: * @turnkey/sdk-browser\@5.8.0 * @turnkey/sdk-server\@4.7.0 * @turnkey/crypto\@2.5.0 * @turnkey/wallet-stamper\@1.0.8 ## 5.3.2-beta.2 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-types\@0.4.0-beta.2 * @turnkey/sdk-browser\@5.6.1-beta.2 * @turnkey/crypto\@2.5.1-beta.2 * @turnkey/wallet-stamper\@1.0.9-beta.2 * @turnkey/sdk-server\@4.5.1-beta.2 ## 5.3.2-beta.1 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-types\@0.4.0-beta.1 * @turnkey/sdk-browser\@5.6.1-beta.1 * @turnkey/crypto\@2.5.1-beta.1 * @turnkey/wallet-stamper\@1.0.9-beta.1 * @turnkey/sdk-server\@4.5.1-beta.1 ## 5.3.2-beta.0 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-types\@1.0.0-beta.0 * @turnkey/sdk-browser\@5.6.1-beta.0 * @turnkey/crypto\@2.5.1-beta.0 * @turnkey/wallet-stamper\@1.0.9-beta.0 * @turnkey/sdk-server\@4.5.1-beta.0 ## 5.3.2 ### Patch Changes * [#833](https://github.com/tkhq/sdk/pull/833) [`1a549b7`](https://github.com/tkhq/sdk/commit/1a549b71f9a6e7ab59d52aaae7e58e34c8f2e8b5) Author [@moeodeh3](https://github.com/moeodeh3) - - Add optional `includeUnverifiedSubOrgs` to `otpConfig` in the Auth component to allow inclusion of unverified subOrgs * Fix `customAccounts` being ignored for subOrgs created through OTP and external wallets * Updated dependencies \[[`8b39dba`](https://github.com/tkhq/sdk/commit/8b39dbabf68d3e376b5b07f26960d5b61ae87fa9), [`1a549b7`](https://github.com/tkhq/sdk/commit/1a549b71f9a6e7ab59d52aaae7e58e34c8f2e8b5)]: * @turnkey/sdk-browser\@5.7.0 * @turnkey/sdk-server\@4.6.0 * @turnkey/crypto\@2.5.0 * @turnkey/wallet-stamper\@1.0.8 ## 5.3.1 ### Patch Changes * Updated dependencies \[[`f83f25b`](https://github.com/tkhq/sdk/commit/f83f25ba33ef15dbd66723531eebe2fd00f43ac0)]: * @turnkey/sdk-browser\@5.6.0 * @turnkey/sdk-server\@4.5.0 * @turnkey/crypto\@2.5.0 * @turnkey/wallet-stamper\@1.0.8 ## 5.3.0 ### Minor Changes * [#651](https://github.com/tkhq/sdk/pull/651) [`81e355c`](https://github.com/tkhq/sdk/commit/81e355c9a8321feffcac056916b65139cf35eeed) Author [@turnekybc](https://github.com/turnekybc) - Add Coinbase & MoonPay Fiat Onramp. View the [Fiat Onramp feature docs](https://docs.turnkey.com/wallets/fiat-on-ramp). ### Patch Changes * Updated dependencies \[[`81e355c`](https://github.com/tkhq/sdk/commit/81e355c9a8321feffcac056916b65139cf35eeed), [`6cde41c`](https://github.com/tkhq/sdk/commit/6cde41cfecdfb7d54abf52cc65e28ef0e2ad6ba3)]: * @turnkey/sdk-browser\@5.5.0 * @turnkey/sdk-server\@4.4.0 * @turnkey/sdk-types\@0.3.0 * @turnkey/crypto\@2.5.0 * @turnkey/wallet-stamper\@1.0.8 ## 5.2.11 ### Patch Changes * [#787](https://github.com/tkhq/sdk/pull/787) [`0d1eb2c`](https://github.com/tkhq/sdk/commit/0d1eb2c464bac3cf6f4386f402604ecf8f373f15) Author [@andrewkmin](https://github.com/andrewkmin) - Add `showTitle` toggle in authConfig for the Auth component to control visibility of the "Log in or Sign up" title. * Updated dependencies \[[`0d1eb2c`](https://github.com/tkhq/sdk/commit/0d1eb2c464bac3cf6f4386f402604ecf8f373f15)]: * @turnkey/sdk-browser\@5.4.1 ## 5.2.10 ### Patch Changes * Updated dependencies \[[`e90a478`](https://github.com/tkhq/sdk/commit/e90a478c9208d858b1144df9b2c2c7ba956c406e)]: * @turnkey/sdk-browser\@5.4.0 * @turnkey/sdk-server\@4.3.0 * @turnkey/crypto\@2.4.3 * @turnkey/wallet-stamper\@1.0.7 ## 5.2.9 ### Patch Changes * Updated dependencies \[[`2db00b0`](https://github.com/tkhq/sdk/commit/2db00b0a799d09ae33fa08a117e3b2f433f2b0b4)]: * @turnkey/sdk-server\@4.2.4 ## 5.2.8 ### Patch Changes * Updated dependencies \[[`cb13c26`](https://github.com/tkhq/sdk/commit/cb13c26edb79a01ab651e3b2897334fd154b436a)]: * @turnkey/sdk-browser\@5.3.4 * @turnkey/sdk-server\@4.2.3 * @turnkey/crypto\@2.4.3 * @turnkey/wallet-stamper\@1.0.7 ## 5.2.7 ### Patch Changes * Updated dependencies \[[`2c4f42c`](https://github.com/tkhq/sdk/commit/2c4f42c747ac8017cf17e86b0ca0c3fa6f593bbf)]: * @turnkey/sdk-browser\@5.3.3 ## 5.2.6 ### Patch Changes * Updated dependencies \[[`6cbff7a`](https://github.com/tkhq/sdk/commit/6cbff7a0c0b3a9a05586399e5cef476154d3bdca)]: * @turnkey/crypto\@2.4.3 * @turnkey/sdk-browser\@5.3.2 * @turnkey/wallet-stamper\@1.0.7 * @turnkey/sdk-server\@4.2.2 ## 5.2.5 ### Patch Changes * Updated dependencies \[[`c5cdf82`](https://github.com/tkhq/sdk/commit/c5cdf8229da5da1bd6d52db06b2fe42826e96d57), [`fa46701`](https://github.com/tkhq/sdk/commit/fa467019eef34b5199372248edff1e7a64934e79), [`fa46701`](https://github.com/tkhq/sdk/commit/fa467019eef34b5199372248edff1e7a64934e79)]: * @turnkey/crypto\@2.4.2 * @turnkey/sdk-browser\@5.3.1 * @turnkey/wallet-stamper\@1.0.6 * @turnkey/sdk-server\@4.2.1 ## 5.2.4 ### Patch Changes * Updated dependencies \[[`5f3dd98`](https://github.com/tkhq/sdk/commit/5f3dd9814650308b3bf3198168c453e7b1a98efd), [`7625df0`](https://github.com/tkhq/sdk/commit/7625df0538002c3455bd5862211210e38472e164), [`878e039`](https://github.com/tkhq/sdk/commit/878e03973856cfec83e6e3fda5b76d1b64943628)]: * @turnkey/sdk-browser\@5.3.0 * @turnkey/sdk-server\@4.2.0 * @turnkey/crypto\@2.4.1 * @turnkey/wallet-stamper\@1.0.5 ## 5.2.3 ### Patch Changes * Updated dependencies \[[`039602a`](https://github.com/tkhq/sdk/commit/039602a015d20783952b992d1d339f5fc003f658)]: * @turnkey/sdk-types\@0.2.1 * @turnkey/sdk-browser\@5.2.3 ## 5.2.2 ### Patch Changes * Updated dependencies \[[`0dd3fc3`](https://github.com/tkhq/sdk/commit/0dd3fc31956992c5b449da5868f6eef8b0bb194c)]: * @turnkey/sdk-types\@0.2.0 * @turnkey/sdk-browser\@5.2.2 ## 5.2.1 ### Patch Changes * Updated dependencies \[]: * @turnkey/crypto\@2.4.0 * @turnkey/sdk-browser\@5.2.1 * @turnkey/sdk-server\@4.1.1 * @turnkey/wallet-stamper\@1.0.4 ## 5.2.0 ### Minor Changes * [#632](https://github.com/tkhq/sdk/pull/632) [`a38a6e3`](https://github.com/tkhq/sdk/commit/a38a6e36dc2bf9abdea64bc817d1cad95b8a289a) Author [@amircheikh](https://github.com/amircheikh) - Added optional `socialLinking` boolean to the `authConfig`. If true, this will enable social linking for new Google \<-> Gmail users. For more information on social linking, visit [our docs](https://docs.turnkey.com/authentication/social-logins#social-linking). ### Patch Changes * Updated dependencies \[[`5afbe51`](https://github.com/tkhq/sdk/commit/5afbe51949bdd1997fad083a4c1e4272ff7409dc), [`10ee5c5`](https://github.com/tkhq/sdk/commit/10ee5c524b477ce998e4fc635152cd101ae5a9cc), [`a38a6e3`](https://github.com/tkhq/sdk/commit/a38a6e36dc2bf9abdea64bc817d1cad95b8a289a), [`40c4035`](https://github.com/tkhq/sdk/commit/40c40359ec7096d0bca39ffc93e89361b3b11a1a), [`593de2d`](https://github.com/tkhq/sdk/commit/593de2d9404ec8cf53426f9cf832c13eefa3fbf2)]: * @turnkey/sdk-browser\@5.2.0 * @turnkey/wallet-stamper\@1.0.4 * @turnkey/crypto\@2.4.0 * @turnkey/sdk-server\@4.1.0 ## 5.1.0 ### Minor Changes * Update @turnkey/sdk-types readme and install dependency in packages with common types * [#650](https://github.com/tkhq/sdk/pull/650) [`27fe590`](https://github.com/tkhq/sdk/commit/27fe590cdc3eb6a8cde093eeefda2ee1cdc79412) Author [@turnekybc](https://github.com/turnekybc) - Update @turnkey/sdk-types readme and install dependency in packages with common types ### Patch Changes * Updated dependencies \[[`27fe590`](https://github.com/tkhq/sdk/commit/27fe590cdc3eb6a8cde093eeefda2ee1cdc79412)]: * @turnkey/sdk-browser\@5.1.0 * @turnkey/sdk-types\@0.1.0 * @turnkey/sdk-server\@4.0.1 ## 5.0.2 ### Patch Changes * [#648](https://github.com/tkhq/sdk/pull/648) [`fd2eb18`](https://github.com/tkhq/sdk/commit/fd2eb18afd7a1338f584eda65962f9880eea7092) Thanks [@moe-dev](https://github.com/moe-dev)! - Patch fix for inpage oauth on EWK sometimes failing with Google ## 5.0.1 ### Patch Changes * [#646](https://github.com/tkhq/sdk/pull/646) [`c6754f2`](https://github.com/tkhq/sdk/commit/c6754f29cce16f0d4451e380742f581a2bf55e77) Thanks [@moe-dev](https://github.com/moe-dev)! - Patch releases fixes Google Oauth edge case in the Auth Component where logins fail due to indexedDbPublic key not being available yet ## 5.0.0 ### Major Changes * [#601](https://github.com/tkhq/sdk/pull/601) [`07dfd33`](https://github.com/tkhq/sdk/commit/07dfd3397472687092e1c73b1d68714f421b9ca0) Author [@moe-dev](https://github.com/moe-dev) This release significantly enhances authentication by integrating the new `indexedDbClient` within the `useTurnkey` hook and updating the `Auth` component to leverage IndexedDB for secure, persistent client-side authentication. ### Key Changes: * **IndexedDB Authentication**: * Replaced the legacy iframe-based authentication with `indexedDbClient` for all authentication flows in the `Auth` component. * Secure, persistent, non-extractable P-256 keys stored in IndexedDB now provide authentication and session management. * **Enhanced Developer Experience**: * The `useTurnkey` hook now includes direct access to the new `indexedDbClient`. * Simplified and secure client-side authentication without iframe complexity or credential injection. ### Deprecation Notice: * The `iframeClient` for authentication flows is now deprecated. All new integrations should migrate to the IndexedDB-based authentication provided by `indexedDbClient`. ### Patch Changes * Updated dependencies \[[`07dfd33`](https://github.com/tkhq/sdk/commit/07dfd3397472687092e1c73b1d68714f421b9ca0), [`e8a5f1b`](https://github.com/tkhq/sdk/commit/e8a5f1b431623c4ff1cb85c6039464b328cf0e6a)]: * @turnkey/sdk-browser\@5.0.0 * @turnkey/sdk-server\@4.0.0 * @turnkey/crypto\@2.3.1 * @turnkey/wallet-stamper\@1.0.3 ## 4.2.6 ### Patch Changes * fe0957d: Updated the styling of the OtpInput component in the Auth component to remove spinner buttons from numeric inputs. * Updated dependencies \[25ca339] * @turnkey/sdk-browser\@4.3.0 * @turnkey/sdk-server\@3.3.0 * @turnkey/crypto\@2.3.1 * @turnkey/wallet-stamper\@1.0.3 ## 4.2.5 ### Patch Changes * 1cf9243: - Added `openOAuthInPage` to the `authConfig`. This makes the Google, Apple and Facebook login pages replace the current URL, rather than opening in a popup. * Fixed keyboard input type on mobile. Now, the keyboard will correctly default to "number" input for numeric OTP codes and "text" input for alphanumeric OTP codes. * Updated dependencies \[3f6e415] * @turnkey/sdk-browser\@4.2.0 * @turnkey/sdk-server\@3.2.0 * @turnkey/crypto\@2.3.1 * @turnkey/wallet-stamper\@1.0.3 ## 4.2.4 ### Patch Changes * Updated dependencies \[3e4a482] * @turnkey/sdk-browser\@4.1.0 * @turnkey/sdk-server\@3.1.0 * @turnkey/crypto\@2.3.1 * @turnkey/wallet-stamper\@1.0.3 ## 4.2.3 ### Patch Changes * 0e630b2: Update supported countries for SMS deliverability in EWK ## 4.2.2 ### Patch Changes * 7755413: Ensure that iframe has an embedded key ## 4.2.1 ### Patch Changes * Updated dependencies \[7b72769] * @turnkey/sdk-server\@3.0.1 ## 4.2.0 ### Minor Changes * de59993: Update default country codes to supported deliveries: USA, Canada, France, Czech Republic, Finland, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia (with a 1 min delay), Lithuania, Luxembourg, Malta, Mexico, Moldova, Montenegro, Netherlands, Norway, Poland, Portugal, Romania, Serbia, Slovenia, Spain, Sweden, Switzerland. * d1083bd: Add `otpConfig` param to `Auth` component that allows you to pass in `alphanumeric` and `otpLength` default for the Auth component is still false, 6 respectively (non breaking) ### Patch Changes * Updated dependencies \[e501690] * Updated dependencies \[d1083bd] * @turnkey/sdk-browser\@4.0.0 * @turnkey/sdk-server\@3.0.0 * @turnkey/crypto\@2.3.1 * @turnkey/wallet-stamper\@1.0.3 ## 4.1.3 ### Patch Changes * Updated dependencies \[bf87774] * @turnkey/sdk-browser\@3.1.0 * Expose `getEmbeddedPublicKey()` via `TurnkeyIframeClient`. This can be used to fetch the live public key of the target embedded key living within an iframe. Usage may look like the following: ```javascript theme={"system"} import { useTurnkey } from "@turnkey/sdk-react"; ... const { authIframeClient } = useTurnkey(); const publicKey = await authIframeClient!.getEmbeddedPublicKey(); ``` Functionally, this can be useful for scenarios where the developer would like to verify whether an iframe has a live embedded key within it. This contrasts from the static `iframeStamper.iframePublicKey` exposed by `@turnkey/iframe-stamper`'s `publicKey()` method. ## 4.1.2 ### Patch Changes * Updated dependencies \[5ec5187] * @turnkey/sdk-browser\@3.0.1 * @turnkey/sdk-server\@2.6.1 ## 4.1.1 ### Patch Changes * 2b8de45: Add passkeyConfig to EWK You can do this by passing optional `passkeyConfig` of interface `PasskeyConfig` to the `` component ``` export interface PasskeyConfig { displayName?: string; name?: string; } ``` ## 4.1.0 ### Minor Changes * 72890f5: ### @turnkey/sdk-browser * Move all type definitions to [`./__types__/base.ts`](https://github.com/tkhq/sdk/blob/494911d948d0a53c0d00aa01e9821aefd5e3f80d/packages/sdk-browser/src/__types__/base.ts) * `TurnkeyBrowserClient` * `refereshSession()` now consumes a [RefreshSessionParams](https://github.com/tkhq/sdk/blob/494911d948d0a53c0d00aa01e9821aefd5e3f80d/packages/sdk-browser/src/__types__/base.ts#L213) parameter * `loginWithBundle()` now consumes a [LoginWithBundleParams](https://github.com/tkhq/sdk/blob/494911d948d0a53c0d00aa01e9821aefd5e3f80d/packages/sdk-browser/src/__types__/base.ts#L219) parameter * `loginWithPasskey()` now consumes a [LoginWithPasskeyParams](https://github.com/tkhq/sdk/blob/494911d948d0a53c0d00aa01e9821aefd5e3f80d/packages/sdk-browser/src/__types__/base.ts#L224) parameter * `loginWithWallet()` now consumes a [LoginWithWalletParams](https://github.com/tkhq/sdk/blob/494911d948d0a53c0d00aa01e9821aefd5e3f80d/packages/sdk-browser/src/__types__/base.ts#L231) parameter ### @turnkey/sdk-react * `Auth.tsx` * updated `passkeyClient?.loginWithPasskey()` to implement new method signature * updated `walletClient?.loginWithWallet()` to implement new method signature ### @turnkey/sdk-server * Move all type definitions to [`./__types__/base.ts`](https://github.com/tkhq/sdk/blob/494911d948d0a53c0d00aa01e9821aefd5e3f80d/packages/sdk-server/src/__types__/base.ts) ### Patch Changes * c9ae537: Update nextJs to >= 15.2.3 as per github advisory: [https://github.com/advisories/GHSA-f82v-jwr5-mffw](https://github.com/advisories/GHSA-f82v-jwr5-mffw) For Next.js 15.x, this issue is fixed in 15.2.3 For Next.js 14.x, this issue is fixed in 14.2.25 For Next.js 13.x, this issue is fixed in 13.5.9 For Next.js 12.x, this issue is fixed in 12.3.5 * Updated dependencies \[0e4e959] * Updated dependencies \[856f449] * Updated dependencies \[c9ae537] * Updated dependencies \[d4ce5fa] * Updated dependencies \[ecdb29a] * Updated dependencies \[72890f5] * @turnkey/sdk-browser\@3.0.0 * @turnkey/sdk-server\@2.6.0 * @turnkey/crypto\@2.3.1 * @turnkey/wallet-stamper\@1.0.3 ## 4.0.0 ### Major Changes * 93540e7: ## Major Package Updates ### @turnkey/sdk-browser * create abstract `TurnkeyBaseClient` class which extends `TurnkeySDKClientBase` * `TurnkeyBrowserClient`, `TurnkeyIframeClient`, `TurnkeyPasskeyClient`, and `TurnkeyWalletClient` all extend `TurnkeyBaseClient` * TurnkeyBrowserClient * Session Management * `refreshSession` - attempts to refresh an existing, active session and will extend the session expiry using the `expirationSeconds` parameter * loginWithBundle - authenticate a user via a credential bundle and creates a read-write session * loginWithPasskey - attempts to authenticate a user via passkey and create a read-only or read-write session * loginWithSession - takes a `Session`, which can be either read-only or read-write, created via a server action and attempts to authenticate the user * TurnkeyPasskeyClient * Session Management * createPasskeySession - leverages passkey authentication to create a read-write session. Once authenticated, the user will not be prompted for additional passkey taps. ### @turnkey/sdk-react * update `TurnkeyContext` to use new `.getSession()` method to check if there is an active session * `OTPVerification` component no longer receives `authIframeClient` or `onValidateSuccess` props ## Minor Package Updates ### @turnkey/sdk-server * expose `sendCredential` server action * add `SessionType` enum * `READ_ONLY` & `READ_WRITE` ### @turnkey/eip-1193-provider * update dependencies in `package.json` * moved from `peerDependencies` to `dependencies` * `"@turnkey/http": "workspace:*"` * `"@turnkey/sdk-browser": "workspace:*"` * moved from `devDependencies` to `dependencies` * `"@turnkey/api-key-stamper": "workspace:*"` * specify TypeScript version ^5.1.5 ### Minor Changes * 9147962: add dangerouslyOverrideIframeKeyTtl option to override iframe embedded key TTL (for longer lived read/write sessions) ### Patch Changes * fdb8bf0: Add loading indicators for EWK. Exposed email customization to EWK. * Updated dependencies \[93540e7] * Updated dependencies \[fdb8bf0] * Updated dependencies \[9147962] * @turnkey/sdk-browser\@2.0.0 * @turnkey/sdk-server\@2.5.0 * @turnkey/crypto\@2.3.1 ## 3.1.0 ### Minor Changes * 9317588: Adds wallet as an authentication option in the Embedded Wallet Kit components for sdk-react ### Patch Changes * Updated dependencies \[233ae71] * Updated dependencies \[9317588] * @turnkey/sdk-browser\@1.16.0 * @turnkey/sdk-server\@2.4.0 * @turnkey/crypto\@2.3.1 ## 3.0.6 ### Patch Changes * Updated dependencies \[56a307e] * @turnkey/sdk-browser\@1.15.0 * @turnkey/sdk-server\@2.3.0 * @turnkey/crypto\@2.3.1 * @turnkey/wallet-stamper\@1.0.3 ## 3.0.5 ### Patch Changes * cdf2e6e: Fix issue in EWK preventing sign up flow ## 3.0.4 ### Patch Changes * 9256e75: Fix apple login issue on mobile web browser * bfc833f: Add getOrCreateSuborg server action * Updated dependencies \[3c44c4a] * Updated dependencies \[bfc833f] * @turnkey/sdk-browser\@1.14.0 * @turnkey/sdk-server\@2.2.0 * @turnkey/crypto\@2.3.1 * @turnkey/wallet-stamper\@1.0.3 ## 3.0.3 ### Patch Changes * 5f6de98: Fix phone number validation issue causing issues with non +1 country codes * Updated dependencies \[69d2571] * Updated dependencies \[57f9cb0] * @turnkey/sdk-browser\@1.13.0 * @turnkey/sdk-server\@2.1.0 * @turnkey/crypto\@2.3.1 * @turnkey/wallet-stamper\@1.0.3 ## 3.0.2 ### Patch Changes * faa757c: Patch EWK custom session lengths - previously not working as intended (defaulted to 15 minute sessions only) and fix the following useLocalStorage issue when compiling: \[Error: useLocalStorage is a client-only hook] * a8bd73b: Fix issue with EWK where suborgs were being created on failed fetches ## 3.0.1 ### Patch Changes * cb8cf7e: Add all supported country codes to phone input field * 2eb2179: Fix bundling issue with sdk-react * Updated dependencies \[755833b] * Updated dependencies \[2bc0046] * @turnkey/sdk-browser\@1.12.1 * @turnkey/sdk-server\@2.0.1 * @turnkey/crypto\@2.3.1 * @turnkey/wallet-stamper\@1.0.3 ## 3.0.0 ### Major Changes * 1ebd4e2: Remove references to server actions and import from sdk-server ### Patch Changes * Updated dependencies \[6695af2] * Updated dependencies \[1ebd4e2] * @turnkey/sdk-browser\@1.12.0 * @turnkey/sdk-server\@2.0.0 * @turnkey/crypto\@2.3.0 * @turnkey/wallet-stamper\@1.0.2 ## 2.0.4 ### Patch Changes * 99ebe78: Fixed MUI components not inheriting fonts. * Updated dependencies \[053fbfb] * @turnkey/sdk-browser\@1.11.2 * @turnkey/sdk-server\@1.7.3 * @turnkey/crypto\@2.3.0 * @turnkey/wallet-stamper\@1.0.2 ## 2.0.3 ### Patch Changes * d43c52c: Add session length customization, wallet generation customization, enter to continue, more css customization and css fixes (icon sizing issues, etc) * 5419d49: fix css bundling bug * Updated dependencies \[328d6aa] * Updated dependencies \[b90947e] * Updated dependencies \[2d5977b] * Updated dependencies \[fad7c37] * @turnkey/sdk-browser\@1.11.1 * @turnkey/sdk-server\@1.7.2 * @turnkey/crypto\@2.3.0 * @turnkey/wallet-stamper\@1.0.2 ## 2.0.2 ### Patch Changes * eaf3e20: Fix css related build issues with React 19+ & NextJs 15+ ## 2.0.1 ### Patch Changes * 0da96aa: Add readme to react sdk ## 2.0.0 ### Major Changes * 95717d7: New Feature: UI components - Auth, Export, Import. Leverages server and client directives on NextJS 13+ to abstract functionalities away from the developer ### Patch Changes * c8330fa: Add a user identifier for sms rate limiting * 12d5aaa: Update TurnkeySDKBrowserConfig type with an optional iframeUrl field. The TurnkeyContext provider will check for an iframeUrl otherwise it will fallback to the default. * Updated dependencies \[7988bc1] * Updated dependencies \[c895c8f] * Updated dependencies \[538d4fc] * Updated dependencies \[12d5aaa] * @turnkey/sdk-browser\@1.11.0 * @turnkey/wallet-stamper\@1.0.2 * @turnkey/sdk-server\@1.7.1 * @turnkey/crypto\@2.3.0 ## 1.1.2 ### Patch Changes * @turnkey/sdk-browser\@1.10.2 * @turnkey/wallet-stamper\@1.0.1 ## 1.1.1 ### Patch Changes * @turnkey/sdk-browser\@1.10.1 * @turnkey/wallet-stamper\@1.0.0 ## 1.1.0 ### Minor Changes * The `useTurnkey` hook now returns the new `walletClient`, used for authenticating requests via wallet signatures * Added new `client` object returned from the `useTurnkey` hook. This is the authenticated client. It will be null if the user is not authenticated. Example: ```typescript theme={"system"} const { client } = useTurnkey(); ``` ### Patch Changes * Updated dependencies \[8bea78f] * @turnkey/wallet-stamper\@2.0.0 * @turnkey/sdk-browser\@1.10.0 ## 1.0.14 ### Patch Changes * Updated dependencies \[3dd74ac] * Updated dependencies \[1e36edf] * Updated dependencies \[4df8914] * Updated dependencies \[11a9e2f] * @turnkey/sdk-browser\@1.9.0 ## 1.0.13 ### Patch Changes * Updated dependencies \[9ebd062] * @turnkey/sdk-browser\@1.8.0 ## 1.0.12 ### Patch Changes * Updated dependencies \[96d7f99] * @turnkey/sdk-browser\@1.7.1 ## 1.0.11 ### Patch Changes * Updated dependencies \[ff059d5] * @turnkey/sdk-browser\@1.7.0 ## 1.0.10 ### Patch Changes * Updated dependencies \[c988ed0] * @turnkey/sdk-browser\@1.6.0 ## 1.0.9 ### Patch Changes * Updated dependencies \[1813ed5] * @turnkey/sdk-browser\@1.5.0 ## 1.0.8 ### Patch Changes * Updated dependencies \[bab5393] * Updated dependencies \[a16073c] * Updated dependencies \[7e7d209] * @turnkey/sdk-browser\@1.4.0 ## 1.0.7 ### Patch Changes * Updated dependencies \[93dee46] * @turnkey/sdk-browser\@1.3.0 ## 1.0.6 ### Patch Changes * Updated dependencies \[e2f2e0b] * @turnkey/sdk-browser\@1.2.4 ## 1.0.5 ### Patch Changes * Updated dependencies * @turnkey/sdk-browser\@1.2.3 ## 1.0.4 ### Patch Changes * Updated dependencies * @turnkey/sdk-browser\@1.2.2 ## 1.0.3 ### Patch Changes * f17a229: Update to oauth related endpoints to drop jwks uri from oauth providers * Updated dependencies \[f17a229] * @turnkey/sdk-browser\@1.2.1 ## 1.0.2 ### Patch Changes * Updated dependencies * @turnkey/sdk-browser\@1.2.0 ## 1.0.1 ### Patch Changes * Updated dependencies * @turnkey/sdk-browser\@1.1.0 ## 1.0.0 ### Major Changes * Stable Release: Add Oauth integration. New suborg creation version will now require an oauthProviders field under root users. ### Patch Changes * Updated dependencies * @turnkey/sdk-browser\@1.0.0 ## 0.4.1 ### Patch Changes * @turnkey/sdk-browser\@0.4.1 ## 0.4.0 ### Minor Changes * e4b29da: Deprecate the `getAuthBundle()` path for passkey sessions and replace it with `getReadWriteSession()` to store authBundles with their expirationTimestamps so applications can better manually manage active writing sessions ### Patch Changes * Updated dependencies \[e4b29da] * @turnkey/sdk-browser\@0.4.0 ## 0.3.0 ### Minor Changes * d409d81: Add support for Passkey Sessions ### Patch Changes * Updated dependencies \[d409d81] * @turnkey/sdk-browser\@0.3.0 ## 0.2.1 ### Patch Changes * @turnkey/sdk-browser\@0.2.1 ## 0.2.0 ### Minor Changes * updated syntax ### Patch Changes * Updated dependencies * @turnkey/sdk-browser\@0.2.0 ## 0.1.0 ### Minor Changes * Ready for 0.1.0 ### Patch Changes * Updated dependencies * @turnkey/sdk-browser\@0.1.0 ## 0.0.1 Initial (experimental) release! This is an alpha release and subject to change. # SDK Server Source: https://docs.turnkey.com/changelogs/sdk-server/readme # @turnkey/sdk-server ## 5.1.1 ### Patch Changes * Updated dependencies \[]: * @turnkey/api-key-stamper\@0.6.3 * @turnkey/wallet-stamper\@1.1.14 * @turnkey/http\@3.17.1 ## 5.1.0 ### Minor Changes * [#1206](https://github.com/tkhq/sdk/pull/1206) [`58e04e5`](https://github.com/tkhq/sdk/commit/58e04e5856626d9d2593abb61d8ca32d8ccbb833) Author [@DeRauk](https://github.com/DeRauk) - Adds sdk methods for the GetWalletAddressBalances and ListSupportedAssets apis. ### Patch Changes * [#1201](https://github.com/tkhq/sdk/pull/1201) [`1f6e240`](https://github.com/tkhq/sdk/commit/1f6e2403fca1fd9cbca646f88c88dbc49ddb0c34) Author [@ethankonk](https://github.com/ethankonk) - Synced with Mono v2026.2.0 * [#1197](https://github.com/tkhq/sdk/pull/1197) [`7458b7c`](https://github.com/tkhq/sdk/commit/7458b7cd6fc64796b376e3374b7c2ed79467459c) Thanks [@moe-dev](https://github.com/moe-dev)! - Add support for SolSendTransaction and associated abstractions * Updated dependencies \[[`1f6e240`](https://github.com/tkhq/sdk/commit/1f6e2403fca1fd9cbca646f88c88dbc49ddb0c34), [`58e04e5`](https://github.com/tkhq/sdk/commit/58e04e5856626d9d2593abb61d8ca32d8ccbb833), [`7458b7c`](https://github.com/tkhq/sdk/commit/7458b7cd6fc64796b376e3374b7c2ed79467459c)]: * @turnkey/http\@3.17.0 * @turnkey/wallet-stamper\@1.1.13 * @turnkey/api-key-stamper\@0.6.2 ## 5.0.3 ### Patch Changes * [#1194](https://github.com/tkhq/sdk/pull/1194) [`dced9db`](https://github.com/tkhq/sdk/commit/dced9dbbd8ea533442e19e45ce36e6a05a45a555) Author [@moeodeh3](https://github.com/moeodeh3) - Add `Content-Type: application/json` header to all Turnkey API requests * Updated dependencies \[[`dced9db`](https://github.com/tkhq/sdk/commit/dced9dbbd8ea533442e19e45ce36e6a05a45a555)]: * @turnkey/http\@3.16.3 * @turnkey/wallet-stamper\@1.1.12 ## 5.0.2 ### Patch Changes * [#1173](https://github.com/tkhq/sdk/pull/1173) [`4742eaf`](https://github.com/tkhq/sdk/commit/4742eafbfdcc6fe6b6d3aab01569ad94a5198571) Author [@ethankonk](https://github.com/ethankonk) - Fix polling logic to use the `organizationId` from the activity response instead of the config, which fixes activity polling for auth functions * Updated dependencies \[]: * @turnkey/api-key-stamper\@0.6.1 * @turnkey/wallet-stamper\@1.1.12 * @turnkey/http\@3.16.2 ## 5.0.1 ### Patch Changes * Updated dependencies \[[`91d6a9e`](https://github.com/tkhq/sdk/commit/91d6a9eb1b9ac9e21745749615ac7a7be66f5cf6)]: * @turnkey/api-key-stamper\@0.6.0 * @turnkey/wallet-stamper\@1.1.11 * @turnkey/http\@3.16.1 ## 5.0.0 ### Major Changes * [#1153](https://github.com/tkhq/sdk/pull/1153) [`78ec1d9`](https://github.com/tkhq/sdk/commit/78ec1d9afcafde3ca7107fc720323d486d6afaea) Thanks [@moe-dev](https://github.com/moe-dev)! - Update as per mono v2025.12.3. ### Breaking/Behavioral Changes * `appName` is now **required**: * In `emailCustomization` for Email Auth activities * At the top-level intent for OTP activities * Auth proxy endpoints are **not affected** ### Activity Version Bumps The following activity types have been versioned: * `ACTIVITY_TYPE_INIT_OTP` → `ACTIVITY_TYPE_INIT_OTP_V2` * `ACTIVITY_TYPE_INIT_OTP_AUTH_V2` → `ACTIVITY_TYPE_INIT_OTP_V3` * `ACTIVITY_TYPE_EMAIL_AUTH_V2` → `ACTIVITY_TYPE_EMAIL_AUTH_V3` * `ACTIVITY_TYPE_INIT_USER_EMAIL_RECOVERY` -> `ACTIVITY_TYPE_INIT_USER_EMAIL_RECOVERY_V2` ### Patch Changes * [#1145](https://github.com/tkhq/sdk/pull/1145) [`dbd4d8e`](https://github.com/tkhq/sdk/commit/dbd4d8e4ea567240c4d287452dd0d8f53050beca) Author [@moeodeh3](https://github.com/moeodeh3) - Stamp function improvements * Queries: add `organizationId` fallback from config * Activities: fix request structure to include the `parameters wrapper`, `organizationId`, `timestampMs`, and `type` fields * Updated dependencies \[[`78ec1d9`](https://github.com/tkhq/sdk/commit/78ec1d9afcafde3ca7107fc720323d486d6afaea)]: * @turnkey/http\@3.16.0 * @turnkey/wallet-stamper\@1.1.10 ## 4.12.2 ### Patch Changes * Updated dependencies \[]: * @turnkey/wallet-stamper\@1.1.9 ## 4.12.1 ### Patch Changes * Updated dependencies \[]: * @turnkey/wallet-stamper\@1.1.8 ## 4.12.0 ### Minor Changes * [#1072](https://github.com/tkhq/sdk/pull/1072) [`67b03a5`](https://github.com/tkhq/sdk/commit/67b03a5d9ab1b6eabfb0b41938ac91365b5dcd9b) Thanks [@moe-dev](https://github.com/moe-dev)! - Bump packages as per mono v2025.11.0 ### Patch Changes * Updated dependencies \[[`67b03a5`](https://github.com/tkhq/sdk/commit/67b03a5d9ab1b6eabfb0b41938ac91365b5dcd9b)]: * @turnkey/http\@3.15.0 * @turnkey/wallet-stamper\@1.1.7 ## 4.11.0 ### Minor Changes * [#1063](https://github.com/tkhq/sdk/pull/1063) [`71cdca3`](https://github.com/tkhq/sdk/commit/71cdca3b97ba520dc5327410a1e82cf9ad85fb0e) Author [@zkharit](https://github.com/zkharit) - Omit optional email parameter if not set * [#1058](https://github.com/tkhq/sdk/pull/1058) [`9fbd5c4`](https://github.com/tkhq/sdk/commit/9fbd5c459782dc3721dd0935d0a4458babce258b) Author [@moeodeh3](https://github.com/moeodeh3) - Update per mono release `v2025.10.10-hotfix.2` ### Patch Changes * Updated dependencies \[[`9fbd5c4`](https://github.com/tkhq/sdk/commit/9fbd5c459782dc3721dd0935d0a4458babce258b)]: * @turnkey/http\@3.14.0 * @turnkey/wallet-stamper\@1.1.6 ## 4.10.5 ### Patch Changes * Updated dependencies \[]: * @turnkey/wallet-stamper\@1.1.6 ## 4.10.4 ### Patch Changes * Updated dependencies \[]: * @turnkey/wallet-stamper\@1.1.5 ## 4.10.3 ### Patch Changes * [#1016](https://github.com/tkhq/sdk/pull/1016) [`9df42ad`](https://github.com/tkhq/sdk/commit/9df42adc02c7ff77afba3b938536e79b57882ef1) Author [@amircheikh](https://github.com/amircheikh) - Synced API as per mono v2025.10.2 * Updated dependencies \[[`9df42ad`](https://github.com/tkhq/sdk/commit/9df42adc02c7ff77afba3b938536e79b57882ef1)]: * @turnkey/http\@3.13.1 * @turnkey/wallet-stamper\@1.1.4 ## 4.10.2 ### Patch Changes * Updated dependencies \[]: * @turnkey/wallet-stamper\@1.1.3 ## 4.10.1 ### Patch Changes * Updated dependencies \[]: * @turnkey/wallet-stamper\@1.1.2 ## 4.10.0 ### Minor Changes * [#977](https://github.com/tkhq/sdk/pull/977) [`4567059`](https://github.com/tkhq/sdk/commit/45670598f102223925b87a5295edca15a6ce8241) Author [@besler613](https://github.com/besler613) - OAuth2Authenticate now supports returning the encrypted bearer token via the optional `bearerTokenTargetPublicKey` request parameter (mono release v2025.9.5) ### Patch Changes * Updated dependencies \[[`4567059`](https://github.com/tkhq/sdk/commit/45670598f102223925b87a5295edca15a6ce8241)]: * @turnkey/http\@3.13.0 * @turnkey/wallet-stamper\@1.1.1 ## 4.9.1 ### Patch Changes * [#958](https://github.com/tkhq/sdk/pull/958) [`5a96fe8`](https://github.com/tkhq/sdk/commit/5a96fe80db4c4c45e09ad8c613695ee4c2b8e51f) Author [@amircheikh](https://github.com/amircheikh) - - Synced api with mono * Updated dependencies \[[`5a96fe8`](https://github.com/tkhq/sdk/commit/5a96fe80db4c4c45e09ad8c613695ee4c2b8e51f)]: * @turnkey/http\@3.12.1 * @turnkey/wallet-stamper\@1.1.1 ## 4.9.0 ### Minor Changes * Updated dependencies \[[`fc1d6e2`](https://github.com/tkhq/sdk/commit/fc1d6e2d26f4a53116633e9e8cccccd792267f4e), [`fc1d6e2`](https://github.com/tkhq/sdk/commit/fc1d6e2d26f4a53116633e9e8cccccd792267f4e), [`06347ad`](https://github.com/tkhq/sdk/commit/06347adfa08fb0867c350e43821d0fed06c49624)]: * @turnkey/http\@3.12.0 * @turnkey/api-key-stamper\@0.5.0 * @turnkey/wallet-stamper\@1.1.0 ## 4.8.1-beta.0 ### Patch Changes * Updated dependencies \[]: * @turnkey/api-key-stamper\@0.5.0-beta.6 * @turnkey/http\@3.11.1-beta.0 * @turnkey/wallet-stamper\@1.1.0-beta.6 ## 4.8.0 ### Minor Changes * [#879](https://github.com/tkhq/sdk/pull/879) [`026264c`](https://github.com/tkhq/sdk/commit/026264c55aa16342c8925af0bdcdf72dc00e5158) Author [@zkharit](https://github.com/zkharit) - Update packages to include new activities as of the newest release (mono v2025.8.10) ### Patch Changes * Updated dependencies \[[`026264c`](https://github.com/tkhq/sdk/commit/026264c55aa16342c8925af0bdcdf72dc00e5158)]: * @turnkey/http\@3.11.0 * @turnkey/wallet-stamper\@1.0.9 ## 4.7.0-beta.2 ### Minor Changes * SDK beta release @turnkey/react-wallet-kit @turnkey/core ### Patch Changes * Updated dependencies \[]: * @turnkey/api-key-stamper\@0.5.0-beta.5 * @turnkey/wallet-stamper\@1.1.0-beta.5 * @turnkey/http\@3.10.0-beta.2 ## 4.7.0-beta.1 ### Minor Changes * @turnkey/react-wallet-kit and @turnkey/core beta-3 release ### Patch Changes * Updated dependencies \[]: * @turnkey/http\@3.10.0-beta.1 * @turnkey/api-key-stamper\@0.4.8-beta.4 * @turnkey/wallet-stamper\@1.0.9-beta.4 ## 4.7.0-beta.0 ### Minor Changes * @turnkey/react-wallet-kit and @turnkey/core beta-3 release ### Patch Changes * Updated dependencies \[]: * @turnkey/http\@3.10.0-beta.0 * @turnkey/api-key-stamper\@0.4.8-beta.3 * @turnkey/wallet-stamper\@1.0.9-beta.3 ## 4.7.0 ### Minor Changes * [#861](https://github.com/tkhq/sdk/pull/861) [`5d8be2d`](https://github.com/tkhq/sdk/commit/5d8be2d0329070c7aa025dddb1b28f04257ae4e6) Author [@amircheikh](https://github.com/amircheikh) - Synced as per mono 2025.8.4 ### Patch Changes * Updated dependencies \[[`5d8be2d`](https://github.com/tkhq/sdk/commit/5d8be2d0329070c7aa025dddb1b28f04257ae4e6)]: * @turnkey/http\@3.10.0 * @turnkey/wallet-stamper\@1.0.8 ## 4.6.0 ### Minor Changes * [#834](https://github.com/tkhq/sdk/pull/834) [`8b39dba`](https://github.com/tkhq/sdk/commit/8b39dbabf68d3e376b5b07f26960d5b61ae87fa9) Author [@moeodeh3](https://github.com/moeodeh3) - Update per mono release v2025.8.3-hotfix.0 ### Patch Changes * [#833](https://github.com/tkhq/sdk/pull/833) [`1a549b7`](https://github.com/tkhq/sdk/commit/1a549b71f9a6e7ab59d52aaae7e58e34c8f2e8b5) Author [@moeodeh3](https://github.com/moeodeh3) - Add optional `includeUnverified` parameter to `getOrCreateSuborg()` to allow inclusion of unverified subOrgs * Updated dependencies \[[`8b39dba`](https://github.com/tkhq/sdk/commit/8b39dbabf68d3e376b5b07f26960d5b61ae87fa9)]: * @turnkey/http\@3.9.0 * @turnkey/wallet-stamper\@1.0.8 ## 4.5.1-beta.2 ### Patch Changes * Updated dependencies \[]: * @turnkey/api-key-stamper\@0.4.8-beta.2 * @turnkey/http\@3.8.1-beta.2 * @turnkey/wallet-stamper\@1.0.9-beta.2 ## 4.5.1-beta.0 ### Patch Changes * Updated dependencies \[]: * @turnkey/api-key-stamper\@0.4.8-beta.0 * @turnkey/http\@3.8.1-beta.0 * @turnkey/wallet-stamper\@1.0.9-beta.0 ## 4.5.0 ### Minor Changes * [#826](https://github.com/tkhq/sdk/pull/826) [`f83f25b`](https://github.com/tkhq/sdk/commit/f83f25ba33ef15dbd66723531eebe2fd00f43ac0) Author [@turnekybc](https://github.com/turnekybc) - Update per mono release v2025.8.1 ### Patch Changes * Updated dependencies \[[`f83f25b`](https://github.com/tkhq/sdk/commit/f83f25ba33ef15dbd66723531eebe2fd00f43ac0)]: * @turnkey/http\@3.8.0 * @turnkey/wallet-stamper\@1.0.8 ## 4.4.0 ### Minor Changes * [#651](https://github.com/tkhq/sdk/pull/651) [`81e355c`](https://github.com/tkhq/sdk/commit/81e355c9a8321feffcac056916b65139cf35eeed) Author [@turnekybc](https://github.com/turnekybc) - Add Coinbase & MoonPay Fiat Onramp. View the [Fiat Onramp feature docs](https://docs.turnkey.com/wallets/fiat-on-ramp). ### Patch Changes * Updated dependencies \[[`81e355c`](https://github.com/tkhq/sdk/commit/81e355c9a8321feffcac056916b65139cf35eeed)]: * @turnkey/http\@3.7.0 * @turnkey/wallet-stamper\@1.0.8 ## 4.3.0 ### Minor Changes * [#782](https://github.com/tkhq/sdk/pull/782) [`e90a478`](https://github.com/tkhq/sdk/commit/e90a478c9208d858b1144df9b2c2c7ba956c406e) Thanks [@r-n-o](https://github.com/r-n-o)! - Release v2025.7.16 ### Patch Changes * Updated dependencies \[[`e90a478`](https://github.com/tkhq/sdk/commit/e90a478c9208d858b1144df9b2c2c7ba956c406e)]: * @turnkey/http\@3.6.0 * @turnkey/wallet-stamper\@1.0.7 ## 4.2.4 ### Patch Changes * [#780](https://github.com/tkhq/sdk/pull/780) [`2db00b0`](https://github.com/tkhq/sdk/commit/2db00b0a799d09ae33fa08a117e3b2f433f2b0b4) Thanks [@moe-dev](https://github.com/moe-dev)! - Patch fix for server actions leading to unwanted suborg creation when query requests time out ## 4.2.3 ### Patch Changes * [#763](https://github.com/tkhq/sdk/pull/763) [`cb13c26`](https://github.com/tkhq/sdk/commit/cb13c26edb79a01ab651e3b2897334fd154b436a) Author [@andrewkmin](https://github.com/andrewkmin) - Release per mono v2025.7.1. This release contains the following API changes: * Introduction of `SmartContractInterfaces`: we've now exposed endpoints for uploading ABIs and IDLs to help secure EVM and Solana signing flows. For more information, see our docs [here](https://docs.turnkey.com/concepts/policies/smart-contract-interfaces) * Updated dependencies \[[`cb13c26`](https://github.com/tkhq/sdk/commit/cb13c26edb79a01ab651e3b2897334fd154b436a)]: * @turnkey/http\@3.5.1 * @turnkey/wallet-stamper\@1.0.7 ## 4.2.2 ### Patch Changes * Updated dependencies \[]: * @turnkey/wallet-stamper\@1.0.7 ## 4.2.1 ### Patch Changes * Updated dependencies \[]: * @turnkey/wallet-stamper\@1.0.6 ## 4.2.0 ### Minor Changes * [#704](https://github.com/tkhq/sdk/pull/704) [`5f3dd98`](https://github.com/tkhq/sdk/commit/5f3dd9814650308b3bf3198168c453e7b1a98efd) Author [@amircheikh](https://github.com/amircheikh) - Synced with mono 2025.6.10 to include the following endpoints: `update_user_email`: Update a User's email in an existing Organization `update_user_name`: Update a User's name in an existing Organization `update_user_phone_number`: Update a User's phone number in an existing Organization ### Patch Changes * [#698](https://github.com/tkhq/sdk/pull/698) [`7625df0`](https://github.com/tkhq/sdk/commit/7625df0538002c3455bd5862211210e38472e164) Author [@moeodeh3](https://github.com/moeodeh3) - Introduces an optional `runtimeOverride` parameter that allows the ability to explicitly specify the crypto environment: `"browser"`, `"node"`, or `"purejs"`. * Updated dependencies \[[`5f3dd98`](https://github.com/tkhq/sdk/commit/5f3dd9814650308b3bf3198168c453e7b1a98efd), [`7625df0`](https://github.com/tkhq/sdk/commit/7625df0538002c3455bd5862211210e38472e164)]: * @turnkey/http\@3.5.0 * @turnkey/api-key-stamper\@0.4.7 * @turnkey/wallet-stamper\@1.0.5 ## 4.1.1 ### Patch Changes * Updated dependencies \[[`be0a621`](https://github.com/tkhq/sdk/commit/be0a621fb962bd51d2df1a1e79f5260d7c696772)]: * @turnkey/http\@3.4.2 * @turnkey/wallet-stamper\@1.0.4 ## 4.1.0 ### Minor Changes * [#632](https://github.com/tkhq/sdk/pull/632) [`a38a6e3`](https://github.com/tkhq/sdk/commit/a38a6e36dc2bf9abdea64bc817d1cad95b8a289a) Author [@amircheikh](https://github.com/amircheikh) - Exposed `createOauthProviders` and `getUsers` as server actions. These are used for social linking within `@turnkey/sdk-react`. ### Patch Changes * [#663](https://github.com/tkhq/sdk/pull/663) [`593de2d`](https://github.com/tkhq/sdk/commit/593de2d9404ec8cf53426f9cf832c13eefa3fbf2) Thanks [@moe-dev](https://github.com/moe-dev)! - Update to endpoints as per mono v2025.5.7. Add V5 TON address format generation. Non breaking * Updated dependencies \[[`5afbe51`](https://github.com/tkhq/sdk/commit/5afbe51949bdd1997fad083a4c1e4272ff7409dc), [`593de2d`](https://github.com/tkhq/sdk/commit/593de2d9404ec8cf53426f9cf832c13eefa3fbf2)]: * @turnkey/wallet-stamper\@1.0.4 * @turnkey/http\@3.4.1 * @turnkey/api-key-stamper\@0.4.6 ## 4.0.1 ### Patch Changes * Update @turnkey/sdk-types readme and install dependency in packages with common types * [#650](https://github.com/tkhq/sdk/pull/650) [`27fe590`](https://github.com/tkhq/sdk/commit/27fe590cdc3eb6a8cde093eeefda2ee1cdc79412) Author [@turnekybc](https://github.com/turnekybc) - Update @turnkey/sdk-types readme and install dependency in packages with common types ## 4.0.0 ### Major Changes * [#601](https://github.com/tkhq/sdk/pull/601) [`07dfd33`](https://github.com/tkhq/sdk/commit/07dfd3397472687092e1c73b1d68714f421b9ca0) Author [@moe-dev](https://github.com/moe-dev). This release introduces significant updates and new actions to the SDK server methods, enhancing authentication flows and simplifying usage: **Updated Actions:** * `sendOtp`: No longer requires a suborganization ID; OTPs can now be sent directly under a parent organization's context to any email or phone number. * `verifyOtp`: Now returns a `verificationToken`, which is required for creating sessions via the new `otpLogin` action. **New Actions:** * `otpLogin`: Creates a session using a previously obtained `verificationToken`. Returns a session JWT. * `oauthLogin`: Authenticates using an OIDC token obtained from a third-party provider (e.g., Google, Apple, Facebook). Returns a session JWT. These changes standardize authentication processes, simplify integration, and streamline session management across the SDK. ### Patch Changes * [#631](https://github.com/tkhq/sdk/pull/631) [`e8a5f1b`](https://github.com/tkhq/sdk/commit/e8a5f1b431623c4ff1cb85c6039464b328cf0e6a) Author [@andrewkmin](https://github.com/andrewkmin) - Remove unused Next.js dependency * while the `"use server"` directive in `actions.ts` is to be used specifically with Next, removing it from this package (`@turnkey/sdk-server`) is fine, though applications *using* this package will need Next.js * Updated dependencies \[[`07dfd33`](https://github.com/tkhq/sdk/commit/07dfd3397472687092e1c73b1d68714f421b9ca0)]: * @turnkey/http\@3.4.0 * @turnkey/wallet-stamper\@1.0.3 ## 3.3.0 ### Minor Changes * 25ca339: Adding replyToEmailAddress field for specifying reply-to when using a customer sender ### Patch Changes * Updated dependencies \[25ca339] * @turnkey/http\@3.3.0 * @turnkey/wallet-stamper\@1.0.3 ## 3.2.0 ### Minor Changes * 3f6e415: Update per mono v2025.4.5 ### Patch Changes * Updated dependencies \[3f6e415] * Updated dependencies \[4d1d775] * @turnkey/http\@3.2.0 * @turnkey/api-key-stamper\@0.4.5 * @turnkey/wallet-stamper\@1.0.3 ## 3.1.0 ### Minor Changes * 3e4a482: Release per mono v2025.4.4 ### Patch Changes * Updated dependencies \[3e4a482] * @turnkey/http\@3.1.0 * @turnkey/wallet-stamper\@1.0.3 ## 3.0.1 ### Patch Changes * 7b72769: Add sendFromEmailSenderName to sendOtp server action ## 3.0.0 ### Major Changes * d1083bd: initOtpAuth now defaults to v2 (breaking) which allows alphanumeric boolean and otpLength (6-9) to be passed + associated updates to server actions. More details below. * This release introduces the `INIT_OTP_AUTH_V2` activity. The difference between it and `INIT_OTP_AUTH` is that it can now accept `alphanumeric` and `otpLength` for selecting crockford bech32 alphanumeric codes and the length of those codes. By default alphanumeric = true, otpLength = 9 * This release introduces `sendFromEmailSenderName` to `INIT_OTP_AUTH`, `INIT_OTP_AUTH_V2`, `EMAIL_AUTH` and `EMAIL_AUTH_V2`. This is an optional custom sender name for use with sendFromEmailAddress; if left empty, will default to 'Notifications'. ### Patch Changes * Updated dependencies \[d1083bd] * Updated dependencies \[f94d36e] * @turnkey/http\@3.0.0 * @turnkey/wallet-stamper\@1.0.3 ## 2.6.1 ### Patch Changes * 5ec5187: Fix initOtpAuth bug with improper version result (to be updated to V2 following release r2025.3.8) ## 2.6.0 ### Minor Changes * ecdb29a: Update API as per mono v2025.3.2 - Add CREATE\_USERS\_V3 ### Patch Changes * 0e4e959: bump update policy activity to v2 * c9ae537: Update nextJs to >= 15.2.3 as per github advisory: [https://github.com/advisories/GHSA-f82v-jwr5-mffw](https://github.com/advisories/GHSA-f82v-jwr5-mffw) For Next.js 15.x, this issue is fixed in 15.2.3 For Next.js 14.x, this issue is fixed in 14.2.25 For Next.js 13.x, this issue is fixed in 13.5.9 For Next.js 12.x, this issue is fixed in 12.3.5 * 72890f5: ### @turnkey/sdk-browser * Move all type definitions to [`./__types__/base.ts`](https://github.com/tkhq/sdk/blob/494911d948d0a53c0d00aa01e9821aefd5e3f80d/packages/sdk-browser/src/__types__/base.ts) * `TurnkeyBrowserClient` * `refereshSession()` now consumes a [RefreshSessionParams](https://github.com/tkhq/sdk/blob/494911d948d0a53c0d00aa01e9821aefd5e3f80d/packages/sdk-browser/src/__types__/base.ts#L213) parameter * `loginWithBundle()` now consumes a [LoginWithBundleParams](https://github.com/tkhq/sdk/blob/494911d948d0a53c0d00aa01e9821aefd5e3f80d/packages/sdk-browser/src/__types__/base.ts#L219) parameter * `loginWithPasskey()` now consumes a [LoginWithPasskeyParams](https://github.com/tkhq/sdk/blob/494911d948d0a53c0d00aa01e9821aefd5e3f80d/packages/sdk-browser/src/__types__/base.ts#L224) parameter * `loginWithWallet()` now consumes a [LoginWithWalletParams](https://github.com/tkhq/sdk/blob/494911d948d0a53c0d00aa01e9821aefd5e3f80d/packages/sdk-browser/src/__types__/base.ts#L231) parameter ### @turnkey/sdk-react * `Auth.tsx` * updated `passkeyClient?.loginWithPasskey()` to implement new method signature * updated `walletClient?.loginWithWallet()` to implement new method signature ### @turnkey/sdk-server * Move all type definitions to [`./__types__/base.ts`](https://github.com/tkhq/sdk/blob/494911d948d0a53c0d00aa01e9821aefd5e3f80d/packages/sdk-server/src/__types__/base.ts) * Updated dependencies \[ecdb29a] * @turnkey/http\@2.22.0 * @turnkey/wallet-stamper\@1.0.3 ## 2.5.0 ### Minor Changes * 93540e7: ## Major Package Updates ### @turnkey/sdk-browser * create abstract `TurnkeyBaseClient` class which extends `TurnkeySDKClientBase` * `TurnkeyBrowserClient`, `TurnkeyIframeClient`, `TurnkeyPasskeyClient`, and `TurnkeyWalletClient` all extend `TurnkeyBaseClient` * TurnkeyBrowserClient * Session Management * `refreshSession` - attempts to refresh an existing, active session and will extend the session expiry using the `expirationSeconds` parameter * loginWithBundle - authenticate a user via a credential bundle and creates a read-write session * loginWithPasskey - attempts to authenticate a user via passkey and create a read-only or read-write session * loginWithSession - takes a `Session`, which can be either read-only or read-write, created via a server action and attempts to authenticate the user * TurnkeyPasskeyClient * Session Management * createPasskeySession - leverages passkey authentication to create a read-write session. Once authenticated, the user will not be prompted for additional passkey taps. ### @turnkey/sdk-react * update `TurnkeyContext` to use new `.getSession()` method to check if there is an active session * `OTPVerification` component no longer receives `authIframeClient` or `onValidateSuccess` props ## Minor Package Updates ### @turnkey/sdk-server * expose `sendCredential` server action * add `SessionType` enum * `READ_ONLY` & `READ_WRITE` ### @turnkey/eip-1193-provider * update dependencies in `package.json` * moved from `peerDependencies` to `dependencies` * `"@turnkey/http": "workspace:*"` * `"@turnkey/sdk-browser": "workspace:*"` * moved from `devDependencies` to `dependencies` * `"@turnkey/api-key-stamper": "workspace:*"` * specify TypeScript version ^5.1.5 ### Patch Changes * fdb8bf0: Add loading indicators for EWK. Exposed email customization to EWK. ## 2.4.0 ### Minor Changes * 9317588: Adds wallet as an authentication option in the Embedded Wallet Kit components for sdk-react ## 2.3.0 ### Minor Changes * 56a307e: Update api to mono v2025.3.0 ### Patch Changes * Updated dependencies \[56a307e] * @turnkey/http\@2.21.0 ## 2.2.0 ### Minor Changes * 3c44c4a: Updates per mono release v2025.2.2 ### Patch Changes * bfc833f: Add getOrCreateSuborg server action * Updated dependencies \[3c44c4a] * @turnkey/http\@2.20.0 ## 2.1.0 ### Minor Changes * 57f9cb0: Update endpoints - surface GetWalletAccount ### Patch Changes * 69d2571: Upgrade elliptic * Updated dependencies \[57f9cb0] * @turnkey/http\@2.19.0 ## 2.0.1 ### Patch Changes * 755833b: refactor stamper out of config object and move it directly onto the client to match @turnkey/http ## 2.0.0 ### Major Changes * 1ebd4e2: Add server actions ### Minor Changes * 6695af2: Update per mono release v2025.1.11 ### Patch Changes * Updated dependencies \[6695af2] * @turnkey/http\@2.18.0 ## 1.7.3 ### Patch Changes * 053fbfb: Update mono dependencies * Updated dependencies \[053fbfb] * @turnkey/http\@2.17.3 ## 1.7.2 ### Patch Changes * 328d6aa: Add defaultXrpAccountAtIndex helper * b90947e: Update default account exports, surface WalletAccount type * fad7c37: @turnkey/iframe-stamper - Implemented MessageChannel API for secure communication between the parent and iframe. @turnkey/sdk-browser - fixed spelling in package.json @turnkey/sdk-server - fixed spelling in package.json * Updated dependencies \[2d5977b] * @turnkey/api-key-stamper\@0.4.4 * @turnkey/http\@2.17.2 ## 1.7.1 ### Patch Changes * 538d4fc: Update api endpoints - NEW: User verification, SMS customization params * Updated dependencies \[538d4fc] * @turnkey/http\@2.17.1 ## 1.7.0 ### Minor Changes * 78bc39c: Add default accounts for various address types * Add wallet account ID to list wallets endpoint ### Patch Changes * Updated dependencies \[78bc39c] * @turnkey/http\@2.17.0 ## 1.6.0 ### Minor Changes * 3dd74ac: Added functionality for constructing and returning stamped requests for all packages * 4df8914: Version bump corresponding to mono release v2024.10.10. More detailed changelog to follow ### Patch Changes * Updated dependencies \[4df8914] * @turnkey/http\@2.16.0 ## 1.5.0 ### Minor Changes * 9ebd062: Release OTP functionality ### Patch Changes * Updated dependencies \[9ebd062] * @turnkey/http\@2.15.0 ## 1.4.2 ### Patch Changes * abe7138: Export DEFAULT\_SOLANA\_ACCOUNTS * 96d7f99: Update dependencies * Updated dependencies \[96d7f99] * @turnkey/http\@2.14.2 * @turnkey/api-key-stamper\@0.4.3 ## 1.4.1 ### Patch Changes * ff059d5: Update dependencies * Updated dependencies \[ff059d5] * @turnkey/http\@2.14.1 * @turnkey/api-key-stamper\@0.4.2 ## 1.4.0 ### Minor Changes * c988ed0: Support activity polling (e.g. for awaiting consensus) * \[Breaking] Update the `activityPoller` parameter for configuring polling behavior * Polling continues until either a max number of retries is reached, or if the activity hits a terminal status The shape of the parameter has gone from: ``` { duration: number; timeout: number; } ``` to ``` { intervalMs: number; numRetries: number; } ``` ### Patch Changes * Updated dependencies \[848f8d3] * @turnkey/http\@2.14.0 ## 1.3.0 ### Minor Changes * 93dee46: Add create read write session v2 which allows for user targeting directly from stamp or optional userId in intent ### Patch Changes * Updated dependencies \[93dee46] * @turnkey/http\@2.13.0 ## 1.2.4 ### Patch Changes * Updated dependencies \[e2f2e0b] * @turnkey/http\@2.12.3 ## 1.2.3 ### Patch Changes * Fix activity versioning for CREATE\_SUB\_ORGANIZATION (V5=>V6) ## 1.2.2 ### Patch Changes * Updated dependencies \[2d7e5a9] * @turnkey/api-key-stamper\@0.4.1 * @turnkey/http\@2.12.2 ## 1.2.1 ### Patch Changes * f17a229: Update to oauth related endpoints to drop jwks uri from oauth providers * Updated dependencies \[f17a229] * @turnkey/http\@2.12.1 ## 1.2.0 ### Minor Changes * Add Email Auth V2 - Optional invalidate exisiting Email Authentication API keys ### Patch Changes * Updated dependencies * @turnkey/http\@2.12.0 ## 1.1.0 ### Minor Changes * Update to use new endpoints. Including CREATE\_READ\_WRITE\_SESSION which allows one shot passkey sessions (returns org information and a credential bundle) and CREATE\_API\_KEYS\_V2 which allows a curve type to be passed (SECP256K1 or P256) ### Patch Changes * Updated dependencies * @turnkey/http\@2.11.0 ## 1.0.0 ### Major Changes * Stable Release: Add Oauth integration. New suborg creation version will now require an oauthProviders field under root users. ## 0.2.0 ### Minor Changes * updated syntax ### Patch Changes * e4d2a84: Update client name ## 0.1.0 ### Minor Changes * Ready for 0.1.0 ## 0.0.1 Initial (experimental) release! This is an alpha release and subject to change. # Solana Source: https://docs.turnkey.com/changelogs/solana/readme # @turnkey/solana ## 1.1.26 ### Patch Changes * Updated dependencies \[[`82dc76c`](https://github.com/tkhq/sdk/commit/82dc76c7ce51e5375570bbffab32eb739af90381), [`1d108d6`](https://github.com/tkhq/sdk/commit/1d108d6496ad8266db0e997a27aecc81e46008fb), [`dfdd864`](https://github.com/tkhq/sdk/commit/dfdd8647266fdd0297aaea32046ee815ae8fc27c)]: * @turnkey/core\@1.13.0 * @turnkey/sdk-browser\@5.15.2 * @turnkey/http\@3.17.1 * @turnkey/sdk-server\@5.1.1 ## 1.1.25 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-browser\@5.15.1 ## 1.1.24 ### Patch Changes * Updated dependencies \[[`af6262f`](https://github.com/tkhq/sdk/commit/af6262f31e1abb3090fcda1eec5318056e6d51fe), [`1f6e240`](https://github.com/tkhq/sdk/commit/1f6e2403fca1fd9cbca646f88c88dbc49ddb0c34), [`58e04e5`](https://github.com/tkhq/sdk/commit/58e04e5856626d9d2593abb61d8ca32d8ccbb833), [`7458b7c`](https://github.com/tkhq/sdk/commit/7458b7cd6fc64796b376e3374b7c2ed79467459c)]: * @turnkey/core\@1.12.0 * @turnkey/sdk-browser\@5.15.0 * @turnkey/sdk-server\@5.1.0 * @turnkey/http\@3.17.0 ## 1.1.23 ### Patch Changes * Updated dependencies \[[`d49ef7e`](https://github.com/tkhq/sdk/commit/d49ef7e9f0f78f16b1324a357f61cf0351198096), [`dced9db`](https://github.com/tkhq/sdk/commit/dced9dbbd8ea533442e19e45ce36e6a05a45a555), [`dced9db`](https://github.com/tkhq/sdk/commit/dced9dbbd8ea533442e19e45ce36e6a05a45a555)]: * @turnkey/core\@1.11.2 * @turnkey/sdk-browser\@5.14.3 * @turnkey/sdk-server\@5.0.3 * @turnkey/http\@3.16.3 ## 1.1.22 ### Patch Changes * Updated dependencies \[[`2d19991`](https://github.com/tkhq/sdk/commit/2d19991bcf4e1c9704b73a48c54e870373b4bd95), [`89d4084`](https://github.com/tkhq/sdk/commit/89d40844d791b0bbb6d439da5e778b1fdeca4273), [`4742eaf`](https://github.com/tkhq/sdk/commit/4742eafbfdcc6fe6b6d3aab01569ad94a5198571), [`ba2521d`](https://github.com/tkhq/sdk/commit/ba2521d5d1c1f6baaa58ee65dce8cc4839f7dc7b), [`12ca083`](https://github.com/tkhq/sdk/commit/12ca083314310b05cf41ac29fa2d55eed627f229), [`a85153c`](https://github.com/tkhq/sdk/commit/a85153c8ccc7454cd5aca974bc463fb47c7f8cd4)]: * @turnkey/core\@1.11.1 * @turnkey/sdk-server\@5.0.2 * @turnkey/sdk-browser\@5.14.2 * @turnkey/http\@3.16.2 ## 1.1.21 ### Patch Changes * Updated dependencies \[[`91d6a9e`](https://github.com/tkhq/sdk/commit/91d6a9eb1b9ac9e21745749615ac7a7be66f5cf6), [`699fbd7`](https://github.com/tkhq/sdk/commit/699fbd75ef3f44f768ae641ab4f652e966b8e289)]: * @turnkey/core\@1.11.0 * @turnkey/sdk-browser\@5.14.1 * @turnkey/http\@3.16.1 * @turnkey/sdk-server\@5.0.1 ## 1.1.20 ### Patch Changes * Updated dependencies \[[`6261eed`](https://github.com/tkhq/sdk/commit/6261eed95af8627bf1e95e7291b9760a2267e301), [`78ec1d9`](https://github.com/tkhq/sdk/commit/78ec1d9afcafde3ca7107fc720323d486d6afaea), [`dbd4d8e`](https://github.com/tkhq/sdk/commit/dbd4d8e4ea567240c4d287452dd0d8f53050beca), [`cfd34ab`](https://github.com/tkhq/sdk/commit/cfd34ab14ff2abed0e22dca9a802c58a96b9e8e1), [`78ec1d9`](https://github.com/tkhq/sdk/commit/78ec1d9afcafde3ca7107fc720323d486d6afaea)]: * @turnkey/core\@1.10.0 * @turnkey/sdk-server\@5.0.0 * @turnkey/sdk-browser\@5.14.0 * @turnkey/http\@3.16.0 ## 1.1.19 ### Patch Changes * Updated dependencies \[[`29a42db`](https://github.com/tkhq/sdk/commit/29a42db8f5f3ef8b9c23c90cd00f4c21027aac2e)]: * @turnkey/core\@1.9.0 * @turnkey/sdk-browser\@5.13.6 * @turnkey/sdk-server\@4.12.2 ## 1.1.18 ### Patch Changes * Updated dependencies \[[`7185545`](https://github.com/tkhq/sdk/commit/7185545ea1fc05eb738af09de5a594455f2e08f3)]: * @turnkey/core\@1.8.3 * @turnkey/sdk-browser\@5.13.5 ## 1.1.17 ### Patch Changes * Updated dependencies \[[`3c23fc2`](https://github.com/tkhq/sdk/commit/3c23fc27eda5325a90e79afff4cc3a16f682e1d9)]: * @turnkey/core\@1.8.2 ## 1.1.16 ### Patch Changes * Updated dependencies \[[`d4768c7`](https://github.com/tkhq/sdk/commit/d4768c71b6796532c9800d546154116e5d36b255)]: * @turnkey/core\@1.8.1 * @turnkey/sdk-browser\@5.13.4 ## 1.1.15 ### Patch Changes * Updated dependencies \[[`fd2e031`](https://github.com/tkhq/sdk/commit/fd2e0318079de922512b1f5adb404b11921f77b7), [`e1bd68f`](https://github.com/tkhq/sdk/commit/e1bd68f963d6bbd9c797b1a8f077efadccdec421)]: * @turnkey/core\@1.8.0 * @turnkey/sdk-browser\@5.13.3 * @turnkey/sdk-server\@4.12.1 ## 1.1.14 ### Patch Changes * Updated dependencies \[[`4d29af2`](https://github.com/tkhq/sdk/commit/4d29af2dd7c735916c650d697f18f66dd76c1b79)]: * @turnkey/sdk-browser\@5.13.2 ## 1.1.13 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-browser\@5.13.1 ## 1.1.12 ### Patch Changes * Updated dependencies \[[`beee465`](https://github.com/tkhq/sdk/commit/beee465a13f64abeb71c5c00519f7abab9942607), [`67b03a5`](https://github.com/tkhq/sdk/commit/67b03a5d9ab1b6eabfb0b41938ac91365b5dcd9b)]: * @turnkey/core\@1.7.0 * @turnkey/sdk-browser\@5.13.0 * @turnkey/sdk-server\@4.12.0 * @turnkey/http\@3.15.0 ## 1.1.11 ### Patch Changes * Updated dependencies \[[`71cdca3`](https://github.com/tkhq/sdk/commit/71cdca3b97ba520dc5327410a1e82cf9ad85fb0e), [`9fbd5c4`](https://github.com/tkhq/sdk/commit/9fbd5c459782dc3721dd0935d0a4458babce258b)]: * @turnkey/sdk-server\@4.11.0 * @turnkey/sdk-browser\@5.12.0 * @turnkey/core\@1.6.0 * @turnkey/http\@3.14.0 ## 1.1.10 ### Patch Changes * Updated dependencies \[]: * @turnkey/core\@1.5.2 * @turnkey/sdk-browser\@5.11.6 * @turnkey/sdk-server\@4.10.5 ## 1.1.9 ### Patch Changes * Updated dependencies \[[`886f319`](https://github.com/tkhq/sdk/commit/886f319fab8b0ba560d040e34598436f3beceff0)]: * @turnkey/core\@1.5.1 ## 1.1.8 ### Patch Changes * Updated dependencies \[[`5c4495b`](https://github.com/tkhq/sdk/commit/5c4495bff1b0abfe3c427ead1b8e1a8d510c8186), [`001d822`](https://github.com/tkhq/sdk/commit/001d8225202500e53aa399d6aee0c8f48f6060e0)]: * @turnkey/core\@1.5.0 * @turnkey/sdk-browser\@5.11.5 * @turnkey/sdk-server\@4.10.4 ## 1.1.7 ### Patch Changes * Updated dependencies \[[`9df42ad`](https://github.com/tkhq/sdk/commit/9df42adc02c7ff77afba3b938536e79b57882ef1)]: * @turnkey/sdk-browser\@5.11.4 * @turnkey/sdk-server\@4.10.3 * @turnkey/core\@1.4.2 * @turnkey/http\@3.13.1 ## 1.1.6 ### Patch Changes * Updated dependencies \[[`e5b9c5c`](https://github.com/tkhq/sdk/commit/e5b9c5c5694b1f4d60c0b8606822bcd6d61da4a3)]: * @turnkey/core\@1.4.1 ## 1.1.5 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-browser\@5.11.3 ## 1.1.4 ### Patch Changes * Updated dependencies \[[`6ceb06e`](https://github.com/tkhq/sdk/commit/6ceb06ebdbb11b017ed97e81a7e0dcb862813bfa), [`68631c4`](https://github.com/tkhq/sdk/commit/68631c4008387f845dfe4f1a139981011727f6c9)]: * @turnkey/core\@1.4.0 * @turnkey/sdk-browser\@5.11.2 * @turnkey/sdk-server\@4.10.2 ## 1.1.3 ### Patch Changes * Updated dependencies \[[`4adbf9b`](https://github.com/tkhq/sdk/commit/4adbf9bbb6b93f84aa80e06a1eeabd61d1dbbb86), [`4ead6da`](https://github.com/tkhq/sdk/commit/4ead6da626468fde41daf85eae90faf18651d1c1), [`3997c0f`](https://github.com/tkhq/sdk/commit/3997c0fd08a8a85108acf904c0bf39d69f8dc79c)]: * @turnkey/core\@1.3.0 * @turnkey/sdk-browser\@5.11.1 * @turnkey/sdk-server\@4.10.1 ## 1.1.2 ### Patch Changes * Updated dependencies \[[`4567059`](https://github.com/tkhq/sdk/commit/45670598f102223925b87a5295edca15a6ce8241), [`010543c`](https://github.com/tkhq/sdk/commit/010543c3b1b56a18816ea92a1a1cbe028cf988e4)]: * @turnkey/sdk-browser\@5.11.0 * @turnkey/sdk-server\@4.10.0 * @turnkey/core\@1.2.0 * @turnkey/http\@3.13.0 ## 1.1.1 ### Patch Changes * Updated dependencies \[[`0080c4d`](https://github.com/tkhq/sdk/commit/0080c4d011a7f8d04b41d89b31863b75d1a816ef), [`5a96fe8`](https://github.com/tkhq/sdk/commit/5a96fe80db4c4c45e09ad8c613695ee4c2b8e51f), [`c2a0bd7`](https://github.com/tkhq/sdk/commit/c2a0bd7ea8a53524cde16897f375f8a7088ba963), [`90841f9`](https://github.com/tkhq/sdk/commit/90841f95f3f738c47c04797096902d9d0a23afc7), [`e4bc82f`](https://github.com/tkhq/sdk/commit/e4bc82fc51c692d742923ccfff72c2c862ee71a4)]: * @turnkey/core\@1.1.0 * @turnkey/sdk-browser\@5.10.1 * @turnkey/sdk-server\@4.9.1 * @turnkey/http\@3.12.1 ## 1.1.0 ### Minor Changes * Updated dependencies \[[`fc1d6e2`](https://github.com/tkhq/sdk/commit/fc1d6e2d26f4a53116633e9e8cccccd792267f4e), [`fc1d6e2`](https://github.com/tkhq/sdk/commit/fc1d6e2d26f4a53116633e9e8cccccd792267f4e), [`4880f26`](https://github.com/tkhq/sdk/commit/4880f26a4dd324c049bff7f35284098ccfc55823), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`06347ad`](https://github.com/tkhq/sdk/commit/06347adfa08fb0867c350e43821d0fed06c49624)]: * @turnkey/sdk-server\@4.9.0 * @turnkey/core\@1.0.0 * @turnkey/http\@3.12.0 * @turnkey/sdk-browser\@5.10.0 ## 1.1.0-beta.1 ### Patch Changes * Updated dependencies \[]: * @turnkey/core\@1.0.0-beta.6 * @turnkey/sdk-browser\@5.9.0-beta.1 * @turnkey/http\@3.11.1-beta.0 * @turnkey/sdk-server\@4.8.1-beta.0 ## 1.1.0-beta.0 ### Minor Changes * SDK beta release @turnkey/react-wallet-kit @turnkey/core ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-browser\@5.9.0-beta.0 * @turnkey/sdk-server\@4.7.0-beta.2 * @turnkey/core\@1.0.0-beta.5 * @turnkey/http\@3.10.0-beta.2 ## 1.0.43 ### Patch Changes * Updated dependencies \[[`026264c`](https://github.com/tkhq/sdk/commit/026264c55aa16342c8925af0bdcdf72dc00e5158)]: * @turnkey/sdk-browser\@5.9.0 * @turnkey/sdk-server\@4.8.0 * @turnkey/http\@3.11.0 ## 1.0.42 ### Patch Changes * Updated dependencies \[[`5d8be2d`](https://github.com/tkhq/sdk/commit/5d8be2d0329070c7aa025dddb1b28f04257ae4e6)]: * @turnkey/sdk-browser\@5.8.0 * @turnkey/sdk-server\@4.7.0 * @turnkey/http\@3.10.0 ## 1.0.41-beta.4 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-server\@4.7.0-beta.1 * @turnkey/http\@3.10.0-beta.1 * @turnkey/sdk-browser\@5.7.1-beta.1 ## 1.0.41-beta.3 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-server\@4.7.0-beta.0 * @turnkey/http\@3.10.0-beta.0 * @turnkey/sdk-browser\@5.7.1-beta.0 ## 1.0.41-beta.2 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-browser\@5.6.1-beta.2 * @turnkey/http\@3.8.1-beta.2 * @turnkey/sdk-server\@4.5.1-beta.2 ## 1.0.41-beta.1 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-browser\@5.6.1-beta.1 * @turnkey/http\@3.8.1-beta.1 * @turnkey/sdk-server\@4.5.1-beta.1 ## 1.0.41-beta.0 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-browser\@5.6.1-beta.0 * @turnkey/http\@3.8.1-beta.0 * @turnkey/sdk-server\@4.5.1-beta.0 ## 1.0.41 ### Patch Changes * Updated dependencies \[[`8b39dba`](https://github.com/tkhq/sdk/commit/8b39dbabf68d3e376b5b07f26960d5b61ae87fa9), [`1a549b7`](https://github.com/tkhq/sdk/commit/1a549b71f9a6e7ab59d52aaae7e58e34c8f2e8b5)]: * @turnkey/sdk-browser\@5.7.0 * @turnkey/sdk-server\@4.6.0 * @turnkey/http\@3.9.0 ## 1.0.40 ### Patch Changes * Updated dependencies \[[`f83f25b`](https://github.com/tkhq/sdk/commit/f83f25ba33ef15dbd66723531eebe2fd00f43ac0)]: * @turnkey/sdk-browser\@5.6.0 * @turnkey/sdk-server\@4.5.0 * @turnkey/http\@3.8.0 ## 1.0.39 ### Patch Changes * Updated dependencies \[[`81e355c`](https://github.com/tkhq/sdk/commit/81e355c9a8321feffcac056916b65139cf35eeed)]: * @turnkey/http\@3.7.0 * @turnkey/sdk-browser\@5.5.0 * @turnkey/sdk-server\@4.4.0 ## 1.0.38 ### Patch Changes * Updated dependencies \[[`0d1eb2c`](https://github.com/tkhq/sdk/commit/0d1eb2c464bac3cf6f4386f402604ecf8f373f15)]: * @turnkey/sdk-browser\@5.4.1 ## 1.0.37 ### Patch Changes * Updated dependencies \[[`e90a478`](https://github.com/tkhq/sdk/commit/e90a478c9208d858b1144df9b2c2c7ba956c406e)]: * @turnkey/sdk-browser\@5.4.0 * @turnkey/sdk-server\@4.3.0 * @turnkey/http\@3.6.0 ## 1.0.36 ### Patch Changes * Updated dependencies \[[`2db00b0`](https://github.com/tkhq/sdk/commit/2db00b0a799d09ae33fa08a117e3b2f433f2b0b4)]: * @turnkey/sdk-server\@4.2.4 ## 1.0.35 ### Patch Changes * Updated dependencies \[[`cb13c26`](https://github.com/tkhq/sdk/commit/cb13c26edb79a01ab651e3b2897334fd154b436a)]: * @turnkey/sdk-browser\@5.3.4 * @turnkey/sdk-server\@4.2.3 * @turnkey/http\@3.5.1 ## 1.0.34 ### Patch Changes * Updated dependencies \[[`2c4f42c`](https://github.com/tkhq/sdk/commit/2c4f42c747ac8017cf17e86b0ca0c3fa6f593bbf)]: * @turnkey/sdk-browser\@5.3.3 ## 1.0.33 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-browser\@5.3.2 * @turnkey/sdk-server\@4.2.2 ## 1.0.32 ### Patch Changes * Updated dependencies \[[`fa46701`](https://github.com/tkhq/sdk/commit/fa467019eef34b5199372248edff1e7a64934e79)]: * @turnkey/sdk-browser\@5.3.1 * @turnkey/sdk-server\@4.2.1 ## 1.0.31 ### Patch Changes * Updated dependencies \[[`5f3dd98`](https://github.com/tkhq/sdk/commit/5f3dd9814650308b3bf3198168c453e7b1a98efd), [`5f3dd98`](https://github.com/tkhq/sdk/commit/5f3dd9814650308b3bf3198168c453e7b1a98efd), [`7625df0`](https://github.com/tkhq/sdk/commit/7625df0538002c3455bd5862211210e38472e164)]: * @turnkey/http\@3.5.0 * @turnkey/sdk-browser\@5.3.0 * @turnkey/sdk-server\@4.2.0 ## 1.0.30 ### Patch Changes * Updated dependencies: * @turnkey/sdk-browser\@5.2.3 ## 1.0.29 ### Patch Changes * Updated dependencies: * @turnkey/sdk-browser\@5.2.2 ## 1.0.28 ### Patch Changes * [#665](https://github.com/tkhq/sdk/pull/665) [`be0a621`](https://github.com/tkhq/sdk/commit/be0a621fb962bd51d2df1a1e79f5260d7c696772) Author [@amircheikh](https://github.com/amircheikh) - Fix for `no runner registered` error when using mismatched versions of turnkey/http * Updated dependencies \[[`be0a621`](https://github.com/tkhq/sdk/commit/be0a621fb962bd51d2df1a1e79f5260d7c696772)]: * @turnkey/http\@3.4.2 * @turnkey/sdk-browser\@5.2.1 * @turnkey/sdk-server\@4.1.1 ## 1.0.27 ### Patch Changes * Updated dependencies \[[`5afbe51`](https://github.com/tkhq/sdk/commit/5afbe51949bdd1997fad083a4c1e4272ff7409dc), [`a38a6e3`](https://github.com/tkhq/sdk/commit/a38a6e36dc2bf9abdea64bc817d1cad95b8a289a), [`40c4035`](https://github.com/tkhq/sdk/commit/40c40359ec7096d0bca39ffc93e89361b3b11a1a), [`593de2d`](https://github.com/tkhq/sdk/commit/593de2d9404ec8cf53426f9cf832c13eefa3fbf2)]: * @turnkey/sdk-browser\@5.2.0 * @turnkey/sdk-server\@4.1.0 * @turnkey/http\@3.4.1 ## 1.0.26 ### Patch Changes * Updated dependencies \[[`27fe590`](https://github.com/tkhq/sdk/commit/27fe590cdc3eb6a8cde093eeefda2ee1cdc79412)]: * @turnkey/sdk-browser\@5.1.0 * @turnkey/sdk-server\@4.0.1 ## 1.0.25 ### Patch Changes * Updated dependencies \[[`07dfd33`](https://github.com/tkhq/sdk/commit/07dfd3397472687092e1c73b1d68714f421b9ca0), [`e8a5f1b`](https://github.com/tkhq/sdk/commit/e8a5f1b431623c4ff1cb85c6039464b328cf0e6a)]: * @turnkey/sdk-browser\@5.0.0 * @turnkey/sdk-server\@4.0.0 * @turnkey/http\@3.4.0 ## 1.0.24 ### Patch Changes * Updated dependencies \[25ca339] * @turnkey/sdk-browser\@4.3.0 * @turnkey/sdk-server\@3.3.0 * @turnkey/http\@3.3.0 ## 1.0.23 ### Patch Changes * Updated dependencies \[3f6e415] * @turnkey/sdk-browser\@4.2.0 * @turnkey/sdk-server\@3.2.0 * @turnkey/http\@3.2.0 ## 1.0.22 ### Patch Changes * Updated dependencies \[3e4a482] * @turnkey/sdk-browser\@4.1.0 * @turnkey/sdk-server\@3.1.0 * @turnkey/http\@3.1.0 ## 1.0.21 ### Patch Changes * Updated dependencies \[7b72769] * @turnkey/sdk-server\@3.0.1 ## 1.0.20 ### Patch Changes * Updated dependencies \[e501690] * Updated dependencies \[d1083bd] * Updated dependencies \[f94d36e] * @turnkey/sdk-browser\@4.0.0 * @turnkey/sdk-server\@3.0.0 * @turnkey/http\@3.0.0 ## 1.0.19 ### Patch Changes * Updated dependencies \[bf87774] * @turnkey/sdk-browser\@3.1.0 ## 1.0.18 ### Patch Changes * Updated dependencies \[5ec5187] * @turnkey/sdk-browser\@3.0.1 * @turnkey/sdk-server\@2.6.1 ## 1.0.17 ### Patch Changes * Updated dependencies \[0e4e959] * Updated dependencies \[856f449] * Updated dependencies \[c9ae537] * Updated dependencies \[d4ce5fa] * Updated dependencies \[ecdb29a] * Updated dependencies \[72890f5] * @turnkey/sdk-browser\@3.0.0 * @turnkey/sdk-server\@2.6.0 * @turnkey/http\@2.22.0 ## 1.0.16 ### Patch Changes * Updated dependencies \[93540e7] * Updated dependencies \[fdb8bf0] * Updated dependencies \[9147962] * @turnkey/sdk-browser\@2.0.0 * @turnkey/sdk-server\@2.5.0 ## 1.0.15 ### Patch Changes * Updated dependencies \[233ae71] * Updated dependencies \[9317588] * @turnkey/sdk-browser\@1.16.0 * @turnkey/sdk-server\@2.4.0 ## 1.0.14 ### Patch Changes * Updated dependencies \[56a307e] * @turnkey/sdk-browser\@1.15.0 * @turnkey/sdk-server\@2.3.0 * @turnkey/http\@2.21.0 ## 1.0.13 ### Patch Changes * Updated dependencies \[3c44c4a] * Updated dependencies \[bfc833f] * @turnkey/sdk-browser\@1.14.0 * @turnkey/sdk-server\@2.2.0 * @turnkey/http\@2.20.0 ## 1.0.12 ### Patch Changes * Updated dependencies \[69d2571] * Updated dependencies \[57f9cb0] * @turnkey/sdk-browser\@1.13.0 * @turnkey/sdk-server\@2.1.0 * @turnkey/http\@2.19.0 ## 1.0.11 ### Patch Changes * Updated dependencies \[755833b] * @turnkey/sdk-browser\@1.12.1 * @turnkey/sdk-server\@2.0.1 ## 1.0.10 ### Patch Changes * Updated dependencies \[6695af2] * Updated dependencies \[1ebd4e2] * @turnkey/sdk-browser\@1.12.0 * @turnkey/sdk-server\@2.0.0 * @turnkey/http\@2.18.0 ## 1.0.9 ### Patch Changes * Updated dependencies \[053fbfb] * @turnkey/sdk-browser\@1.11.2 * @turnkey/sdk-server\@1.7.3 * @turnkey/http\@2.17.3 ## 1.0.8 ### Patch Changes * Updated dependencies \[328d6aa] * Updated dependencies \[b90947e] * Updated dependencies \[2d5977b] * Updated dependencies \[fad7c37] * @turnkey/sdk-browser\@1.11.1 * @turnkey/sdk-server\@1.7.2 * @turnkey/http\@2.17.2 ## 1.0.7 ### Patch Changes * c895c8f: Update @solana/web3.js from ^1.88.1 to ^1.95.8 * Updated dependencies \[7988bc1] * Updated dependencies \[538d4fc] * Updated dependencies \[12d5aaa] * @turnkey/sdk-browser\@1.11.0 * @turnkey/sdk-server\@1.7.1 * @turnkey/http\@2.17.1 ## 1.0.6 ### Patch Changes * @turnkey/sdk-browser\@1.10.2 ## 1.0.5 ### Patch Changes * Updated dependencies \[78bc39c] * @turnkey/sdk-server\@1.7.0 * @turnkey/http\@2.17.0 * @turnkey/sdk-browser\@1.10.1 ## 1.0.4 ### Patch Changes * 9eaf38a: Add optional org id for all signing methods ## 1.0.3 ### Patch Changes * Updated dependencies \[8bea78f] * @turnkey/sdk-browser\@1.10.0 ## 1.0.2 ### Patch Changes * b55bc32: Add optional org id to addSignature function * Updated dependencies \[3dd74ac] * Updated dependencies \[1e36edf] * Updated dependencies \[4df8914] * Updated dependencies \[11a9e2f] * @turnkey/sdk-browser\@1.9.0 * @turnkey/sdk-server\@1.6.0 * @turnkey/http\@2.16.0 ## 1.0.1 ### Patch Changes * Updated dependencies \[9ebd062] * @turnkey/sdk-browser\@1.8.0 * @turnkey/sdk-server\@1.5.0 * @turnkey/http\@2.15.0 ## 1.0.0 ### Major Changes * a4f0f69: Integrate @turnkey/solana with Turnkey's Sign Transaction endpoint. There are no breaking changes, but a major release felt right given this is effectively adding "full" Solana support. This release introduces a new method: `signTransaction`. Under the hood, this creates an activity of type `ACTIVITY_TYPE_SIGN_TRANSACTION_V2`. There is **no action required** for existing users of `addSignature`. * `addSignature` does not use our Policy Engine, and instead signs a transaction's message straight up * While `addSignature` mutates the incoming transaction by adding a signature to it directly, `signTransaction` returns a new transaction object * Both legacy and versioned (V0) transactions are supported For some examples of how you can use Turnkey's Policy Engine with Solana transactions, see [https://docs.turnkey.com/concepts/policies/examples](https://docs.turnkey.com/concepts/policies/examples). ### Patch Changes * Updated dependencies \[abe7138] * Updated dependencies \[96d7f99] * @turnkey/sdk-server\@1.4.2 * @turnkey/sdk-browser\@1.7.1 * @turnkey/http\@2.14.2 ## 0.5.1 ### Patch Changes * Updated dependencies \[ff059d5] * Updated dependencies \[ff059d5] * @turnkey/sdk-browser\@1.7.0 * @turnkey/sdk-server\@1.4.1 * @turnkey/http\@2.14.1 ## 0.5.0 ### Minor Changes * bdded80: Support awaiting consensus ### Patch Changes * Updated dependencies \[c988ed0] * Updated dependencies \[848f8d3] * @turnkey/sdk-browser\@1.6.0 * @turnkey/sdk-server\@1.4.0 * @turnkey/http\@2.14.0 ## 0.4.3 ### Patch Changes * Updated dependencies \[1813ed5] * @turnkey/sdk-browser\@1.5.0 ## 0.4.2 ### Patch Changes * Updated dependencies \[bab5393] * Updated dependencies \[a16073c] * Updated dependencies \[7e7d209] * @turnkey/sdk-browser\@1.4.0 ## 0.4.1 ### Patch Changes * Updated dependencies \[93dee46] * @turnkey/http\@2.13.0 * @turnkey/sdk-browser\@1.3.0 * @turnkey/sdk-server\@1.3.0 ## 0.4.0 ### Minor Changes * c342954: Add compatibility with @turnkey/sdk-server and @turnkey/sdk-browser ## 0.3.10 ### Patch Changes * Updated dependencies \[e2f2e0b] * @turnkey/http\@2.12.3 ## 0.3.9 ### Patch Changes * Updated dependencies \[2d7e5a9] * @turnkey/http\@2.12.2 ## 0.3.8 ### Patch Changes * Updated dependencies \[f17a229] * @turnkey/http\@2.12.1 ## 0.3.7 ### Patch Changes * Updated dependencies * @turnkey/http\@2.12.0 ## 0.3.6 ### Patch Changes * Updated dependencies * @turnkey/http\@2.11.0 ## 0.3.5 ### Patch Changes * Updated dependencies \[7a9ce7a] * @turnkey/http\@2.10.0 ## 0.3.4 ### Patch Changes * Updated dependencies * @turnkey/http\@2.9.1 ## 0.3.3 ### Patch Changes * Updated dependencies \[83b62b5] * @turnkey/http\@2.9.0 ## 0.3.2 ### Patch Changes * Updated dependencies \[46a7d90] * @turnkey/http\@2.8.0 ## 0.3.1 ### Patch Changes Adjust logic for signing transactions and versioned transactions to avoid typechecks (#218) ## 0.3.0 ### Minor Changes Add support for signing Solana versioned transactions (#216) ## 0.2.2 ### Patch Changes * Updated dependencies * @turnkey/http\@2.7.1 ## 0.2.1 ### Patch Changes * Updated dependencies \[d73725b] * @turnkey/http\@2.7.0 ## 0.2.0 ### Minor Changes * \#202: implements `signMessage` on the Solana `TurnkeySigner` ## 0.1.1 * Fix readme link ## 0.1.0 * Initial release # Telegram Cloud Storage Stamper Source: https://docs.turnkey.com/changelogs/telegram-cloud-storage-stamper/readme # @turnkey/telegram-cloud-storage-stamper ## 2.1.4 ### Patch Changes * Updated dependencies \[]: * @turnkey/api-key-stamper\@0.6.3 ## 2.1.3 ### Patch Changes * Updated dependencies \[]: * @turnkey/api-key-stamper\@0.6.2 ## 2.1.2 ### Patch Changes * Updated dependencies \[]: * @turnkey/api-key-stamper\@0.6.1 ## 2.1.1 ### Patch Changes * Updated dependencies \[[`91d6a9e`](https://github.com/tkhq/sdk/commit/91d6a9eb1b9ac9e21745749615ac7a7be66f5cf6)]: * @turnkey/api-key-stamper\@0.6.0 ## 2.1.0 ### Minor Changes * Updated dependencies \[[`06347ad`](https://github.com/tkhq/sdk/commit/06347adfa08fb0867c350e43821d0fed06c49624)]: * @turnkey/api-key-stamper\@0.5.0 ## 2.1.0-beta.6 ### Patch Changes * Updated dependencies \[]: * @turnkey/api-key-stamper\@0.5.0-beta.6 ## 2.1.0-beta.5 ### Minor Changes * SDK beta release @turnkey/react-wallet-kit @turnkey/core ### Patch Changes * Updated dependencies \[]: * @turnkey/api-key-stamper\@0.5.0-beta.5 ## 2.0.4-beta.4 ### Patch Changes * Updated dependencies \[]: * @turnkey/api-key-stamper\@0.4.8-beta.4 ## 2.0.4-beta.3 ### Patch Changes * Updated dependencies \[]: * @turnkey/api-key-stamper\@0.4.8-beta.3 ## 2.0.4-beta.2 ### Patch Changes * Updated dependencies \[]: * @turnkey/api-key-stamper\@0.4.8-beta.2 ## 2.0.4-beta.1 ### Patch Changes * Updated dependencies \[]: * @turnkey/api-key-stamper\@0.4.8-beta.1 ## 2.0.4-beta.0 ### Patch Changes * Updated dependencies \[]: * @turnkey/api-key-stamper\@0.4.8-beta.0 ## 2.0.3 ### Patch Changes * Updated dependencies \[[`7625df0`](https://github.com/tkhq/sdk/commit/7625df0538002c3455bd5862211210e38472e164)]: * @turnkey/api-key-stamper\@0.4.7 ## 2.0.2 ### Patch Changes * Updated dependencies \[]: * @turnkey/api-key-stamper\@0.4.6 ## 2.0.1 ### Patch Changes * Updated dependencies \[4d1d775] * @turnkey/api-key-stamper\@0.4.5 ## 2.0.0 ### Major Changes * 24ca647: Remove default export and used all named exports for consistency ### Package imports for `@turnkey/telegram-cloud-storage-stamper` #### for versions \< v2.0.0 ```typescript theme={"system"} import TelegramCloudStorageStamper, { CloudStorageAPIKey, } from "@turnkey/telegram-cloud-storage-stamper"; ``` #### for versions >= v2.0.0 ```typescript theme={"system"} import { TelegramCloudStorageStamper, CloudStorageAPIKey, } from "@turnkey/telegram-cloud-storage-stamper"; ``` ## 1.0.3 ### Patch Changes * Updated dependencies \[2d5977b] * @turnkey/api-key-stamper\@0.4.4 ## 1.0.2 ### Patch Changes * Export the default cloud storage api key location ## 1.0.1 ### Patch Changes * Update the default cloud storage key to conform to cloud storage key constraints ## 1.0.0 ### Major Changes * Initial release of the telegram-cloud-storage-stamper package. This package is to be used alongside Telegram mini-app development and provides a stamping utility and an interface into Telegram Cloud Storage. More can be read in the [readme](https://github.com/tkhq/sdk/tree/main/packages/telegram-cloud-storage-stamper). # TVC changelog Source: https://docs.turnkey.com/changelogs/tvc-changelog/readme PLACEHOLDER -- Version history for Turnkey's Verifiable Cloud. # TVC changelog > **This is a placeholder page.** TVC changelog entries will be added in a future phase. # Viem Source: https://docs.turnkey.com/changelogs/viem/readme # @turnkey/viem ## 0.14.26 ### Patch Changes * Updated dependencies \[[`82dc76c`](https://github.com/tkhq/sdk/commit/82dc76c7ce51e5375570bbffab32eb739af90381), [`1d108d6`](https://github.com/tkhq/sdk/commit/1d108d6496ad8266db0e997a27aecc81e46008fb), [`dfdd864`](https://github.com/tkhq/sdk/commit/dfdd8647266fdd0297aaea32046ee815ae8fc27c)]: * @turnkey/core\@1.13.0 * @turnkey/sdk-browser\@5.15.2 * @turnkey/api-key-stamper\@0.6.3 * @turnkey/http\@3.17.1 * @turnkey/sdk-server\@5.1.1 ## 0.14.25 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-browser\@5.15.1 ## 0.14.24 ### Patch Changes * Updated dependencies \[[`af6262f`](https://github.com/tkhq/sdk/commit/af6262f31e1abb3090fcda1eec5318056e6d51fe), [`1f6e240`](https://github.com/tkhq/sdk/commit/1f6e2403fca1fd9cbca646f88c88dbc49ddb0c34), [`58e04e5`](https://github.com/tkhq/sdk/commit/58e04e5856626d9d2593abb61d8ca32d8ccbb833), [`7458b7c`](https://github.com/tkhq/sdk/commit/7458b7cd6fc64796b376e3374b7c2ed79467459c)]: * @turnkey/core\@1.12.0 * @turnkey/sdk-browser\@5.15.0 * @turnkey/sdk-server\@5.1.0 * @turnkey/http\@3.17.0 * @turnkey/api-key-stamper\@0.6.2 ## 0.14.23 ### Patch Changes * [#1182](https://github.com/tkhq/sdk/pull/1182) [`fb5a861`](https://github.com/tkhq/sdk/commit/fb5a86122c8afc51a7a2868fe01dc49dd0d4e076) Author [@andrewkmin](https://github.com/andrewkmin) - Add support for Tempo transaction signing * Updated dependencies \[[`d49ef7e`](https://github.com/tkhq/sdk/commit/d49ef7e9f0f78f16b1324a357f61cf0351198096), [`dced9db`](https://github.com/tkhq/sdk/commit/dced9dbbd8ea533442e19e45ce36e6a05a45a555), [`dced9db`](https://github.com/tkhq/sdk/commit/dced9dbbd8ea533442e19e45ce36e6a05a45a555)]: * @turnkey/core\@1.11.2 * @turnkey/sdk-browser\@5.14.3 * @turnkey/sdk-server\@5.0.3 * @turnkey/http\@3.16.3 ## 0.14.22 ### Patch Changes * Updated dependencies \[[`2d19991`](https://github.com/tkhq/sdk/commit/2d19991bcf4e1c9704b73a48c54e870373b4bd95), [`89d4084`](https://github.com/tkhq/sdk/commit/89d40844d791b0bbb6d439da5e778b1fdeca4273), [`4742eaf`](https://github.com/tkhq/sdk/commit/4742eafbfdcc6fe6b6d3aab01569ad94a5198571), [`ba2521d`](https://github.com/tkhq/sdk/commit/ba2521d5d1c1f6baaa58ee65dce8cc4839f7dc7b), [`12ca083`](https://github.com/tkhq/sdk/commit/12ca083314310b05cf41ac29fa2d55eed627f229), [`a85153c`](https://github.com/tkhq/sdk/commit/a85153c8ccc7454cd5aca974bc463fb47c7f8cd4)]: * @turnkey/core\@1.11.1 * @turnkey/sdk-server\@5.0.2 * @turnkey/sdk-browser\@5.14.2 * @turnkey/api-key-stamper\@0.6.1 * @turnkey/http\@3.16.2 ## 0.14.21 ### Patch Changes * Updated dependencies \[[`91d6a9e`](https://github.com/tkhq/sdk/commit/91d6a9eb1b9ac9e21745749615ac7a7be66f5cf6), [`91d6a9e`](https://github.com/tkhq/sdk/commit/91d6a9eb1b9ac9e21745749615ac7a7be66f5cf6), [`699fbd7`](https://github.com/tkhq/sdk/commit/699fbd75ef3f44f768ae641ab4f652e966b8e289)]: * @turnkey/core\@1.11.0 * @turnkey/api-key-stamper\@0.6.0 * @turnkey/sdk-browser\@5.14.1 * @turnkey/http\@3.16.1 * @turnkey/sdk-server\@5.0.1 ## 0.14.20 ### Patch Changes * Updated dependencies \[[`6261eed`](https://github.com/tkhq/sdk/commit/6261eed95af8627bf1e95e7291b9760a2267e301), [`78ec1d9`](https://github.com/tkhq/sdk/commit/78ec1d9afcafde3ca7107fc720323d486d6afaea), [`dbd4d8e`](https://github.com/tkhq/sdk/commit/dbd4d8e4ea567240c4d287452dd0d8f53050beca), [`cfd34ab`](https://github.com/tkhq/sdk/commit/cfd34ab14ff2abed0e22dca9a802c58a96b9e8e1), [`78ec1d9`](https://github.com/tkhq/sdk/commit/78ec1d9afcafde3ca7107fc720323d486d6afaea)]: * @turnkey/core\@1.10.0 * @turnkey/sdk-server\@5.0.0 * @turnkey/sdk-browser\@5.14.0 * @turnkey/http\@3.16.0 ## 0.14.19 ### Patch Changes * Updated dependencies \[[`29a42db`](https://github.com/tkhq/sdk/commit/29a42db8f5f3ef8b9c23c90cd00f4c21027aac2e)]: * @turnkey/core\@1.9.0 * @turnkey/sdk-browser\@5.13.6 * @turnkey/sdk-server\@4.12.2 ## 0.14.18 ### Patch Changes * Updated dependencies \[[`7185545`](https://github.com/tkhq/sdk/commit/7185545ea1fc05eb738af09de5a594455f2e08f3)]: * @turnkey/core\@1.8.3 * @turnkey/sdk-browser\@5.13.5 ## 0.14.17 ### Patch Changes * Updated dependencies \[[`3c23fc2`](https://github.com/tkhq/sdk/commit/3c23fc27eda5325a90e79afff4cc3a16f682e1d9)]: * @turnkey/core\@1.8.2 ## 0.14.16 ### Patch Changes * Updated dependencies \[[`d4768c7`](https://github.com/tkhq/sdk/commit/d4768c71b6796532c9800d546154116e5d36b255)]: * @turnkey/core\@1.8.1 * @turnkey/sdk-browser\@5.13.4 ## 0.14.15 ### Patch Changes * Updated dependencies \[[`fd2e031`](https://github.com/tkhq/sdk/commit/fd2e0318079de922512b1f5adb404b11921f77b7), [`e1bd68f`](https://github.com/tkhq/sdk/commit/e1bd68f963d6bbd9c797b1a8f077efadccdec421)]: * @turnkey/core\@1.8.0 * @turnkey/sdk-browser\@5.13.3 * @turnkey/sdk-server\@4.12.1 ## 0.14.14 ### Patch Changes * Updated dependencies \[[`4d29af2`](https://github.com/tkhq/sdk/commit/4d29af2dd7c735916c650d697f18f66dd76c1b79)]: * @turnkey/sdk-browser\@5.13.2 ## 0.14.13 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-browser\@5.13.1 ## 0.14.12 ### Patch Changes * Updated dependencies \[[`beee465`](https://github.com/tkhq/sdk/commit/beee465a13f64abeb71c5c00519f7abab9942607), [`67b03a5`](https://github.com/tkhq/sdk/commit/67b03a5d9ab1b6eabfb0b41938ac91365b5dcd9b)]: * @turnkey/core\@1.7.0 * @turnkey/sdk-browser\@5.13.0 * @turnkey/sdk-server\@4.12.0 * @turnkey/http\@3.15.0 ## 0.14.11 ### Patch Changes * Updated dependencies \[[`71cdca3`](https://github.com/tkhq/sdk/commit/71cdca3b97ba520dc5327410a1e82cf9ad85fb0e), [`9fbd5c4`](https://github.com/tkhq/sdk/commit/9fbd5c459782dc3721dd0935d0a4458babce258b)]: * @turnkey/sdk-server\@4.11.0 * @turnkey/sdk-browser\@5.12.0 * @turnkey/core\@1.6.0 * @turnkey/http\@3.14.0 ## 0.14.10 ### Patch Changes * [#1030](https://github.com/tkhq/sdk/pull/1030) [`a177cd5`](https://github.com/tkhq/sdk/commit/a177cd5ba4bcb52d7d2121871e50a21f75622667) Author [@Serdnad](https://github.com/Serdnad) - Fix object returned by signAuthorization to not include duplicate 0x prefixes. * Updated dependencies \[]: * @turnkey/core\@1.5.2 * @turnkey/sdk-browser\@5.11.6 * @turnkey/sdk-server\@4.10.5 ## 0.14.9 ### Patch Changes * Updated dependencies \[[`886f319`](https://github.com/tkhq/sdk/commit/886f319fab8b0ba560d040e34598436f3beceff0)]: * @turnkey/core\@1.5.1 ## 0.14.8 ### Patch Changes * Updated dependencies \[[`5c4495b`](https://github.com/tkhq/sdk/commit/5c4495bff1b0abfe3c427ead1b8e1a8d510c8186), [`001d822`](https://github.com/tkhq/sdk/commit/001d8225202500e53aa399d6aee0c8f48f6060e0)]: * @turnkey/core\@1.5.0 * @turnkey/sdk-browser\@5.11.5 * @turnkey/sdk-server\@4.10.4 ## 0.14.7 ### Patch Changes * Updated dependencies \[[`9df42ad`](https://github.com/tkhq/sdk/commit/9df42adc02c7ff77afba3b938536e79b57882ef1)]: * @turnkey/sdk-browser\@5.11.4 * @turnkey/sdk-server\@4.10.3 * @turnkey/core\@1.4.2 * @turnkey/http\@3.13.1 ## 0.14.6 ### Patch Changes * Updated dependencies \[[`e5b9c5c`](https://github.com/tkhq/sdk/commit/e5b9c5c5694b1f4d60c0b8606822bcd6d61da4a3)]: * @turnkey/core\@1.4.1 ## 0.14.5 ### Patch Changes * [#995](https://github.com/tkhq/sdk/pull/995) [`9fbcbba`](https://github.com/tkhq/sdk/commit/9fbcbbafb824a24c4f99b54966920ba78e924025) Author [@ethankonk](https://github.com/ethankonk) - Fixed the signAuthorization return type to match viem's signAuthorization return * Updated dependencies \[]: * @turnkey/sdk-browser\@5.11.3 ## 0.14.4 ### Patch Changes * Updated dependencies \[[`6ceb06e`](https://github.com/tkhq/sdk/commit/6ceb06ebdbb11b017ed97e81a7e0dcb862813bfa), [`68631c4`](https://github.com/tkhq/sdk/commit/68631c4008387f845dfe4f1a139981011727f6c9)]: * @turnkey/core\@1.4.0 * @turnkey/sdk-browser\@5.11.2 * @turnkey/sdk-server\@4.10.2 ## 0.14.3 ### Patch Changes * Updated dependencies \[[`4adbf9b`](https://github.com/tkhq/sdk/commit/4adbf9bbb6b93f84aa80e06a1eeabd61d1dbbb86), [`4ead6da`](https://github.com/tkhq/sdk/commit/4ead6da626468fde41daf85eae90faf18651d1c1), [`3997c0f`](https://github.com/tkhq/sdk/commit/3997c0fd08a8a85108acf904c0bf39d69f8dc79c)]: * @turnkey/core\@1.3.0 * @turnkey/sdk-browser\@5.11.1 * @turnkey/sdk-server\@4.10.1 ## 0.14.2 ### Patch Changes * Updated dependencies \[[`4567059`](https://github.com/tkhq/sdk/commit/45670598f102223925b87a5295edca15a6ce8241), [`010543c`](https://github.com/tkhq/sdk/commit/010543c3b1b56a18816ea92a1a1cbe028cf988e4)]: * @turnkey/sdk-browser\@5.11.0 * @turnkey/sdk-server\@4.10.0 * @turnkey/core\@1.2.0 * @turnkey/http\@3.13.0 ## 0.14.1 ### Patch Changes * Updated dependencies \[[`0080c4d`](https://github.com/tkhq/sdk/commit/0080c4d011a7f8d04b41d89b31863b75d1a816ef), [`5a96fe8`](https://github.com/tkhq/sdk/commit/5a96fe80db4c4c45e09ad8c613695ee4c2b8e51f), [`c2a0bd7`](https://github.com/tkhq/sdk/commit/c2a0bd7ea8a53524cde16897f375f8a7088ba963), [`90841f9`](https://github.com/tkhq/sdk/commit/90841f95f3f738c47c04797096902d9d0a23afc7), [`e4bc82f`](https://github.com/tkhq/sdk/commit/e4bc82fc51c692d742923ccfff72c2c862ee71a4)]: * @turnkey/core\@1.1.0 * @turnkey/sdk-browser\@5.10.1 * @turnkey/sdk-server\@4.9.1 * @turnkey/http\@3.12.1 ## 0.14.0 ### Minor Changes * Updated dependencies \[[`fc1d6e2`](https://github.com/tkhq/sdk/commit/fc1d6e2d26f4a53116633e9e8cccccd792267f4e), [`fc1d6e2`](https://github.com/tkhq/sdk/commit/fc1d6e2d26f4a53116633e9e8cccccd792267f4e), [`4880f26`](https://github.com/tkhq/sdk/commit/4880f26a4dd324c049bff7f35284098ccfc55823), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`06347ad`](https://github.com/tkhq/sdk/commit/06347adfa08fb0867c350e43821d0fed06c49624)]: * @turnkey/sdk-server\@4.9.0 * @turnkey/core\@1.0.0 * @turnkey/http\@3.12.0 * @turnkey/api-key-stamper\@0.5.0 * @turnkey/sdk-browser\@5.10.0 ## 0.14.0-beta.1 ### Patch Changes * Updated dependencies \[]: * @turnkey/core\@1.0.0-beta.6 * @turnkey/sdk-browser\@5.9.0-beta.1 * @turnkey/api-key-stamper\@0.5.0-beta.6 * @turnkey/http\@3.11.1-beta.0 * @turnkey/sdk-server\@4.8.1-beta.0 ## 0.14.0-beta.0 ### Minor Changes * SDK beta release @turnkey/react-wallet-kit @turnkey/core ### Patch Changes * Updated dependencies \[]: * @turnkey/api-key-stamper\@0.5.0-beta.5 * @turnkey/sdk-browser\@5.9.0-beta.0 * @turnkey/sdk-server\@4.7.0-beta.2 * @turnkey/core\@1.0.0-beta.5 * @turnkey/http\@3.10.0-beta.2 ## 0.13.1 ### Patch Changes * Updated dependencies \[[`026264c`](https://github.com/tkhq/sdk/commit/026264c55aa16342c8925af0bdcdf72dc00e5158)]: * @turnkey/sdk-browser\@5.9.0 * @turnkey/sdk-server\@4.8.0 * @turnkey/http\@3.11.0 ## 0.13.0 ### Minor Changes * [#847](https://github.com/tkhq/sdk/pull/847) [`bc88e60`](https://github.com/tkhq/sdk/commit/bc88e60955883b13d93c04d5681f9b081cdaee92) Author [@andrewkmin](https://github.com/andrewkmin) - Support `signAuthorization` with bespoke, policy-engine compatible payload encoding type. This means you can now target an `address`, `nonce`, or `chainId` within policies. For more information, see an example in our docs [here](https://docs.turnkey.com/policies/examples/ethereum#allow-signing-of-eip-7702-authorizations). ### Patch Changes * Updated dependencies \[[`5d8be2d`](https://github.com/tkhq/sdk/commit/5d8be2d0329070c7aa025dddb1b28f04257ae4e6)]: * @turnkey/sdk-browser\@5.8.0 * @turnkey/sdk-server\@4.7.0 * @turnkey/http\@3.10.0 ## 0.12.1 ### Patch Changes * [#848](https://github.com/tkhq/sdk/pull/848) [`8305dd2`](https://github.com/tkhq/sdk/commit/8305dd2cbfbb3cfc55ed37c9626198627c752fd9) Author [@andrewkmin](https://github.com/andrewkmin) - Fix: update serialization of typed data to conform to Viem's implementation ## 0.12.1-beta.1 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-server\@4.7.0-beta.1 * @turnkey/http\@3.10.0-beta.1 * @turnkey/sdk-browser\@5.7.1-beta.1 * @turnkey/api-key-stamper\@0.4.8-beta.4 ## 0.12.1-beta.0 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-server\@4.7.0-beta.0 * @turnkey/http\@3.10.0-beta.0 * @turnkey/sdk-browser\@5.7.1-beta.0 * @turnkey/api-key-stamper\@0.4.8-beta.3 ## 0.12.0 ### Minor Changes * [#642](https://github.com/tkhq/sdk/pull/642) [`7898dce`](https://github.com/tkhq/sdk/commit/7898dce1b71c1f956a588636a29c56e47b013426) Author [@andrewkmin](https://github.com/andrewkmin) - - Add implementation for `sign`. This is primarily applicable for account abstraction use cases. * Enforce message hashing at an abstracted level. * Minor bugfixes: pass through payload encoding; enforce default value for `to` parameter (abstracted away from user -- non-breaking) ### Patch Changes * Updated dependencies \[[`8b39dba`](https://github.com/tkhq/sdk/commit/8b39dbabf68d3e376b5b07f26960d5b61ae87fa9), [`1a549b7`](https://github.com/tkhq/sdk/commit/1a549b71f9a6e7ab59d52aaae7e58e34c8f2e8b5)]: * @turnkey/sdk-browser\@5.7.0 * @turnkey/sdk-server\@4.6.0 * @turnkey/http\@3.9.0 ## 0.11.2-beta.2 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-browser\@5.6.1-beta.2 * @turnkey/api-key-stamper\@0.4.8-beta.2 * @turnkey/http\@3.8.1-beta.2 * @turnkey/sdk-server\@4.5.1-beta.2 ## 0.11.2-beta.1 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-browser\@5.6.1-beta.1 * @turnkey/api-key-stamper\@0.4.8-beta.1 * @turnkey/http\@3.8.1-beta.1 * @turnkey/sdk-server\@4.5.1-beta.1 ## 0.11.2-beta.0 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-browser\@5.6.1-beta.0 * @turnkey/api-key-stamper\@0.4.8-beta.0 * @turnkey/http\@3.8.1-beta.0 * @turnkey/sdk-server\@4.5.1-beta.0 ## 0.11.1 ### Patch Changes * Updated dependencies \[[`f83f25b`](https://github.com/tkhq/sdk/commit/f83f25ba33ef15dbd66723531eebe2fd00f43ac0)]: * @turnkey/sdk-browser\@5.6.0 * @turnkey/sdk-server\@4.5.0 * @turnkey/http\@3.8.0 ## 0.11.0 ### Minor Changes * [#651](https://github.com/tkhq/sdk/pull/651) [`81e355c`](https://github.com/tkhq/sdk/commit/81e355c9a8321feffcac056916b65139cf35eeed) Author [@turnekybc](https://github.com/turnekybc) - Add Coinbase & MoonPay Fiat Onramp. View the [Fiat Onramp feature docs](https://docs.turnkey.com/wallets/fiat-on-ramp). ### Patch Changes * [#808](https://github.com/tkhq/sdk/pull/808) [`517d1d8`](https://github.com/tkhq/sdk/commit/517d1d83f7d4f9e000c7b47ff93e7a23daf4f6d2) Author [@moeodeh3](https://github.com/moeodeh3) - Fix serialization with BigInt values in `signTypedData()` * Updated dependencies \[[`81e355c`](https://github.com/tkhq/sdk/commit/81e355c9a8321feffcac056916b65139cf35eeed)]: * @turnkey/http\@3.7.0 * @turnkey/sdk-browser\@5.5.0 * @turnkey/sdk-server\@4.4.0 ## 0.10.5 ### Patch Changes * Updated dependencies \[[`0d1eb2c`](https://github.com/tkhq/sdk/commit/0d1eb2c464bac3cf6f4386f402604ecf8f373f15)]: * @turnkey/sdk-browser\@5.4.1 ## 0.10.4 ### Patch Changes * Updated dependencies \[[`e90a478`](https://github.com/tkhq/sdk/commit/e90a478c9208d858b1144df9b2c2c7ba956c406e)]: * @turnkey/sdk-browser\@5.4.0 * @turnkey/sdk-server\@4.3.0 * @turnkey/http\@3.6.0 ## 0.10.3 ### Patch Changes * [#777](https://github.com/tkhq/sdk/pull/777) [`cbb0ba0`](https://github.com/tkhq/sdk/commit/cbb0ba0dc2ea960415e1e7f21c3621e85765b02a) Author [@turnekybc](https://github.com/turnekybc) - Publish latest version of @turnkey/viem * Updated dependencies \[[`2db00b0`](https://github.com/tkhq/sdk/commit/2db00b0a799d09ae33fa08a117e3b2f433f2b0b4)]: * @turnkey/sdk-server\@4.2.4 ## 0.10.2 ### Patch Changes * Updated dependencies \[[`cb13c26`](https://github.com/tkhq/sdk/commit/cb13c26edb79a01ab651e3b2897334fd154b436a)]: * @turnkey/sdk-browser\@5.3.4 * @turnkey/sdk-server\@4.2.3 * @turnkey/http\@3.5.1 ## 0.10.1 ### Patch Changes * Updated dependencies \[[`2c4f42c`](https://github.com/tkhq/sdk/commit/2c4f42c747ac8017cf17e86b0ca0c3fa6f593bbf)]: * @turnkey/sdk-browser\@5.3.3 ## 0.10.0 ### Minor Changes * [#733](https://github.com/tkhq/sdk/pull/733) [`cc463d3`](https://github.com/tkhq/sdk/commit/cc463d3fde57f4d434fc41c5ed4ce42a0a506874) Author [@besler613](https://github.com/besler613) - Typed data hashing is now performed server-side using the new `PAYLOAD_ENCODING_EIP712` encoding, and EIP-712 Policies are supported via the `eth.eip_712` namespace. ## 0.9.12 ### Patch Changes * Updated dependencies \[]: * @turnkey/sdk-browser\@5.3.2 * @turnkey/sdk-server\@4.2.2 ## 0.9.11 ### Patch Changes * Updated dependencies \[[`fa46701`](https://github.com/tkhq/sdk/commit/fa467019eef34b5199372248edff1e7a64934e79)]: * @turnkey/sdk-browser\@5.3.1 * @turnkey/sdk-server\@4.2.1 ## 0.9.10 ### Patch Changes * Updated dependencies \[[`5f3dd98`](https://github.com/tkhq/sdk/commit/5f3dd9814650308b3bf3198168c453e7b1a98efd), [`5f3dd98`](https://github.com/tkhq/sdk/commit/5f3dd9814650308b3bf3198168c453e7b1a98efd), [`7625df0`](https://github.com/tkhq/sdk/commit/7625df0538002c3455bd5862211210e38472e164)]: * @turnkey/http\@3.5.0 * @turnkey/sdk-browser\@5.3.0 * @turnkey/sdk-server\@4.2.0 * @turnkey/api-key-stamper\@0.4.7 ## 0.9.9 ### Patch Changes * Updated dependencies: * @turnkey/sdk-browser\@5.2.3 ## 0.9.8 ### Patch Changes * Updated dependencies: * @turnkey/sdk-browser\@5.2.2 ## 0.9.7 ### Patch Changes * [#665](https://github.com/tkhq/sdk/pull/665) [`be0a621`](https://github.com/tkhq/sdk/commit/be0a621fb962bd51d2df1a1e79f5260d7c696772) Author [@amircheikh](https://github.com/amircheikh) - Fix for `no runner registered` error when using mismatched versions of turnkey/http * Updated dependencies \[[`be0a621`](https://github.com/tkhq/sdk/commit/be0a621fb962bd51d2df1a1e79f5260d7c696772)]: * @turnkey/http\@3.4.2 * @turnkey/sdk-browser\@5.2.1 * @turnkey/sdk-server\@4.1.1 ## 0.9.6 ### Patch Changes * Updated dependencies \[[`5afbe51`](https://github.com/tkhq/sdk/commit/5afbe51949bdd1997fad083a4c1e4272ff7409dc), [`a38a6e3`](https://github.com/tkhq/sdk/commit/a38a6e36dc2bf9abdea64bc817d1cad95b8a289a), [`40c4035`](https://github.com/tkhq/sdk/commit/40c40359ec7096d0bca39ffc93e89361b3b11a1a), [`593de2d`](https://github.com/tkhq/sdk/commit/593de2d9404ec8cf53426f9cf832c13eefa3fbf2)]: * @turnkey/sdk-browser\@5.2.0 * @turnkey/sdk-server\@4.1.0 * @turnkey/http\@3.4.1 * @turnkey/api-key-stamper\@0.4.6 ## 0.9.5 ### Patch Changes * Updated dependencies \[[`27fe590`](https://github.com/tkhq/sdk/commit/27fe590cdc3eb6a8cde093eeefda2ee1cdc79412)]: * @turnkey/sdk-browser\@5.1.0 * @turnkey/sdk-server\@4.0.1 ## 0.9.4 ### Patch Changes * Updated dependencies \[[`07dfd33`](https://github.com/tkhq/sdk/commit/07dfd3397472687092e1c73b1d68714f421b9ca0), [`e8a5f1b`](https://github.com/tkhq/sdk/commit/e8a5f1b431623c4ff1cb85c6039464b328cf0e6a)]: * @turnkey/sdk-browser\@5.0.0 * @turnkey/sdk-server\@4.0.0 * @turnkey/http\@3.4.0 ## 0.9.3 ### Patch Changes * Updated dependencies \[25ca339] * @turnkey/sdk-browser\@4.3.0 * @turnkey/sdk-server\@3.3.0 * @turnkey/http\@3.3.0 ## 0.9.2 ### Patch Changes * d440e7b: Update `signAuthorization` implementation to explicitly include `yParity` in the response ## 0.9.1 ### Patch Changes * Updated dependencies \[3f6e415] * Updated dependencies \[4d1d775] * @turnkey/sdk-browser\@4.2.0 * @turnkey/sdk-server\@3.2.0 * @turnkey/http\@3.2.0 * @turnkey/api-key-stamper\@0.4.5 ## 0.9.0 ### Minor Changes * 2f75cf1: Add support for signing Type 3 (EIP-4844) transactions * Note the inline comments on the `signTransaction` [implementation](https://github.com/tkhq/sdk/blob/5e5666aba978f756e2021c261830effc5559811f/packages/viem/src/index.ts#L392): when signing Type 3 transactions, our Viem implementation will extract the transaction payload (not including blobs, commitments, or proofs), sign it, extract the signature, and then reassemble the entire transaction payload. * See [with-viem](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-viem/) for examples. ### Patch Changes * Updated dependencies \[3e4a482] * @turnkey/sdk-browser\@4.1.0 * @turnkey/sdk-server\@3.1.0 * @turnkey/http\@3.1.0 ## 0.8.0 ### Minor Changes * 1d709ce: - Add support for EIP 7702 (Type 4) transactions by way of a new `signAuthorization` method * Update upstream `viem` version to `^2.24.2` (required for 7702) * Introduce new `to` parameter, used for indicating the result shape of `signMessage` (and related) requests * Affects `signTypedData` as well * Is used by `signAuthorization` * As a result, `serializeSignature` is updated as well ## 0.7.2 ### Patch Changes * Updated dependencies \[7b72769] * @turnkey/sdk-server\@3.0.1 ## 0.7.1 ### Patch Changes * 123406b: The organizationId parameter is ignored when using a client other than TurnkeyClient (e.g., passkeyClient). Consequently, the SDK calls the client without the specified organizationId, which is unintended. This patch resolves the issue * Updated dependencies \[e501690] * Updated dependencies \[d1083bd] * Updated dependencies \[f94d36e] * @turnkey/sdk-browser\@4.0.0 * @turnkey/sdk-server\@3.0.0 * @turnkey/http\@3.0.0 ## 0.7.0 ### Minor Changes * d99fe40: Upgrade upstream viem dependency ### Patch Changes * Updated dependencies \[bf87774] * @turnkey/sdk-browser\@3.1.0 ## 0.6.18 ### Patch Changes * Updated dependencies \[5ec5187] * @turnkey/sdk-browser\@3.0.1 * @turnkey/sdk-server\@2.6.1 ## 0.6.17 ### Patch Changes * Updated dependencies \[0e4e959] * Updated dependencies \[856f449] * Updated dependencies \[c9ae537] * Updated dependencies \[d4ce5fa] * Updated dependencies \[ecdb29a] * Updated dependencies \[72890f5] * @turnkey/sdk-browser\@3.0.0 * @turnkey/sdk-server\@2.6.0 * @turnkey/http\@2.22.0 ## 0.6.16 ### Patch Changes * Updated dependencies \[93540e7] * Updated dependencies \[fdb8bf0] * Updated dependencies \[9147962] * @turnkey/sdk-browser\@2.0.0 * @turnkey/sdk-server\@2.5.0 ## 0.6.15 ### Patch Changes * Updated dependencies \[233ae71] * Updated dependencies \[9317588] * @turnkey/sdk-browser\@1.16.0 * @turnkey/sdk-server\@2.4.0 ## 0.6.14 ### Patch Changes * Updated dependencies \[56a307e] * @turnkey/sdk-browser\@1.15.0 * @turnkey/sdk-server\@2.3.0 * @turnkey/http\@2.21.0 ## 0.6.13 ### Patch Changes * Updated dependencies \[3c44c4a] * Updated dependencies \[bfc833f] * @turnkey/sdk-browser\@1.14.0 * @turnkey/sdk-server\@2.2.0 * @turnkey/http\@2.20.0 ## 0.6.12 ### Patch Changes * Updated dependencies \[69d2571] * Updated dependencies \[57f9cb0] * @turnkey/sdk-browser\@1.13.0 * @turnkey/sdk-server\@2.1.0 * @turnkey/http\@2.19.0 ## 0.6.11 ### Patch Changes * Updated dependencies \[755833b] * @turnkey/sdk-browser\@1.12.1 * @turnkey/sdk-server\@2.0.1 ## 0.6.10 ### Patch Changes * Updated dependencies \[6695af2] * Updated dependencies \[1ebd4e2] * @turnkey/sdk-browser\@1.12.0 * @turnkey/sdk-server\@2.0.0 * @turnkey/http\@2.18.0 ## 0.6.9 ### Patch Changes * Updated dependencies \[053fbfb] * @turnkey/sdk-browser\@1.11.2 * @turnkey/sdk-server\@1.7.3 * @turnkey/http\@2.17.3 ## 0.6.8 ### Patch Changes * Updated dependencies \[328d6aa] * Updated dependencies \[b90947e] * Updated dependencies \[2d5977b] * Updated dependencies \[fad7c37] * @turnkey/sdk-browser\@1.11.1 * @turnkey/sdk-server\@1.7.2 * @turnkey/api-key-stamper\@0.4.4 * @turnkey/http\@2.17.2 ## 0.6.7 ### Patch Changes * Updated dependencies \[7988bc1] * Updated dependencies \[538d4fc] * Updated dependencies \[12d5aaa] * @turnkey/sdk-browser\@1.11.0 * @turnkey/sdk-server\@1.7.1 * @turnkey/http\@2.17.1 ## 0.6.6 ### Patch Changes * @turnkey/sdk-browser\@1.10.2 ## 0.6.5 ### Patch Changes * Updated dependencies \[78bc39c] * @turnkey/sdk-server\@1.7.0 * @turnkey/http\@2.17.0 * @turnkey/sdk-browser\@1.10.1 ## 0.6.4 ### Patch Changes * Updated dependencies \[8bea78f] * @turnkey/sdk-browser\@1.10.0 ## 0.6.3 ### Patch Changes * Updated dependencies \[3dd74ac] * Updated dependencies \[1e36edf] * Updated dependencies \[4df8914] * Updated dependencies \[11a9e2f] * @turnkey/sdk-browser\@1.9.0 * @turnkey/sdk-server\@1.6.0 * @turnkey/http\@2.16.0 ## 0.6.2 ### Patch Changes * Updated dependencies \[9ebd062] * @turnkey/sdk-browser\@1.8.0 * @turnkey/sdk-server\@1.5.0 * @turnkey/http\@2.15.0 ## 0.6.1 ### Patch Changes * Updated dependencies \[abe7138] * Updated dependencies \[96d7f99] * @turnkey/sdk-server\@1.4.2 * @turnkey/sdk-browser\@1.7.1 * @turnkey/http\@2.14.2 * @turnkey/api-key-stamper\@0.4.3 ## 0.6.0 ### Minor Changes * 2bb9ea0: Add synchronous createAccount variant (thank you @mshrieve) * Closes [https://github.com/tkhq/sdk/issues/349](https://github.com/tkhq/sdk/issues/349) * Originally attributed to [https://github.com/tkhq/sdk/pull/348](https://github.com/tkhq/sdk/pull/348) * Upshot: no change required if your setup was working. However, if you would like a synchronous option for creating a Viem account, now you may do so with `createAccountWithAddress` ### Patch Changes * Updated dependencies \[ff059d5] * Updated dependencies \[ff059d5] * @turnkey/sdk-browser\@1.7.0 * @turnkey/sdk-server\@1.4.1 * @turnkey/http\@2.14.1 * @turnkey/api-key-stamper\@0.4.2 ## 0.5.0 ### Minor Changes * 848f8d3: Support awaiting consensus and improve error handling * Add new error types that extend `BaseError` (and thus implement `error.walk`) * `TurnkeyConsensusNeededError` wraps consensus-related errors * `TurnkeyActivityError` wraps base Turnkey errors * Add a few new helper functions: * `serializeSignature` serializes a raw signature * `isTurnkeyActivityConsensusNeededError` and `isTurnkeyActivityError` use `error.walk` to check the type of a Viem error ### Patch Changes * Updated dependencies \[c988ed0] * Updated dependencies \[848f8d3] * @turnkey/sdk-browser\@1.6.0 * @turnkey/sdk-server\@1.4.0 * @turnkey/http\@2.14.0 ## 0.4.31 ### Patch Changes * Updated dependencies \[1813ed5] * @turnkey/sdk-browser\@1.5.0 ## 0.4.30 ### Patch Changes * Updated dependencies \[bab5393] * Updated dependencies \[a16073c] * Updated dependencies \[7e7d209] * @turnkey/sdk-browser\@1.4.0 ## 0.4.29 ### Patch Changes * Updated dependencies \[93dee46] * @turnkey/http\@2.13.0 * @turnkey/sdk-browser\@1.3.0 * @turnkey/sdk-server\@1.3.0 ## 0.4.28 ### Patch Changes * Updated dependencies \[e2f2e0b] * @turnkey/sdk-browser\@1.2.4 * @turnkey/sdk-server\@1.2.4 * @turnkey/http\@2.12.3 ## 0.4.27 ### Patch Changes * Updated dependencies * @turnkey/sdk-browser\@1.2.3 * @turnkey/sdk-server\@1.2.3 ## 0.4.26 ### Patch Changes * Updated dependencies \[2d7e5a9] * Updated dependencies \[f4b607f] * @turnkey/api-key-stamper\@0.4.1 * @turnkey/http\@2.12.2 * @turnkey/sdk-browser\@1.2.2 * @turnkey/sdk-server\@1.2.2 ## 0.4.25 ### Patch Changes * Updated dependencies \[f17a229] * @turnkey/http\@2.12.1 * @turnkey/sdk-browser\@1.2.1 * @turnkey/sdk-server\@1.2.1 ## 0.4.24 ### Patch Changes * Updated dependencies * @turnkey/http\@2.12.0 * @turnkey/sdk-browser\@1.2.0 * @turnkey/sdk-server\@1.2.0 ## 0.4.23 ### Patch Changes * Updated dependencies * @turnkey/http\@2.11.0 * @turnkey/sdk-browser\@1.1.0 * @turnkey/sdk-server\@1.1.0 ## 0.4.22 ### Patch Changes * Updated dependencies * @turnkey/sdk-browser\@1.0.0 * @turnkey/sdk-server\@1.0.0 ## 0.4.21 ### Patch Changes * @turnkey/sdk-browser\@0.4.1 ## 0.4.20 ### Patch Changes * d59e1b6: Add export of turnkey viem account functions * Updated dependencies \[e4b29da] * @turnkey/sdk-browser\@0.4.0 ## 0.4.19 ### Patch Changes * Updated dependencies \[d409d81] * @turnkey/sdk-browser\@0.3.0 ## 0.4.18 ### Patch Changes * @turnkey/sdk-browser\@0.2.1 ## 0.4.17 ### Patch Changes * Updated dependencies * Updated dependencies \[e4d2a84] * @turnkey/sdk-browser\@0.2.0 * @turnkey/sdk-server\@0.2.0 ## 0.4.16 ### Patch Changes * Updated dependencies * @turnkey/sdk-browser\@0.1.0 * @turnkey/sdk-server\@0.1.0 ## 0.4.15 ### Patch Changes * a6502e6: Add support for new Turnkey Client types ## 0.4.14 ### Patch Changes * Updated dependencies \[7a9ce7a] * @turnkey/http\@2.10.0 ## 0.4.13 ### Patch Changes * Updated dependencies * @turnkey/http\@2.9.1 ## 0.4.12 ### Patch Changes * Updated dependencies \[83b62b5] * @turnkey/http\@2.9.0 ## 0.4.11 ### Patch Changes * Updated dependencies \[46a7d90] * @turnkey/http\@2.8.0 ## 0.4.10 ### Patch Changes * Updated dependencies * @turnkey/http\@2.7.1 ## 0.4.9 ### Patch Changes * Updated dependencies (\[c3b423b], \[d73725b]) * @turnkey/api-key-stamper\@0.4.0 * @turnkey/http\@2.7.0 ## 0.4.8 ### Patch Changes * 4794c64: Updated dependencies ## 0.4.7 ### Patch Changes * Updated dependencies \[f9d636c] * @turnkey/http\@2.6.2 ## 0.4.6 ### Patch Changes * Updated dependencies \[52e2389] * @turnkey/http\@2.6.1 ## 0.4.5 ### Patch Changes * Updated dependencies \[7a3c890] * @turnkey/http\@2.6.0 ## 0.4.4 ### Patch Changes * Upgrade to Node v18 (#184) * Updated dependencies * @turnkey/api-key-stamper\@0.3.1 * @turnkey/http\@2.5.1 ## 0.4.3 ### Patch Changes * Updated dependencies \[464ac0e] * @turnkey/http\@2.5.0 ## 0.4.2 ### Patch Changes * @turnkey/http\@2.4.2 ## 0.4.1 ### Patch Changes * Updated dependencies \[f87ced8] * @turnkey/http\@2.4.1 ## 0.4.0 ### Minor Changes * Use rollup to build ESM and CommonJS, fix ESM support (#174) ### Patch Changes * Updated dependencies \[fc5b291] * @turnkey/api-key-stamper\@0.3.0 * @turnkey/http\@2.4.0 ## 0.3.4 ### Patch Changes * Updated dependencies * @turnkey/api-key-stamper\@0.2.0 * @turnkey/http\@2.3.1 ## 0.3.3 ### Patch Changes * Updated dependencies \[f1bd68a] * @turnkey/http\@2.3.0 ## 0.3.2 ### Patch Changes * Updated dependencies \[ed50a0f] * Updated dependencies * @turnkey/http\@2.2.0 ## 0.3.0 ### Minor Changes * cf8631a: Update interface to support `signWith` This change supports signing with wallet account addresses, private key addresses, or private key IDs. See below for an example: ```js theme={"system"} const httpClient = new TurnkeyClient( { baseUrl: "https://api.turnkey.com", }, // This uses API key credentials. // If you're using passkeys, use `@turnkey/webauthn-stamper` to collect webauthn signatures: // new WebauthnStamper({...options...}) new ApiKeyStamper({ apiPublicKey: "...", apiPrivateKey: "...", }), ); // Create the Viem custom account const turnkeyAccount = await createAccount({ client: httpClient, organizationId: "...", signWith: "...", // optional; will be fetched from Turnkey if not provided ethereumAddress: "...", }); ``` ## 0.2.7 ### Patch Changes * Updated dependencies \[bb6ea0b] * @turnkey/http\@2.1.0 ## 0.2.6 ### Patch Changes * 59dcd2f: Unpin typescript * da7c960: Bump Viem dependency to fix `getAddresses()` for LocalAccount * Updated dependencies * @turnkey/http\@2.0.0 * Updated the shape of signing ## 0.2.5 ### Patch Changes * Updated dependencies * @turnkey/http\@1.3.0 ## 0.2.4 ### Patch Changes * 0ec2d94: Addresses a bug when signing raw messages (see [https://github.com/tkhq/sdk/issues/116](https://github.com/tkhq/sdk/issues/116)) ## 0.2.3 ### Patch Changes * Updated dependencies * @turnkey/http\@1.2.0 ## 0.2.2 ### Patch Changes * Updated dependencies * @turnkey/api-key-stamper\@0.1.1 * @turnkey/http\@1.1.1 ## 0.2.1 ### Patch Changes * Fix code sample in the readme; add more details and links ## 0.2.0 ### Minor Changes * Add new `createAccount` method and deprecates the existing `createApiAccount`. `createAccount` offers a superset of functionality and works with stampers (`@turnkey/api-key-stamper` / `@turnkey/webauthn-stamper`) to integrate with API keys or passkeys. ### Patch Changes * Updated dependencies: @turnkey/http\@1.1.0 * New dependency: @turnkey/api-key-stamper\@0.1.0 ## 0.1.1 ### Patch Changes * readme updates ## 0.1.0 Initial release! # Wallet Stamper Source: https://docs.turnkey.com/changelogs/wallet-stamper/readme # @turnkey/wallet-stamper ## 1.1.14 ### Patch Changes * Updated dependencies \[]: * @turnkey/crypto\@2.8.12 ## 1.1.13 ### Patch Changes * Updated dependencies \[]: * @turnkey/crypto\@2.8.11 ## 1.1.12 ### Patch Changes * Updated dependencies \[]: * @turnkey/crypto\@2.8.10 ## 1.1.11 ### Patch Changes * Updated dependencies \[[`d0dba04`](https://github.com/tkhq/sdk/commit/d0dba0412fa7b0c7c9b135e73cc0ef6f55187314)]: * @turnkey/crypto\@2.8.9 ## 1.1.10 ### Patch Changes * Updated dependencies \[]: * @turnkey/crypto\@2.8.8 ## 1.1.9 ### Patch Changes * Updated dependencies \[]: * @turnkey/crypto\@2.8.7 ## 1.1.8 ### Patch Changes * Updated dependencies \[]: * @turnkey/crypto\@2.8.6 ## 1.1.7 ### Patch Changes * Updated dependencies \[[`5f829c6`](https://github.com/tkhq/sdk/commit/5f829c67af03bb85c3806acd202b2debf8274e78)]: * @turnkey/crypto\@2.8.5 ## 1.1.6 ### Patch Changes * Updated dependencies \[[`c745646`](https://github.com/tkhq/sdk/commit/c745646ae4b2a275e116abca07c6e108f89beb04)]: * @turnkey/crypto\@2.8.4 ## 1.1.5 ### Patch Changes * Updated dependencies \[[`5c4495b`](https://github.com/tkhq/sdk/commit/5c4495bff1b0abfe3c427ead1b8e1a8d510c8186)]: * @turnkey/crypto\@2.8.3 ## 1.1.4 ### Patch Changes * Updated dependencies \[]: * @turnkey/crypto\@2.8.2 ## 1.1.3 ### Patch Changes * Updated dependencies \[]: * @turnkey/crypto\@2.8.1 ## 1.1.2 ### Patch Changes * Updated dependencies \[[`3997c0f`](https://github.com/tkhq/sdk/commit/3997c0fd08a8a85108acf904c0bf39d69f8dc79c)]: * @turnkey/crypto\@2.8.0 ## 1.1.1 ### Patch Changes * Updated dependencies \[[`2191a1b`](https://github.com/tkhq/sdk/commit/2191a1b201fb17dea4c79cf9e02b3a493b18f97a)]: * @turnkey/crypto\@2.7.0 ## 1.1.0 ### Minor Changes * Updated dependencies \[[`fc1d6e2`](https://github.com/tkhq/sdk/commit/fc1d6e2d26f4a53116633e9e8cccccd792267f4e), [`fc1d6e2`](https://github.com/tkhq/sdk/commit/fc1d6e2d26f4a53116633e9e8cccccd792267f4e), [`4880f26`](https://github.com/tkhq/sdk/commit/4880f26a4dd324c049bff7f35284098ccfc55823), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`c6ee323`](https://github.com/tkhq/sdk/commit/c6ee3239c389a7bbbbb23610c84b883ed298f95c), [`06347ad`](https://github.com/tkhq/sdk/commit/06347adfa08fb0867c350e43821d0fed06c49624), [`6bfcbc5`](https://github.com/tkhq/sdk/commit/6bfcbc5c098e64ab1d115518733b87cfc1653e17)]: * @turnkey/encoding\@0.6.0 * @turnkey/crypto\@2.6.0 ## 1.1.0-beta.6 ### Patch Changes * Updated dependencies \[]: * @turnkey/encoding\@0.6.0-beta.6 * @turnkey/crypto\@2.6.0-beta.6 ## 1.1.0-beta.5 ### Minor Changes * SDK beta release @turnkey/react-wallet-kit @turnkey/core ### Patch Changes * Updated dependencies \[]: * @turnkey/encoding\@0.6.0-beta.5 * @turnkey/crypto\@2.6.0-beta.5 ## 1.0.9-beta.4 ### Patch Changes * Updated dependencies \[]: * @turnkey/encoding\@0.6.0-beta.4 * @turnkey/crypto\@2.5.1-beta.4 ## 1.0.9-beta.3 ### Patch Changes * Updated dependencies \[]: * @turnkey/encoding\@0.6.0-beta.3 * @turnkey/crypto\@2.5.1-beta.3 ## 1.0.9-beta.2 ### Patch Changes * Updated dependencies \[]: * @turnkey/encoding\@0.6.0-beta.2 * @turnkey/crypto\@2.5.1-beta.2 ## 1.0.9-beta.1 ### Patch Changes * Updated dependencies \[]: * @turnkey/encoding\@0.6.0-beta.1 * @turnkey/crypto\@2.5.1-beta.1 ## 1.0.9-beta.0 ### Patch Changes * Updated dependencies \[]: * @turnkey/encoding\@0.6.0-beta.0 * @turnkey/crypto\@2.5.1-beta.0 ## 1.0.9 ### Patch Changes * Updated dependencies \[[`d7420e6`](https://github.com/tkhq/sdk/commit/d7420e6c3559efc1024b58749b31d253150cb189)]: * @turnkey/crypto\@2.6.0 ## 1.0.8 ### Patch Changes * Updated dependencies \[[`6cde41c`](https://github.com/tkhq/sdk/commit/6cde41cfecdfb7d54abf52cc65e28ef0e2ad6ba3)]: * @turnkey/crypto\@2.5.0 ## 1.0.7 ### Patch Changes * Updated dependencies \[[`6cbff7a`](https://github.com/tkhq/sdk/commit/6cbff7a0c0b3a9a05586399e5cef476154d3bdca)]: * @turnkey/crypto\@2.4.3 ## 1.0.6 ### Patch Changes * Updated dependencies \[[`c5cdf82`](https://github.com/tkhq/sdk/commit/c5cdf8229da5da1bd6d52db06b2fe42826e96d57), [`fa46701`](https://github.com/tkhq/sdk/commit/fa467019eef34b5199372248edff1e7a64934e79)]: * @turnkey/crypto\@2.4.2 ## 1.0.5 ### Patch Changes * Updated dependencies \[[`878e039`](https://github.com/tkhq/sdk/commit/878e03973856cfec83e6e3fda5b76d1b64943628)]: * @turnkey/crypto\@2.4.1 ## 1.0.4 ### Patch Changes * [#659](https://github.com/tkhq/sdk/pull/659) [`5afbe51`](https://github.com/tkhq/sdk/commit/5afbe51949bdd1997fad083a4c1e4272ff7409dc) Author [@turnekybc](https://github.com/turnekybc) - export types and models from @turnkey/sdk-browser * Updated dependencies \[[`40c4035`](https://github.com/tkhq/sdk/commit/40c40359ec7096d0bca39ffc93e89361b3b11a1a), [`10ee5c5`](https://github.com/tkhq/sdk/commit/10ee5c524b477ce998e4fc635152cd101ae5a9cc)]: * @turnkey/encoding\@0.5.0 * @turnkey/crypto\@2.4.0 ## 1.0.3 ### Patch Changes * Updated dependencies \[2bc0046] * @turnkey/crypto\@2.3.1 ## 1.0.2 ### Patch Changes * c895c8f: Update @solana/web3.js from ^1.88.1 to ^1.95.8 * @turnkey/crypto\@2.3.0 ## 1.0.1 ### Patch Changes * Updated dependencies \[668edfa] * @turnkey/crypto\@2.3.0 ## 1.0.0 ### Major Changes * Renamed `recoverPublicKey` to `getPublicKey` on the `EthereumWallet` interface to improve clarity and consistency across wallet interfaces * Changed `getPublicKey` method signature to take no parameters ```typescript theme={"system"} // Old method signature recoverPublicKey(message: string): Promise; ``` ```typescript theme={"system"} // New method signature getPublicKey(): Promise; ``` * Added an `EthereumWallet` implementation as a helper to simplify support for Ethereum wallets: ```typescript theme={"system"} import { EthereumWallet } from "@turnkey/wallet-stamper"; const wallet = new EthereumWallet(); // Instantiate the WalletStamper with the EthereumWallet const walletStamper = new WalletStamper(wallet); // Instantiate the TurnkeyClient with the WalletStamper const client = new TurnkeyClient({ baseUrl: BASE_URL }, walletStamper); ``` ### Patch Changes * Updated dependencies \[8bea78f] * @turnkey/crypto\@2.2.0 ## 0.0.5 ### Patch Changes * Updated dependencies \[e5c4fe9] * @turnkey/encoding\@0.4.0 ## 0.0.4 ### Patch Changes * Updated dependencies \[93666ff] * @turnkey/encoding\@0.3.0 ## 0.0.3 ### Patch Changes * Updated dependencies \[2d7e5a9] * Updated dependencies \[f4b607f] * @turnkey/encoding\@0.2.1 ## 0.0.2 ### Patch Changes * 68a14dd: Initial release! 🎉 # Webauthn Stamper Source: https://docs.turnkey.com/changelogs/webauthn-stamper/readme # @turnkey/webauthn-stamper ## 0.6.0 ## 0.6.0-beta.0 ### Minor Changes * SDK beta release @turnkey/react-wallet-kit @turnkey/core ## 0.5.1 ### Patch Changes * [#659](https://github.com/tkhq/sdk/pull/659) [`5afbe51`](https://github.com/tkhq/sdk/commit/5afbe51949bdd1997fad083a4c1e4272ff7409dc) Author [@turnekybc](https://github.com/turnekybc) - export types and models from @turnkey/sdk-browser ## 0.5.0 ### Minor Changes * Remove dependency on `noble/hashes` and `Buffer` in favor of a minimal sha256 lib * Introduce `@turnkey/encoding` to consolidate utility functions ## 0.4.3 ### Patch Changes * Upgrade to Node v18 (#184) ## 0.4.2 ### Patch Changes * Make sha256 computation synchronous to resolve ios passkey prompt issues (#179) ## 0.4.1 ### Patch Changes * Fix universal files to stop using `require`. Use ES6 imports instead (#178) ## 0.4.0 ### Minor Changes * Use rollup to build ESM and CommonJS, fix ESM support (#174) ## 0.3.0 ### Minor Changes * Add support for ESM (#154) ## 0.2.0 ### Minor Changes * Adds Buffer polyfill for environments where it is not globally available ([https://github.com/tkhq/sdk/pull/125](https://github.com/tkhq/sdk/pull/125)) ## 0.1.0 Initial release # Auth Proxy Source: https://docs.turnkey.com/features/authentication/auth-proxy Use Turnkey's managed Auth Proxy to securely run OTP/OAuth/signup flows without standing up your own backend. ## Overview The **Turnkey Auth Proxy** is a managed, multi-tenant service that signs and forwards authentication requests to the Turnkey API on your behalf — no backend required for auth flows. It handles sub-organization creation, OTP (email/SMS), and OAuth login. * **Host:** `https://authproxy.turnkey.com` * **What it does:** Validates origin, looks up your org's proxy config, signs the request with a proxy-scoped API key, and forwards it to the Turnkey API. * **What it doesn't do:** It cannot authenticate users without their participation (OTP code entry, OAuth consent). It has no access to funds or broader org operations. Enable and configure the Auth Proxy in **Dashboard → Embedded Wallets → Configuration**. ## How it works 1. **Enable in Dashboard** — Toggle Auth Proxy ON. Turnkey creates a proxy user and proxy API key, stored encrypted in your org's auth proxy config. 2. **Configure allowed origins** — Only requests from these origins may call the proxy (CORS + origin validation). Defaults to `*`. Exact URLs only — partial wildcards like `https://*.myapp.com` are not supported. 3. **Your frontend calls the Auth Proxy** — Pass your `X-Auth-Proxy-Config-Id` header with every request. 4. **Proxy signs and forwards** — The proxy decrypts your proxy key in-memory (per request only), signs the activity, and forwards it to the Turnkey API. 5. **Response returned** — The proxy returns the result (e.g., `organizationId`, `session`) directly to your frontend. **Security notes:** * Proxy keys are HPKE-encrypted inside Turnkey's enclaves and decrypted per-request only, in-memory. * Strict separation from Turnkey's core backend — communicates via public API only. * The Auth Proxy passes App Proofs through to the caller without verifying them. End-users (SDKs) are expected to perform App Proof verification. See [Turnkey Verified](/security/turnkey-verified). ## Authentication & headers * **Auth Proxy Config Id** (required) — identifies your org's proxy config. Found in **Dashboard → Embedded Wallets → Configuration**. ``` X-Auth-Proxy-Config-Id: ``` * **CORS & Origin** — requests must originate from a whitelisted origin set in the dashboard. ## Auth flows ### OTP (email or SMS) Used to authenticate users with a one-time code sent to their email or phone number. For a walkthrough of the user experience, see [Email auth — User experience](/features/authentication/email#user-experience). **Flow:** 1. **[Init OTP](/api-reference/auth-proxy/otp-init)** `POST /v1/otp_init_v2` — Send an OTP code to the user's email or phone. Returns an `otpId` and an `otpEncryptionTargetBundle`. > `otpEncryptionTargetBundle` is a TEE-signed bundle containing a target P-256 encryption key. The client uses it to encrypt the OTP code before submission, so the code is only decryptable inside the enclave. If you're using `react-wallet-kit` this is handled automatically — see the [otp-auth/without-backend](https://github.com/tkhq/sdk/tree/main/examples/authentication/otp-auth/without-backend) example. 2. **[Verify OTP](/api-reference/auth-proxy/otp-verify)** `POST /v1/otp_verify_v2` — Submit the OTP code along with the `otpId`. Returns a `verificationToken` — a short-lived, enclave-signed token proving the user owns the contact. 3. **[OTP Login](/api-reference/auth-proxy/otp-login)** `POST /v1/otp_login_v2` — Exchange the `verificationToken` + a client `publicKey` + `clientSignature` for a session JWT. The session is scoped to the sub-org matching the verified contact. > `clientSignature` is the client's signature over the `verificationToken` using the private key corresponding to `publicKey`. This binds the session to the client's keypair and prevents replay attacks. **Pre-verified signup:** You can also pass a `verificationToken` directly to [Signup](#signup-create-sub-organization) to create a new sub-org for a user who has already verified their contact via OTP — skipping a separate OTP round-trip on registration. *** ### OAuth (OIDC providers — Google, Apple, etc.) Used when your app receives an OIDC token directly from a provider like Google or Apple. 1. **[OAuth Login](/api-reference/auth-proxy/oauth-login)** `POST /v1/oauth_login` — Submit the `oidcToken` and a client `publicKey`. Returns a session JWT for the sub-org that has a matching OAuth provider (`iss`, `sub`, `aud`). *** ### OAuth (OAuth 2.0-only providers — Discord, X/Twitter, etc.) Used for providers that don't issue OIDC tokens natively. Turnkey acts as an OIDC wrapper. 1. **[OAuth2 Authenticate](/api-reference/auth-proxy/oauth2-authenticate)** `POST /v1/oauth2_authenticate` — Submit the OAuth 2.0 `authCode`, `redirectUri`, PKCE `codeVerifier`, `nonce`, and `clientId`. Turnkey exchanges the code, calls the provider's user-info endpoint, and returns a Turnkey-issued OIDC token. 2. **[OAuth Login](/api-reference/auth-proxy/oauth-login)** `POST /v1/oauth_login` — Use the Turnkey-issued token from step 1, same as a standard OIDC flow. *** ### Signup (create sub-organization) **[Signup](/api-reference/auth-proxy/signup)** `POST /v1/signup_v2` — Create a new sub-organization for an end user. Optionally creates a wallet and sets up credentials (API keys, passkeys, OAuth providers) in a single call. Notable fields: * `verificationToken` — if provided, the sub-org is created with the user's contact (email/phone) marked as verified (requires a prior OTP verify step). * `oauthProviders` — accepts either `oidcToken` (verified) or `oidcClaims` (`{iss, sub, aud}`, verified against an accompanying token). See [Multi-platform OAuth identities](/features/authentication/social-logins#multi-platform-oauth-identities). * `wallet` — if provided, a wallet with the specified accounts is created atomically with the sub-org. * `clientSignature` — optional client-side signature binding the signup request to a keypair. *** ### Account lookup **[Get Account](/api-reference/auth-proxy/account)** `POST /v1/account` — Look up a sub-org by `filterType` (`EMAIL`, `PHONE_NUMBER`, `CREDENTIAL_ID`, `OIDC_TOKEN`, etc.) and `filterValue`. Returns the `organizationId` of the matching sub-org, or an empty response if none exists. Used to check whether a user already has an account before deciding to call signup vs. login. *** ### Wallet Kit config **[Get Wallet Kit Config](/api-reference/auth-proxy/wallet-kit-config)** `POST /v1/wallet_kit_config` — Returns the auth method toggles and session configuration for the calling org. Used by `react-wallet-kit` to determine which auth methods to show in the modal. ## Dashboard configuration Each auth method can be independently enabled or disabled — including email OTP, SMS OTP, individual social providers (Google, Apple, X, Discord), passkeys, and external wallets. | Setting | Description | | ---------------------------------------------- | ------------------------------------------------------------------------------------------------------------ | | Enable/Disable | Toggle the Auth Proxy on or off for your org | | Config ID | Your `X-Auth-Proxy-Config-Id` value | | Allowed Origins | Exact frontend URLs allowed to call the proxy. Defaults to `*` | | Session expiration | Default session lifetime in seconds (default: 900) | | OTP length & type | Code length (6–9 digits) and character set (numeric or alphanumeric) | | Email customization | Application name and logo URL shown in OTP emails | | OAuth redirect URL | Redirect URI registered in your OAuth provider's console | | Social logins | Per-provider toggles (Google, Apple, X, Discord) with client IDs | | Social linking | Google client IDs allowed to auto-link a Google account to an existing email OTP account with the same email | | Passkey / Wallet | Show or hide passkey and external wallet options in the Wallet Kit modal | | Require verification token for account lookups | Gate the `/account` endpoint behind a prior OTP verification | # Backend authentication Source: https://docs.turnkey.com/features/authentication/backend-setup Guide for integrating Turnkey authentication into your backend, covering session JWT creation, validation, and enforcing user access controls. ## Introduction This guide shows you how to use Turnkey as the foundation for your own backend authentication system. You’ll learn how to issue, send, and validate session JWTs, and enforce access controls in your backend. ## Why use backend authentication? There are several benefits to enforcing authenticated requests to your backend: 1. **User data**: Store and retrieve user data associated with Turnkey sub-organizations 2. **Metrics and monitoring**: Add custom validations, rate limiting, and logging 3. **Co-signing capabilities**: Enable 2/2 signing patterns where your application is a co-signer ## JWT authentication flow JSON Web Tokens (JWTs) provide a secure, stateless way to authenticate requests between your frontend and backend. Here's how to implement a JWT-based flow with Turnkey: ### Architecture overview ```mermaid theme={"system"} sequenceDiagram participant User participant Frontend participant Backend participant Turnkey %% Login/Signup Flow User->>Frontend: Login/Signup Action Frontend->>Backend: Send auth info Backend->>Backend: Create and sign Turnkey request Backend->>Turnkey: Send signed request Turnkey->>Backend: Return session JWT Backend->>Frontend: Return session JWT Frontend->>Frontend: Store session JWT %% Subsequent Request Flow User->>Frontend: Action requiring Backend Authentication Frontend->>Backend: Send request with JWT Backend->>Backend: Validate JWT Backend->>Backend: Check user permissions Backend->>Frontend: Return response Frontend->>User: Update UI ``` ### High-level flow The overall pattern is similar, but may differ slightly depending on the auth method. Generally: * The user authenticates (via passkey, OTP, etc.) * A session is created with Turnkey, returning a session JWT * That session JWT is used to make authenticated requests to your backend ## Getting the session JWT Turnkey supports multiple authentication methods, each of which results in a session JWT that proves the user's identity. This section covers the two most common flows: passkey authentication and OTP (One-Time Passcode) authentication. It explains how each method ultimately produces a session JWT that your frontend can use to make authenticated requests to your backend. ### Passkey authentication Turnkey supports passkey authentication, which allows users to log in using their device’s biometric system or a hardware security key. In this guide, we’ll separate login and signup flows, since most apps handle them independently and the implementation details differ slightly. #### Signup flow ```mermaid theme={"system"} sequenceDiagram participant User participant Frontend participant Backend participant Turnkey User->>Frontend: Begin signup (create passkey) Frontend->>Frontend: Create passkey and ephemeral API key Frontend->>Backend: Send passkey + ephemeral API public key Backend->>Turnkey: Create sub-org with passkey + API public key Turnkey->>Backend: Return subOrgId Backend->>Frontend: Return subOrgId Frontend->>Frontend: Create TurnkeyClient with ephemeral API key Frontend->>Turnkey: Call stampLogin() using ephemeral API key Turnkey->>Frontend: Return session JWT User->>Frontend: Action requiring Backend Authentication Frontend->>Backend: Send request along with session JWT Backend->>Backend: Validate JWT Backend->>Backend: Check user permissions Backend->>Frontend: Return response Frontend->>User: Update UI ``` The user begins the signup flow by tapping a button like “Sign up with Passkey” on the frontend. The frontend creates a passkey using WebAuthn, prompting the user for biometric or hardware authentication. At the same time, it silently generates a temporary API key in the background, which is used to stamp requests during the signup process. **Note:** We use a temporary API key during signup to avoid prompting the user twice for a passkey tap. Without it, we’d need to use the passkey to stamp the `stampLogin()` request later in the flow, which would trigger a second prompt right after creating the passkey. Using the API key instead allows us to create the session in the background with just a single tap. The frontend sends the passkey and API public key to the backend. The backend then uses the Turnkey API to create a new sub-organization and register both credentials as authenticators. The frontend initializes a `TurnkeyClient` using the temporary API key and calls `stampLogin()`. Turnkey returns a session JWT representing the authenticated user session. Your frontend can now make requests to your backend and attach the session JWT. The backend will validate the token on each request and verify that the user has permission to perform the requested action. #### Login flow ```mermaid theme={"system"} sequenceDiagram participant User participant Frontend participant Backend participant Turnkey User->>Frontend: Begin login Frontend->>Frontend: Call stampLogin() with passkeyStamper Frontend->>Frontend: Trigger WebAuthn prompt Frontend->>User: Request biometric/hardware authentication User->>Frontend: Tap to approve login Frontend->>Turnkey: Send signed request to Turnkey Turnkey->>Frontend: Return session JWT User->>Frontend: Action requiring Backend Authentication Frontend->>Backend: Send request along with session JWT Backend->>Backend: Validate JWT Backend->>Backend: Check user permissions Backend->>Frontend: Return response Frontend->>User: Update UI ``` The user begins the login flow by tapping a button like “Log in with Passkey” on the frontend. The frontend initializes a `TurnkeyClient` with a `passkeyStamper` and calls `stampLogin()`. This triggers a WebAuthn prompt, prompting the user to approve the login request using their passkey. Once the user approves the request, the signed login is sent to Turnkey. Turnkey then returns a session JWT representing the authenticated user session. Your frontend can now make requests to your backend and attach the session JWT. The backend will validate the token on each request and verify that the user has permission to perform the requested action. ### OTP authentication Turnkey also supports SMS and email-based One-Time Passcode (OTP) authentication, allowing users to log in by entering a code sent to their email or phone number. We’ll cover OTP login and signup together, since the flows are similar and most apps handle them in a unified way. ```mermaid theme={"system"} sequenceDiagram participant User participant Frontend participant Backend participant Turnkey User->>Frontend: Begin login (enter email/phone) Frontend->>Backend: Request OTP Backend->>Turnkey: Call initOtp() Turnkey->>Backend: Return otpId Backend->>Frontend: Return otpId Frontend->>User: Prompt for OTP code User->>Frontend: Enter OTP code Frontend->>Backend: Verify OTP Backend->>Turnkey: Call verifyOtp() Turnkey->>Backend: Return verification token Backend->>Frontend: Return verification token Frontend->>Frontend: Create API key Frontend->>Backend: Send API public key + verification token Backend->>Turnkey: Call getSubOrgIds() with contact info Turnkey->>Backend: Return existing subOrgId (if any) alt SubOrgId not found Backend->>Turnkey: Create new sub-org with contact Turnkey->>Backend: Return new subOrgId end Backend->>Turnkey: Call otpLogin() with subOrgId, public key, and token Turnkey->>Backend: Return session JWT Backend->>Frontend: Return session JWT User->>Frontend: Action requiring Backend Authentication Frontend->>Backend: Send request along with session JWT Backend->>Backend: Validate JWT Backend->>Backend: Check user permissions Backend->>Frontend: Return response Frontend->>User: Update UI ``` The user begins the login flow by entering their email or phone number on the frontend. The frontend sends the contact info to your backend, which requests an OTP from Turnkey. Once the user receives and enters the code, your backend verifies it with Turnkey and receives a verification token. The frontend generates an API key, then sends the API public key and verification token to the backend. The backend checks with Turnkey whether a sub-organization already exists for the contact. If not, it creates a new one. The backend calls `otpLogin()` with the subOrgId, public key, and verification token. Turnkey returns a session JWT representing the authenticated user session, which the backend then returns to the frontend. Your frontend can now make requests to your backend and attach the session JWT. The backend will validate the token on each request and verify that the user has permission to perform the requested action. ## Sending the JWT from the frontend After a user completes Turnkey authentication and a session is created (via passkey, OTP, or another supported method), your backend returns a session JWT to the frontend. This token proves the user’s identity and is the frontend’s responsibility to store and include in all future authenticated requests to your backend. The session JWT should be attached to each request using the `Authorization` header. This allows your backend to identify the authenticated user and enforce any necessary access control based on the `user_id` or `organization_id`. **Note:** These requests are sent to your own backend endpoints and may contain any application-specific payload, such as a form submission, a database mutation, or a business action. They are not necessarily related to Turnkey. Here’s an example of how the frontend might send the JWT: ```typescript theme={"system"} const response = await fetch("/api/your-backend-endpoint", { method: "POST", headers: { "Content-Type": "application/json", "Authorization": `Bearer ${sessionJwt}`, }, body: JSON.stringify({ /* your request payload */ }), }); ``` This adds the following header to your HTTP request: ```http theme={"system"} Authorization: Bearer ``` ## Validating the JWT in your backend After a user completes Turnkey authentication and a session is created (via passkey, OTP, or another supported method), your backend returns a session JWT to the frontend. This token proves the user's identity and is the frontend’s responsibility to store and include in all future authenticated requests. ### What does the session JWT contain? Before diving into how to verify the session JWT, it’s helpful to understand what’s actually inside it. The JWT includes information that identifies the authenticated user and the organization they belong to, as well as metadata like expiration time and session type. Here’s an example of a decoded session JWT: ```typescript theme={"system"} { "exp": , "public_key": "", "session_type": "SESSION_TYPE_READ_WRITE", "user_id": "", "organization_id": "" } ``` ### Validating the JWT To validate the session JWT: Use the helper function `verifySessionJwtSignature` from [`@turnkey/crypto`](https://github.com/tkhq/sdk/blob/e10342cd111fbb9b1d168ff386b5dc263e3a5ce3/packages/crypto/src/turnkey.ts#L409-L466) to confirm that the JWT was signed by Turnkey and hasn’t been modified. ```typescript theme={"system"} import { verifySessionJwtSignature } from "@turnkey/crypto"; const isValid = await verifySessionJwtSignature(sessionJwt); if (!isValid) { throw new Error("Invalid JWT: failed signature verification"); } ``` Before verifying expiration or enforcing access controls, you’ll need to decode the JWT payload to access fields like `user_id`, `organization_id`, and `exp`. Here’s an example helper you can define to decode and extract the session fields from the payload: ```typescript theme={"system"} export function decodeSessionJwt(token: string): { sessionType: string; userId: string; organizationId: string; expiry: number; publicKey: string; } { const [, payload] = token.split("."); if (!payload) { throw new Error("Invalid JWT: Missing payload"); } const decoded = JSON.parse(atob(payload)); const { exp, public_key: publicKey, session_type: sessionType, user_id: userId, organization_id: organizationId, } = decoded; if (!exp || !publicKey || !sessionType || !userId || !organizationId) { throw new Error("JWT payload missing required fields"); } return { sessionType, userId, organizationId, expiry: exp, publicKey, }; } ``` Ensure that the token has not expired by validating the exp (expiration) claim. ```typescript theme={"system"} if (decodedJwt.exp * 1000 < Date.now()) { throw new Error("Token has expired"); } ``` Once the token is verified and decoded, use the `userId` and `organizationId` to enforce access control in your application. This step is application-specific and depends on how your backend maps users to organizations. For example, you might: * Look up the user in your database by `userId` * Confirm that the request targets the correct `organizationId` * Reject the request if the user is not linked to that organization This ensures that even with a valid JWT, a user can only access resources associated with their own Turnkey sub-organization. ## Advanced topics
# Bring your own auth Source: https://docs.turnkey.com/features/authentication/bring-your-own-auth Learn how to integrate Turnkey with your existing authentication system while keeping user wallets non-custodial. Some teams have requirements that make it impractical to use Turnkey's built-in authentication directly — existing enterprise SSO, compliance constraints, a mature identity platform already in production, or simply a preference to keep auth centralized in one system. In these cases, you don't need to replace your auth layer: Turnkey can work alongside it. If you already have an authentication system — whether that's Auth0, Cognito, an enterprise IdP, or a homegrown JWT issuer — you can keep using it to authenticate users and only rely on Turnkey for wallet and key management. The key decision is whether you want that integration to be **custodial** or **non-custodial**. ## Custodial vs. non-custodial ### Custodial (API key approach) The simplest integration pattern is to use a **parent org API key** on your backend. Your server authenticates users however it normally would, and then uses the API key to operate on their Turnkey sub-organization on their behalf. This works well and is easy to implement, but it is **custodial**: your backend holds signing authority over user wallets. **Sub-org provisioning:** Your backend generates an API key pair for the user and registers it in the sub-org at creation time. This API key lives in the sub-org and is what your backend uses to stamp all subsequent requests on that user's behalf. ```ts theme={"system"} await client.createSubOrganization({ subOrganizationName: `user-${userId}`, rootQuorumThreshold: 1, rootUsers: [{ userName: userEmail, userEmail: userEmail, apiKeys: [{ apiKeyName: "backend-key", publicKey: YOUR_BACKEND_PUBLIC_KEY, }], authenticators: [], oauthProviders: [], }], }); ``` ### Non-custodial (OIDC approach) If you want users to fully control their wallets, Turnkey must be able to independently verify that a user has authenticated with your system. This requires your auth system to issue **OIDC-compliant tokens**, a standard Turnkey knows how to validate. With that in place, the user's device generates a keypair, receives an OIDC token from your auth system that binds that keypair to their identity, and Turnkey registers the public key as a session credential directly in the sub-org. **Sub-org provisioning:** Your backend still creates the sub-org (using the parent org API key) on first registration, but includes the user's OIDC provider in the root user so that the user can authenticate directly with Turnkey on subsequent logins. ```ts theme={"system"} // Backend creates the sub-org with the OIDC provider registered await client.createSubOrganization({ subOrganizationName: `user-${userId}`, rootQuorumThreshold: 1, rootUsers: [{ userName: userEmail, userEmail: userEmail, apiKeys: [], authenticators: [], oauthProviders: [{ providerName: "my-auth-system", oidcToken: idToken, }], }], }); ``` After provisioning, each login follows these steps: 1. **Client** generates a P256 keypair and computes `nonce = sha256(publicKey)` 2. **Client** passes the nonce to your auth system when requesting a token 3. **Auth system** issues an OIDC token with that nonce embedded 4. **Client** sends the OIDC token and `publicKey` to your backend 5. **Backend** calls `oauthLogin` (stamped with the parent org API key) with the OIDC token and `publicKey` 6. **Turnkey** verifies the token signature and checks that `nonce == sha256(publicKey)`, then returns a session JWT 7. **Client** stores the session — only the device holding the private key can use it to sign ## Requirements for your OIDC issuer To use the non-custodial flow, your auth system must issue OIDC-compliant tokens with standard claims (`iss`, `sub`, `aud`, `exp`), a publicly reachable `/.well-known/openid-configuration` endpoint, and a `nonce` set to `sha256(publicKey)` to bind the token to the user's device keypair. See [OIDC token verification](/features/authentication/social-logins#oidc-token-verification) for the full details on how Turnkey validates tokens. ## Integration flow ### Step 1: Register the user When a user first authenticates, create a Turnkey sub-org for them with your OIDC provider registered. Registration requires a valid OIDC token — Turnkey verifies its signature against your JWKS and extracts the `iss`, `sub`, and `aud` claims, storing them as the user's identity fingerprint. The token itself is not retained; on each subsequent login a fresh token is verified independently and matched against that fingerprint. See [Registration vs. login tokens](/features/authentication/social-logins#registration-vs-login-tokens) for the full explanation. ```ts theme={"system"} await client.createSubOrganization({ subOrganizationName: `user-${userId}`, rootQuorumThreshold: 1, rootUsers: [{ userName: userEmail, userEmail: userEmail, apiKeys: [], authenticators: [], oauthProviders: [{ providerName: "my-auth-system", oidcToken: idToken, }], }], }); ``` ### Step 2: Log the user in On each login, the frontend generates a keypair, requests a token with `nonce = sha256(publicKey)` from your auth server, then calls `oauthLogin`: ```ts theme={"system"} // --- Client --- // 1. Generate session keypair on the user's device const publicKey = await createApiKeyPair(); // 2. Compute nonce and trigger auth on your auth server // Your server must embed nonce = sha256(publicKey) in the issued OIDC token const nonce = sha256(publicKey); const idToken = await yourAuthServer.issueToken({ userId, nonce }); // 3. Send publicKey + idToken to your backend to complete the Turnkey login const session = await yourBackend.login({ idToken, publicKey }); // 4. Store the session — from here the device's private key is the only signer await storeSession({ sessionToken: session }); ``` ```ts theme={"system"} // --- Backend (server action / API route) --- // Stamped with the parent org API key; calls Turnkey on behalf of the user export async function login({ idToken, publicKey, suborgId }) { const { session } = await turnkeyClient.oauthLogin({ organizationId: suborgId, oidcToken: idToken, publicKey, }); return session; } ``` Turnkey's enclave verifies the token signature against your JWKS and checks the nonce matches `sha256(publicKey)`. The resulting session JWT is scoped to that public key — only the device holding the private key can use it to sign. If you are using `@turnkey/react-wallet-kit`, see [Advanced backend authentication](/solutions/embedded-wallets/integration-guide/react/advanced-backend-authentication) for how to wire this up on the frontend. For a working implementation of this flow, see the [oauth example](https://github.com/tkhq/sdk/tree/main/examples/authentication/oauth) in the SDK — it uses Google as the provider, but the client/backend split and nonce binding pattern are identical for any OIDC issuer. ## Adding an OIDC provider to an existing user If a user already has a Turnkey sub-org (created via email OTP, passkey, etc.) and you want to add your OIDC provider to their account, use `createOauthProviders`. This activity must be stamped with a credential that already has authority in that sub-org — for example, the user's active session, their passkey, or a backend API key registered in the sub-org. The parent org API key alone cannot stamp activities against a sub-org. ```ts theme={"system"} // Stamped with a credential that has authority in the sub-org await client.createOauthProviders({ userId: existingUserId, oauthProviders: [{ providerName: "my-auth-system", oidcToken: idToken, }], }); ``` # Email auth & recovery Source: https://docs.turnkey.com/features/authentication/email Email Authentication enables users to authenticate and recover their Turnkey accounts using email-based verification. There are two methods of email authentication: #### One-time password * Uses a 6-9 digit or bech32 alphanumeric one-time password sent via email * Simple, and familiar user experience **One-Time Password Sandbox Environment** To test OTP codes in our sandbox environment you can use the following: * `alphanumeric` must be set to `false` * `otpLength` must be set to `6` * Email: [user@example.com](mailto:user@example.com) * OTP Code: `000000` #### Credential bundle * Sends an encrypted API key credential directly via email * Alternative method for specific use cases * More secure, but requires copying the full credential to the client Both methods provide users with an expiring API key for authentication or account recovery. ## Core mechanism Email Authentication is built with expiring API keys as the foundation. The two delivery mechanisms are: ### OTP-based method The authentication process happens in two steps: A 6-9 digit or alphanumeric OTP code is sent to the user's verified email address Upon verification of the correct code, an API key credential is generated and encrypted for the client ### Credential bundle method This method is only supported by **legacy iframe-based flows** and is not available in the current Turnkey SDKs. The API key credential is encrypted and delivered directly through email to the user. Once the credential is live on the client side (within the context of an iframe), it is readily available to stamp (authenticate) requests. See the [enclave to end-user secure channel](/security/enclave-secure-channels) for more info on how we achieve secure delivery. This flow remains available for existing legacy integrations but is not recommended for new implementations. As an alternative, we recommend using the email OTP flow, which is fully supported by the current SDKs. An example that sends a magic link using [magicLinkTemplate](https://docs.turnkey.com/authentication/email#email-auth-and-recovery:~:text=height%20of%20124px-,magicLinkTemplate,-%3A%20a%20template%20for) can be found [here](https://github.com/tkhq/sdk/tree/main/examples/authentication/magic-link-auth). ### Email recovery In Turnkey, email recovery **does not refer to a separate, recovery-only email address** (as commonly used in consumer products, where a recovery email can reset access but cannot itself be used to sign in). Instead, it means **adding email as an authentication method for a user**. Once added, that user can authenticate using email by default, alongside any other configured authenticators (such as passkeys, social logins or external wallets). The legacy iframe-based flow using `INIT_USER_EMAIL_RECOVERY` and `RECOVER_USER` still exists for backward compatibility with older integrations. These flows ultimately attach new authentication material (for example, a passkey) to the user. They are being deprecated and **should not be used for new integrations**. ## Prerequisites Make sure you have set up your primary Turnkey organization with at least one API user that can programmatically initiate email auth and create suborganizations. Check out our [Quickstart guide](/get-started/quickstart) if you need help getting started. To allow an API user to initiate email auth, you'll need the following policy in your main organization: ```json theme={"system"} { "effect": "EFFECT_ALLOW", "consensus": "approvers.any(user, user.id == '')", "condition": "(activity.resource == 'AUTH' && activity.action == 'CREATE') || (activity.resource == 'ORGANIZATION' && activity.action == 'CREATE')" } ``` For OTP Auth signup and login flows you will need a user with the following policy ```json theme={"system"} { "effect": "EFFECT_ALLOW", "consensus": "approvers.any(user, user.id == '')", "condition": "(activity.resource == 'AUTH' && activity.action == 'CREATE') || (activity.resource == 'OTP' && activity.action == 'CREATE') || (activity.resource == 'OTP' && activity.action == 'VERIFY') || (activity.resource == 'ORGANIZATION' && activity.action == 'CREATE')" } ``` Avoid using an API key that is also present in the sub-organization that you're targeting within the email activities. Turnkey identifies the user from the request signature and in case of an identical API key it will always prioritize the sub-organization user matching. As a result, it will try to evaluate the sub-organization policies instead of the parent ones. ## User experience ### OTP-based authentication flow The flow begins with a new activity of type `ACTIVITY_TYPE_INIT_OTP_V3` using the parent organization id with these parameters: * `otpType`: specify `"OTP_TYPE_EMAIL"` * `contact`: user's email address * `emailCustomization`: optional parameters for customizing emails * `userIdentifier`: optional parameter for rate limiting SMS OTP requests per user. We recommend generating this server-side based on the user's IP address or public key. See the [OTP Rate Limits](#otp-rate-limits) section below for more details. * `alphanumeric`: optional parameter for making this code bech32 alphanumeric or not. default: true * `otpLength`: optional parameter for selecting the length of the OTP. default: 9 * `expirationSeconds`: optional validity window (defaults to 5 minutes) * `sendFromEmailAddress` : optional custom email address from which to send the OTP email * `sendFromEmailSenderName` : optional custom sender name for use with sendFromEmailAddress; if left empty, will default to ‘Notifications’ * `replyToEmailAddress` : optional custom email address to use as reply-to The response to `ACTIVITY_TYPE_INIT_OTP_V3` includes an `otpEncryptionTargetBundle` which is used in OTP verification. After receiving the OTP, users complete OTP verification with `ACTIVITY_TYPE_VERIFY_OTP_V2` using the parent organization id which returns a verificationToken JWT: * `otpId`: ID from the init activity * `encryptedOtpBundle`: bundle generated using the otpEncryptionTargetBundle received during `ACTIVITY_TYPE_INIT_OTP_V3` and contains the 6-9 digit or alphanumeric code received via email, and the public key of a client-side generated keypair. * `expirationSeconds`: optional validity window (defaults to 1 hour) After receiving the verification token, users complete OTP authentication flow with `ACTIVITY_TYPE_OTP_LOGIN_V2` using the sub-organization ID associated with the contact from the first step: * `publicKey`: public key to add to organization data associated with the signing key in IndexedDB or SecureStorage. * `verificationToken`: JWT returned from successful `VERIFY_OTP` activity * `clientSignature`: This proves authorization for the verification token being used, and is generated using the keypair whose public key was provided in the `encryptedOtpBundle` during verification. * `expirationSeconds`: optional validity window (defaults to 15 minutes) * `invalidateExisting`: optional boolean to invalidate previous login sessions auth otp email ### Sub-organization initiated OTP By default, the OTP flow is performed by the parent organization using an API key with sufficient permissions. Sub-organizations can also run the full flow directly — the sub-org's root user (or any user with a policy permitting OTP creation and verification) can initiate it without involving the parent backend. All activities are stamped using valid sub-organization credentials, with `organizationId` set to the sub-org ID throughout: Call `ACTIVITY_TYPE_INIT_OTP_V3` with `organizationId` set to the sub-org ID, stamped with the sub-org's API key Call `ACTIVITY_TYPE_VERIFY_OTP_V2` with the same sub-org ID and API key to receive a `verificationToken` Use the `verificationToken` to complete one of the following: * `ACTIVITY_TYPE_OTP_LOGIN_V2` — authenticate and create a new session * `ACTIVITY_TYPE_UPDATE_USER_EMAIL` — verify and update the user's email address * `ACTIVITY_TYPE_UPDATE_USER_PHONE` — verify and update the user's phone number The `verificationToken` is scoped to the issuing organization. Parent-issued tokens can be used by any sub-organization; sub-org-issued tokens are limited to that sub-org only. ### OTP rate limits In order to safeguard users, Turnkey enforces rate limits for OTP auth activities. If a `userIdentifier` parameter is provided, the following limits are enforced: * 3 requests per 3 minutes per unique `userIdentifier` * 3 retries max per code, after which point that code will be locked * 3 active codes per user, each with a 5 minute TTL ### Credential bundle authentication flow This alternative method uses `ACTIVITY_TYPE_EMAIL_AUTH` with these parameters: * `email`: user's email address (must match their registered email) * `targetPublicKey`: public key for credential encryption * `apiKeyName`: optional name (defaults to `Email Auth - `) * `expirationSeconds`: optional validity window (defaults to 15 minutes) * `emailCustomization`: optional parameters for customizing emails * `invalidateExisting`: optional boolean to invalidate previous Email Auth API keys auth email ## Email customization We offer customization for the following: * `appName`: the name of the application. This will be used in the email's subject, e.g. `Sign in to ${appName}` * `logoUrl`: a link to a PNG with a max width of 340px and max height of 124px * `magicLinkTemplate`: a template for the URL to be used in the magic link button, e.g. `https://dapp.xyz/%s`. The auth bundle will be interpolated into the `%s` ```js theme={"system"} // Sign and submits the EMAIL_AUTH activity const response = await client.emailAuth({ type: "ACTIVITY_TYPE_EMAIL_AUTH", timestampMs: String(Date.now()), organizationId: , parameters: { email: , targetPublicKey: , apiKeyName: , expirationSeconds: , emailCustomization: { appName: , logoUrl: , magicLinkTemplate: } }, }); ``` ### Breaking change: `appName` required **Effective December 16, 2025** Beginning December 16, 2025, all email-based OTP and recovery activities will require the `appName` parameter. Existing SDK versions will continue working, but upgrading without setting an `appName` will break email-based flows. **Auth Proxy users** — Set `appName` under [email configuration](https://app.turnkey.com/dashboard/walletKit) in the dashboard. **Server SDK users** — If you call `init_otp_auth`, `init_otp`, `email_recovery`, or `email_auth` without `appName`: * For `email_recovery` or `email_auth`: include `appName` in your request * For `init_otp` or `init_otp_auth`: update your API call to match the new input structure when upgrading to the latest server SDK **`emailAuth` and `emailRecovery`** — both methods use the same parameter structure: ```js theme={"system"} await client.emailAuth({ parameters: { email: "user@example.com", targetPublicKey: "", emailCustomization: { appName: "Your App Name" // this is now required } } }); ``` **`initOtp` and `initOtpAuth`** — both methods use the same parameter structure: ```js theme={"system"} await client.initOtp({ parameters: { otpType: "OTP_TYPE_EMAIL", contact: "user@example.com", appName: "Your App Name", // this is now required emailCustomization: { // other optional customization } } }); ``` If you manage email flows with policies, update to the new activity types: | **Flow** | **Old activity type** | **New activity type** | | :---------------- | :-------------------------------------------------------------- | :------------------------------------------ | | Email auth | `ACTIVITY_TYPE_EMAIL_AUTH`, `ACTIVITY_TYPE_EMAIL_AUTH_V2` | `ACTIVITY_TYPE_EMAIL_AUTH_V3` | | Init OTP auth | `ACTIVITY_TYPE_INIT_OTP_AUTH`, `ACTIVITY_TYPE_INIT_OTP_AUTH_V2` | `ACTIVITY_TYPE_INIT_OTP_AUTH_V3` | | Init OTP (signup) | `ACTIVITY_TYPE_INIT_OTP`, `ACTIVITY_TYPE_INIT_OTP_V2` | `ACTIVITY_TYPE_INIT_OTP_V3` | | Verify OTP | `ACTIVITY_TYPE_VERIFY_OTP` | `ACTIVITY_TYPE_VERIFY_OTP_V2` | | OTP login | `ACTIVITY_TYPE_OTP_LOGIN` | `ACTIVITY_TYPE_OTP_LOGIN_V2` | | Email recovery | `ACTIVITY_TYPE_INIT_USER_EMAIL_RECOVERY` | `ACTIVITY_TYPE_INIT_USER_EMAIL_RECOVERY_V2` | ### Email templates We also support custom HTML email templates for [Enterprise](https://www.turnkey.com/pricing) clients on the **Scale** tier. This allows you to inject arbitrary data from a JSON string containing key-value pairs. In this case, the `emailCustomization` variable may look like: ```js theme={"system"} ... emailCustomization: { templateId: , templateVariables: "{\"username\": \"alice and bob\"}" } ... ``` In this specific example, the value `alice and bob` can be interpolated into the email template using the key `username`, referenced in the template with `{{ index .TemplateVariables "username" }}`. The use of such template variables is purely optional. Here’s an example of a custom HTML email template that includes the OTP code, referenced within the markup as `{{ .OtpCode }}`. For best compatibility across email providers, make sure to use PNG images within your templates. dynamic email auth example **Bespoke HTML templates** and **custom email sender domains** are available to [**Enterprise clients**](https://www.turnkey.com/pricing) on the **Scale tier** or higher. If you are interested in implementing bespoke, fully-customized email templates, please reach out to [hello@turnkey.com](mailto:hello@turnkey.com). ### Custom email sender domain [Enterprise](https://www.turnkey.com/pricing) clients can also customize the email sender domain. To get set up, please reach out to your Turnkey rep to get started but here is what you'll be able to configure: ```js theme={"system"} // Optional custom email address from which to send the OTP email "sendFromEmailAddress": "notifs@mail.domain.com" // Optional custom sender name "sendFromEmailSenderName": "MyApp Notifications" // Optional reply-to email address "replyToEmailAddress": "reply@mail.domain.com" ``` Please keep in mind that: * Email has to be from a pre-whitelisted domain * If there is no `sendFromEmailAddress` or it's invalid, the other two fields are ignored * If `sendFromEmailSenderName` is absent, it defaults to "Notifications" (again, ONLY if `sendFromEmailAddress` is present and valid) * If `replyToEmailAddress` is absent, then there is no reply-to added. If it is present, it must ALSO be from a valid, whitelisted domain, but it doesn't have to be the same email address as the `sendFromEmailAddress` one (though once again, this first one MUST be present, or the other two feature are ignored) * **Sender name screening:** Some email clients (e.g. Gmail) screen sender names more aggressively than others (e.g. Apple Mail), which can lead to inconsistent display across clients. To ensure a consistent experience, keep your `sendFromEmailSenderName` "safe looking" — avoid underscores, special symbols, or unusual formatting that may cause it to be filtered or hidden. If you are interested in implementing bespoke, fully-customized email templates and sender domain, please reach out to [hello@turnkey.com](mailto:hello@turnkey.com). ### Authorization Authorization is managed through our [policy engine](/features/policies/overview): ### Authentication Both OTP-based and credential bundle authentication activities: * Can be performed by [root quorum](/features/users/root-quorum#root-quorum) or users with proper policy authorization * Require the respective feature to be enabled in the organization and sub-organization * Can target any user in the organization or sub-organizations Specifically: * For OTP-based auth (current): `ACTIVITY_TYPE_INIT_OTP_V3`, `ACTIVITY_TYPE_VERIFY_OTP_V2`, and `ACTIVITY_TYPE_OTP_LOGIN_V2` * For credential bundle auth: `ACTIVITY_TYPE_EMAIL_AUTH` email auth authorization ### Example implementations * [OTP Auth Example](https://github.com/tkhq/sdk/tree/main/examples/authentication/otp-auth) * [Email Auth Example](https://github.com/tkhq/sdk/tree/main/examples/authentication/email-auth) * [Demo Embedded Wallet](https://wallet.tx.xyz) ([code](https://github.com/tkhq/demo-embedded-wallet)) ## Implementation in organizations For organizations accessed via dashboard: 1. Ensure the required features are enabled: * `FEATURE_NAME_OTP_EMAIL_AUTH` for OTP-based authentication * `FEATURE_NAME_EMAIL_AUTH` for credential bundle authentication 2. Users initiating the request must have appropriate permissions ## Opting out Organizations can disable email-based features if their security model requires it: Use `ACTIVITY_TYPE_REMOVE_ORGANIZATION_FEATURE` to disable: * `FEATURE_NAME_OTP_EMAIL_AUTH` for OTP-based authentication * `FEATURE_NAME_EMAIL_AUTH` for credential bundle authentication When creating sub-organizations, use: * `disableOtpEmailAuth` parameter for OTP-based authentication * `disableEmailAuth` parameter for credential bundle authentication ## Implementation notes * Users are limited to: * 10 long-lived API keys * 10 expiring API keys (oldest are discarded when limit is reached) ### For top-level organizations * Both authentication methods are disabled by default * Must be enabled via `ACTIVITY_TYPE_SET_ORGANIZATION_FEATURE` ### For sub-organizations * Both authentication methods are enabled by default * Can be disabled during creation using `CreateSubOrganizationIntentV7` activity parameters Example of enabling OTP-based Email Auth: ```bash theme={"system"} turnkey request --host api.turnkey.com --path /public/v1/submit/set_organization_feature --body '{ "timestampMs": "'"$(date +%s)"'000", "type": "ACTIVITY_TYPE_SET_ORGANIZATION_FEATURE", "organizationId": "", "parameters": { "name": "FEATURE_NAME_OTP_EMAIL_AUTH" } }' --organization ``` Example of enabling credential bundle Email Auth: ```bash theme={"system"} turnkey request --host api.turnkey.com --path /public/v1/submit/set_organization_feature --body '{ "timestampMs": "'"$(date +%s)"'000", "type": "ACTIVITY_TYPE_SET_ORGANIZATION_FEATURE", "organizationId": "", "parameters": { "name": "FEATURE_NAME_EMAIL_AUTH" } }' --organization ``` # Overview Source: https://docs.turnkey.com/features/authentication/overview Learn about supported authentication methods for Turnkey, how to add them, and usage details. Turnkey's wallet system supports granular controls on who can access wallets and what actions different users can perform. To enforce these controls, Turnkey's API must verify the identity of the party requesting a wallet action, ensuring that only authorized actions are executed by the system. This process is known as **authentication**. Turnkey supports both **API authentication** and **user authentication** for authenticating access to wallets. ## API authentication With **API authentication**, Turnkey authenticates a request from your server directly using an **API secret**. This ensures that Turnkey only executes requests sent by your servers alone, and no other party. In addition to the API secret, you can also configure **authorization policies** that control specific wallets, private keys, and other resources. Any requests to use or update these resources require approval according to the corresponding policy. This allows you to enforce granular controls on all Turnkey resources. For backend implementation details, see our [Backend Setup](/features/authentication/backend-setup) guide. **API Reference**: [Create API Keys](/api-reference/activities/create-api-keys), [Get API Keys](/api-reference/queries/get-api-keys) ## User authentication Turnkey is a powerful toolkit for progressive authentication of users. With fine-grained control over onboarding flows and wallet connections, you can improve conversion and craft better UX. Using any of Turnkey's client-side SDKs, your app can authenticate users across web2 and web3 accounts, including: * **WebAuthN/Passkeys**: Biometric or passkey-based login based on the WebAuthn standard. [Learn more](/features/authentication/passkeys/introduction) * **Email or SMS**: Passwordless login via a one-time passcode sent to a user's email address or phone number. [Learn more](/features/authentication/email) | [SMS Authentication](/features/authentication/sms) * **OAuth and social logins**: Social login with Google, Apple, Twitter, Discord, GitHub, LinkedIn, and more. [Learn more](/features/authentication/social-logins) * **Wallets**: External wallet login via Sign-In With Ethereum and Sign-In With Solana. [Learn more](/solutions/embedded-wallets/integration-guide/react/using-external-wallets/overview) Your app can configure each of these authentication methods to be an upfront login method, or as an account that users link later. All of Turnkey's authentication methods create a common user object, where you can easily find a user's unique ID and all of the accounts they've linked to their profile. A user is a user, regardless of whether they've connected with a wallet, email or other account. Once a user successfully authenticates with Turnkey, Turnkey creates a session for that user that your app can use to represent an authenticated session or to make authenticated requests to your backend. For information about managing authenticated sessions, see our [Sessions](/features/authentication/sessions) documentation. ## Related resources
# Discoverable vs. non-discoverable Source: https://docs.turnkey.com/features/authentication/passkeys/discoverable-vs-non-discoverable Also known as "resident" vs. "non-resident" credentials. From [the spec](https://www.w3.org/TR/webauthn-2/) > Historically, client-side discoverable credentials have been known as resident credentials or resident keys. Due to the phrases ResidentKey and residentKey being widely used in both the WebAuthn API and also in the Authenticator Model (e.g., in dictionary member names, algorithm variable names, and operation parameters) the usage of resident within their names has not been changed for backwards compatibility purposes. Also, the term resident key is defined here as equivalent to a client-side discoverable credential. What does this mean exactly? * "resident" credentials and "discoverable" credentials are the same * "non-resident" credentials and "non-discoverable" credentials are the same. The spec authors made this rename for clarity. With terminology out of the way, what is a "discoverable" credential compared to a "non-discoverable" credential? And why does it matter? ## Discoverable credentials A discoverable credential is a self-contained key pair, stored on the end-user's device. Discoverable credentials are preferred because keys are self-contained, can easily be synced and can be used across devices independently. Crucially for UX, the end-user is able to list their passkeys and choose which device/passkey they'd like to use: device selection on Chrome passkey selection on Chrome With discoverable credentials you don't have to keep track of credential IDs. Your authentication flow can simply be: "prompt the user with passkey authentication", and let the browser or device native UX handle the rest! The downside is you lose some control over these prompts, because they will vary depending on your users' OS and browser. For a live example using discoverable credentials, see [wallet.tx.xyz](https://wallet.tx.xyz/). ## Non-discoverable credentials A non-discoverable credential isn’t stored on the end-user's device fully: Turnkey must store the generated credential ID; otherwise the user won’t be able to sign. This is because the actual signing key is a combination of an “on-device” secret and the credential ID (see details [here](https://crypto.stackexchange.com/questions/105942/how-do-non-resident-keys-work-in-webauthn)). Why would you choose non-discoverable credentials? * Most hardware security keys have limited slots to store discoverable credentials, or will refuse to create new discoverable credentials on the hardware altogether. YubiKey 5 [advertises 25 slots](https://support.yubico.com/hc/en-us/articles/4404456942738-FAQ#h_01FFHQFVBW0995G2MKZGCKQVEJ), SoloKeys [support 50](https://github.com/solokeys/solo1/issues/156#issuecomment-477645573), NitroKeys 3 [support 10](https://github.com/Nitrokey/nitrokey-3-firmware/blob/0e23c75318e2016ac1cfb8345de9279e3ad2eaf9/components/apps/src/lib.rs#L390). Non-discoverable credentials aren't subject to these limits because they work off of a single hardware secret. * Security keys can only allow clearing of individual slots if they support [CTAP 2.1](https://fidoalliance.org/specs/fido-v2.1-rd-20201208/fido-client-to-authenticator-protocol-v2.1-rd-20201208.html). This is described in [this blog post](https://fy.blackhats.net.au/blog/2023-02-02-how-hype-will-turn-your-security-key-into-junk/). When security keys do not support CTAP 2.1, slots can only be freed up by resetting the hardware entirely, erasing all secrets at once. * Non-discoverable credentials take less space. This is important in some environments, but unlikely to be relevant if your users are storing passkeys in their Google or Apple accounts (plenty of space available there!) * Credential IDs have to be communicated during authentication (via the `allowCredentials` field). This allows browsers to offer better, more tailored prompts in some cases. For example: if the list contains a single authenticator with `"transports": ["AUTHENTICATOR_TRANSPORT_INTERNAL"]`, Chrome does “the right thing” by skipping the device selection popup: users go straight to the fingerprint popup, with no need to select “this device”! The downside to this is, of course, that you need to store credential IDs, and you need to make sure you can retrieve credentials for each user. This can be done with a table of credentials keyed by user email, for example. Or if you have your own authentication already, a list of credentials can be returned when the user logs in. For a live example using non-discoverable credentials, head to [app.turnkey.com](https://app.turnkey.com). That's right, Turnkey uses non-discoverable credentials because we need to offer broad support for security keys. We have some work ongoing to support both discoverable and non-discoverable credentials going forward. # Integrating Passkeys Source: https://docs.turnkey.com/features/authentication/passkeys/integration ## Passkey flow A typical passkey flow is composed of 4 main steps, depicted below: Passkey flow on Turnkey 1. Your app frontend triggers a passkey prompt. 2. Your end-user uses their device to produce a signature with their passkey, and a signed request is produced. 3. The signed request is forwarded to your backend. This step is optional, see ["To Proxy or not to proxy"](#proxying-signed-requests) below for more information. 4. The signed request is verified within a Turnkey secure enclave. This flow happens once for **registration** and for each subsequent **authentication** or signature request. The main difference is the browser APIs used to trigger the passkey prompt in step (1): * **Passkey registration** uses `navigator.credentials.create`(as described in [this guide](https://web.dev/passkey-registration/)). `navigator.credentials.create` triggers the creation of a **new** passkey. * **Passkey authentication** uses `navigator.credentials.get`. See [this guide](https://web.dev/passkey-form-autofill/) for more information. `navigator.credentials.get` triggers a signature prompt for an **existing** passkey. ## Our SDK can help Our SDK has integrated passkey functionality, and we've built examples to help you get started. * [`@turnkey/http`](https://www.npmjs.com/package/@turnkey/http) has a helper to trigger passkey registration (`getWebAuthnAttestation`). You can see passkey registration in action in our [`with-federated-passkeys`](https://github.com/tkhq/sdk/tree/main/examples/authentication/with-federated-passkeys) example: [example code](https://github.com/tkhq/sdk/blob/325fdedf2c647c9a93f28aa7355b1ff0053689f9/examples/authentication/with-federated-passkeys/src/pages/index.tsx) * [`@turnkey/webauthn-stamper`](https://www.npmjs.com/package/@turnkey/webauthn-stamper) is a passkey-compatible stamper which integrates seamlessly with `TurnkeyClient`: ```ts theme={"system"} import { WebauthnStamper } from "@turnkey/webauthn-stamper"; import { TurnkeyClient, createActivityPoller } from "@turnkey/http"; const stamper = new WebauthnStamper({ rpId: "your.app.xyz", }); // New HTTP client able to sign with passkeys const httpClient = new TurnkeyClient( { baseUrl: "https://api.turnkey.com" }, stamper ); // This will produce a signed request that can be POSTed from anywhere. // The `signedRequest` has a URL, a POST body, and a "stamp" (HTTP header name and value) const signedRequest = await httpClient.stampCreatePrivateKeys(...) // Alternatively, you can POST directly from your frontend. // Our HTTP client will use the webauthn stamper and the configured baseUrl automatically! const activityPoller = createActivityPoller({ client: client, requestFn: client.createPrivateKeys, }); // Contains the activity result; no backend proxy needed! const completedActivity = await activityPoller({ type: "ACTIVITY_TYPE_CREATE_PRIVATE_KEYS_V2", // (omitting the rest of this for brevity) }) ``` * [`@turnkey/viem`](https://www.npmjs.com/package/@turnkey/viem) is a package wrapping all of the above so that you work directly with Viem without worrying about passkeys. See [this demo](https://github.com/tkhq/demo-viem-passkeys). Regardless of whether you use our helpers and abstractions, take a look at [our registration and authentication options guide](/features/authentication/passkeys/options). This will help you choose the right options for your passkey flow. If you have questions, feedback, or find yourself in need of an abstraction or integration that doesn't exist yet, please get in touch with us! You can * Create an [issue on our SDK repo](https://github.com/tkhq/sdk/issues) * Join our slack community [here](https://join.slack.com/t/clubturnkey/shared_invite/zt-3aemp2g38-zIh4V~3vNpbX5PsSmkKxcQ) * Contact us at [hello@turnkey.com](mailto:hello@turnkey.com) We're here to make this as easy as possible for you and your team! ## Passkey wallets with sub-organizations If you're wondering how to create independent, non-custodial wallets for your end-users, head to [Sub-Organizations](/features/sub-organizations). In short: you'll be able to pass the registered passkeys as part of a "create sub-organization" activity, making your end-users the sole owners of any resource created within the sub-organization (including private keys). Your organization will only have read permissions. # Introduction to Passkeys Source: https://docs.turnkey.com/features/authentication/passkeys/introduction Passkeys are born out of a new standard being pushed by major industry players: Apple and Google. Google has a great high-level introduction to passkeys at [https://developers.google.com/identity/passkeys](https://developers.google.com/identity/passkeys), and Apple has its own version here: [https://developer.apple.com/passkeys](https://developer.apple.com/passkeys) ## TLDR: what are passkeys? From a technical point of view, passkeys are cryptographic key pairs created on end-user devices. Apple and Google have done a great job making these key pairs usable: * Key generation happens in secure end-user hardware. * Using passkeys is easy thanks to native browser UIs and cross-device syncing. * Passkey recovery for users is supported natively by Apple via iCloud Keychain and Google via the Google Password Manager. Passkeys come with big security upgrades compared to traditional passwords: * Access to passkeys is gated with OS-level biometrics: faceID, touchID, lock screen patterns, and so on. * Passkeys are bound to the web domain that creates them. This is important to thwart phishing attacks, where an attacker hosts a similar-looking website to steal user credentials. This is doable with passwords; impossible with passkeys. * Because passkeys rely on public key cryptography, passkeys have two components: a public key and a private key. Private keys are never disclosed to websites or apps, making them a lot harder to steal. Only public keys are sent. To authenticate, passkeys sign messages (with their private keys) and provide signatures as proofs, similar to crypto wallets. ## Isn't this similar to WebAuthn? If you know about Webauthn, congratulations: a lot of this will feel familiar. Passkeys rely on the [same web standard](https://www.w3.org/TR/webauthn-2/) and the same browser APIs: `navigator.credentials.create` and `navigator.credentials.get`. The difference? Passkeys are resident credentials and they can be synced between devices. As a result, they are **not** device-bound and can be used from any device. ## How do cross-device syncing and recovery work? Synchronization and recovery are both supported natively by Apple and Google: * With Apple, Passkeys created on one device are synced through [iCloud Keychain](https://support.apple.com/en-us/HT204085) as long as the user is logged in with their Apple ID. Apple covers both syncing and recovery in ["About the security of passkeys"](https://support.apple.com/en-us/102195). For some additional detail, see [this Q\&A with the passkey team](https://developer.apple.com/news/?id=21mnmxow). Apple's account recovery process is documented in [this support page](https://support.apple.com/en-us/HT204921). * With Google, [Google Password Manager](https://passwords.google/) syncs passkeys across devices seamlessly. Google has plans to support syncing more broadly across different operating systems, see [this support summary](https://developers.google.com/identity/passkeys/supported-environments#chrome-passkey-support-summary). Recovery is covered in [this FAQ ("What happens if a user loses their device?")](https://developers.google.com/identity/passkeys/faq#what_happens_if_a_user_loses_their_device): it relies on Google's overall [account recovery process](https://support.google.com/accounts/answer/7682439?hl=en) because passkeys are attached to Google accounts. ## OS and browser support Modern browsers have great support for passkeys. See [caniuse](https://caniuse.com/passkeys) for detailed information. Support also varies by operating system: [this matrix](https://passkeys.dev/device-support/#matrix) has detailed information about OS-level support. ## Betting on WebAuthn and Passkeys We believe **it's time to move away from passwords** so we've built Turnkey without them. When you authenticate to Turnkey you'll be prompted to create a new passkey: Authenticator selection on Turnkey Passkey prompt on Turnkey Authentication to Turnkey requires a passkey signature. No password needed! Next up, learn about how you can integrate passkeys into your app, [here](/features/authentication/passkeys/integration). # Native Passkeys Source: https://docs.turnkey.com/features/authentication/passkeys/native If you're unfamiliar with passkeys broadly, head to for an overview. TL;DR: passkeys are cryptographic key pairs generated and stored on secure hardware. Typically this is your Mac's or iPhone's , your Android's , or an external security key plugged in via USB. * Registration ("sign up") creates a new key pair: this is your passkey * Authentication ("sign in") uses an existing passkey to sign a message, proving ownership of the associated private key stored on your device. ## Passkeys on the web Creating and using passkeys on the web is straightforward: browsers offer APIs to do it! * `navigator.credentials.create` creates a passkey * `navigator.credentials.get` prompts the user to select a passkey to sign a message And this doesn't require a backend. Here's a demo proving it: [https://passkeyapp.tkhqlabs.xyz/](https://passkeyapp.tkhqlabs.xyz/) An important security feature of passkeys: they're **domain-bound** to prevent phishing. In other words: passkeys created on `passkeyapp.tkhqlabs.xyz` won't be usable on `turnkey.com` for example. Browsers prevent this. ## Native platform APIs ### Android In the Android ecosystem the `CredentialManager` supports creating and using passkeys with `CreatePublicKeyCredentialRequest` and `GetCredentialRequest`. See [the associated documentation](https://developer.android.com/training/sign-in/passkeys#sign-in) for more information. ### iOS iOS APIs to create and use passkeys are available as well: * `ASAuthorizationPlatformPublicKeyCredentialProvider(…).createCredentialRegistrationRequest` for passkey creation * `ASAuthorizationPlatformPublicKeyCredentialProvider(…).createCredentialAssertionRequest` for passkey usage See [these docs](https://developer.apple.com/documentation/authenticationservices/asauthorizationplatformpublickeycredentialprovider) for more info. And [this app](https://github.com/r-n-o/shiny) for a mini demo. ### Beware: no native Turnkey SDK (yet) While the native APIs to interact with passkeys exists on both iOS and Android, Turnkey doesn't yet offer an SDK for Swift or Kotlin, which means you'd have to write code to sign activities and send HTTP requests to our API. Get in touch with us if this is something you're attempting to do, we'd love to support you and release this as a proper SDK maintained by Turnkey. ## Building with React Native (recommended) Turnkey has a fully-featured [TypeScript SDK](https://github.com/tkhq/sdk/). It provides a type-safe client to call the Turnkey API and abstracts activity request signing. [React Native](https://reactnative.dev/) lets you write your app in Typescript and compile it into native code for both iOS and Android automatically. To sign Turnkey requests with native passkeys in a React Native application we've released [`@turnkey/react-native-passkey-stamper`](https://www.npmjs.com/package/@turnkey/react-native-passkey-stamper), a package compatible with our TypeScript client to sign Turnkey requests with native passkeys. Under the hood this package wraps [`react-native-passkey`](https://github.com/f-23/react-native-passkey), which calls the right native APIs on [iOS](https://github.com/f-23/react-native-passkey/blob/17184a1b1f6f3ac61e07aa784c9b64efb28b570e/ios/Passkey.swift#L29) and [Android](https://github.com/f-23/react-native-passkey/blob/17184a1b1f6f3ac61e07aa784c9b64efb28b570e/android/src/main/java/com/reactnativepasskey/PasskeyModule.kt#L30C44-L30C76), and exports a unified interface that we leverage. Bottom-line: if you've used our [webauthn stamper](https://www.npmjs.com/package/@turnkey/webauthn-stamper) or [API key stamper](https://www.npmjs.com/package/@turnkey/api-key-stamper), using our React Native passkey stamper will feel familiar. Take a look at the ["Installation"](https://www.npmjs.com/package/@turnkey/react-native-passkey-stamper#installation) and ["Usage"](https://www.npmjs.com/package/@turnkey/react-native-passkey-stamper#usage) sections to get started with passkeys in your React Native application. If you're looking for a concrete example, head to [this repository](https://github.com/r-n-o/passkeyapp): it contains a sample application integrated with Turnkey, written with Expo, and tested on both Android and iOS. ## Linking apps and web domains Passkeys on native apps aren't app-bound, they're **domain** bound just like web passkeys. This may come as a surprise: you'll have to configure a web domain to use passkeys natively! Configuration is done separately per ecosystem, but the idea is the same: * iOS expects a JSON file at the domain root (`/.well-known /apple-app-site-association`) : [example](https://github.com/r-n-o/passkeyapp/blob/main/http/.well-known/apple-app-site-association) * Android expects a JSON file at the domain root (`/.well-known/assetlinks.json`): [example](https://github.com/r-n-o/passkeyapp/blob/main/http/.well-known/assetlinks.json) This unlocks interesting flows where users use their web-created passkeys in a "companion" native app, or vice-versa. For example: a native app linked to the wallet.tx.xyz domain would allow users to log into their account from a native mobile app *using their web-created passkey* as long as they're synced properly. Note that these associations are "many-to-many": a website can link multiple associated apps, and a single native application can choose to create passkeys for multiple domains, via a dropdown for example. However (as far as we know) a single passkey is always bound to a single web domain: it can't be bound to multiple web domains. # Passkey options Source: https://docs.turnkey.com/features/authentication/passkeys/options Whether you use the raw browser APIs or one of our helpers you'll have flexibility to set your own registration and authentication options. This page provides an overview and some recommendations related to these options. ## Registration options Mozilla has good (but lengthy) documentation on each option: [MDN documentation](https://developer.mozilla.org/en-US/docs/Web/API/CredentialsContainer/create). Below we detail the most relevant options you'll want to think about. ### `challenge` This is the challenge signed by the end-user for registration. During registration this challenge isn't meaningful so we recommend picking a random challenge. It will not be visible to users. ### `timeout` Number of seconds before "giving up". The browser will simply show a timeout popup: Timeout popup This UI isn't very helpful, so we recommend making the timeout long (5 minutes). The less your users see this, the better. ### `rp` The `rp` options is an object with 2 fields: `id` and `name`. `rp.id` (aka RPID) should be your app top-level domain. For example, if your app is hosted on `https://your.app.xyz` the RPID should be `app.xyz` unless you have good reasons to do otherwise (see below). `rp.id`, or RPID, is a way to identify the website a passkey is associated with. Once set at registration time, it **determines the set of origins on which the passkey may be be used**. The [WebAuthn spec](https://www.w3.org/TR/webauthn-2/#relying-party-identifier) states that the RPID must be a “registrable domain suffix of, or equal to” the current domain. If the page creating a passkey is hosted at `https://your.app.xyz`, the RPID can thus be "your.app.xyz" or "app.xyz". A passkey with RPID "your.app.xyz" **cannot** be used on `https://www.app.xyz` or `https://foo.app.xyz`. However a passkey created with RPID "app.xyz" **will** be usable on all `https://*.app.xyz` sub-domains: `https://your.app.xyz`, `https://www.app.xyz`, `https://foo.app.xyz`, and so on. Hence our general recommendation above to set `app.xyz` (top-level domain) as the RPID to maximize flexibility. A reason why you might want to set the RPID to "your.app.xyz" instead of "app.xyz" like recommended above is extra security: if you are worried about user passkeys being usable across all your sub-domains, it makes sense to scope passkeys to the sub-domain they're meant to be used on, and only that sub-domain. If you scope passkeys to a specific sub-domain, be aware that migrating your app to a different sub-domain later will require a migration process where users have to re-enroll themselves by creating new passkeys on the new sub-domain. Passkeys cannot be transferred from one RPID to another. `rp.id` will show up in the initial registration popup: RPID in registration prompt `rp.name` doesn't show up in the popup so can be set to anything. We recommend setting it to the correctly capitalized name of your app, in case browsers start showing it in their native UIs in the future. ### `attestation` This option indicates whether an attestation is needed, to prove the authenticator authenticity. In general, Turnkey doesn't need attestations. Most passkeys do not produce meaningful attestations for privacy reasons. In the context of passkey integrations, you can omit this option: it will default to "none". ### `pubKeyCredParams` and `alg` The `pubKeyCredParams` is a list of supported algorithms. If you're relying on Turnkey to validate passkey signatures, this list should be: `[{alg: -7, type: "public-key"}, {alg: -257, type: "public-key"}]`. The integers `-7` and `-257` are algorithm identifiers for ES256 (aka P256) and RS256 (aka RSA), respectively. The full list of possible values is part of the [COSE standard, maintained by IANA](https://www.iana.org/assignments/cose/cose.xhtml#algorithms). Currently Turnkey only supports ES256 and RS256. ### `user` The `user` field has three sub-fields: * `id`: also known as "user handle", isn't visible to the end-user. We **strongly recommend setting this to a random value** (e.g. `const id = new Uint8Array(32); crypto.getRandomValues(id)`) to make sure a new passkey is created. Be aware: **if you accidentally set this value to an existing user handle, the corresponding passkey will be overridden!** [This section of spec](https://www.w3.org/TR/webauthn-2/#dictionary-user-credential-params) is clear on the matter: "the user handle ought not be a constant value across different accounts, even for non-discoverable credentials". * `name`: this will show up in the passkey list modal (see screenshot below). We recommend setting this to something the user will recognize: their email, the name of your app, or potentially leave this up to the user: User name and display name in passkey list * `displayName`: as far as we can tell this doesn't show up in current browser UIs. It might show up in future iterations so it's best to populate this with the same value as `name`. ### `authenticatorSelection` This option has lots of consequences for UX, and it has many sub-options, outlined below. #### `authenticatorAttachment` This option, if set, restricts the type of authenticators that can be registered. See the table below for the values this option can take and their effect on registration prompts (captured via Chrome on a MacBook Pro). | Empty (default) | `platform` | `cross-platform` | | -------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------- | | If you want broad compatibility, leave this option empty, and the browser UI will allow for both internal and external passkeys. | If set to `platform`, only internal authenticators (face ID, touch ID, and so on) can be registered. | If set to `cross-platform`, only passkeys from other devices or attached via USB are allowed. | | authenticatorAttachment unspecified | authenticatorAttachment set to platform | authenticatorAttachment set to cross-platform | #### `requireResidentKey` and `residentKey` These options allow you to specify whether you want your users to create discoverable or non-discoverable credentials. See [Discoverable vs. non-discoverable](/features/authentication/passkeys/discoverable-vs-non-discoverable) for more information. Default values: `residentKey` is `discouraged` and `requireResidentKey` is `false`. Important note: the default for `requireResidentKey` (`discouraged`) results in different outcomes based on OS: Android devices create non-discoverable credentials whereas iOS devices create discoverable credentials. If you want to create discoverable credentials whenever possible, set `requireResidentKey` to `false` and `residentKey` to `preferred`, which work across Android and iOS devices. #### `userVerification` "User verification" refers to mechanisms on the authenticators themselves such as PIN codes or biometric/fingerprint readers. This flag can be set to: * `discouraged`: yubikey PINs won't be required even if the device technically supports it. We've found that for TouchID/FaceID, authentication will still be required however. * `preferred`: yubikey PINs and other authentication mechanisms will be required if supported, but devices without them will be accepted. * `required`: authenticators without user verification support won't be accepted. To maximize compatibility we recommend setting `userVerification` to "discouraged" or "preferred" because some authenticators do not support user verification. Due to poor yubikey PIN UX in browsers, setting `userVerification` to "discouraged" is best unless you operate with a strict security threat model where user verification makes a big difference. "preferred" is the default value if you don't specify this option. ## Authentication options Mozilla's documentation on authentication options can be found here: [MDN documentation](https://developer.mozilla.org/en-US/docs/Web/API/CredentialsContainer/get). Luckily there are fewer authentication options than registration. ### `challenge` This is the challenge to sign with the passkey. If you're integrating with Turnkey, the challenge should be the POST body of the request to be signed. Our SDK and helpers set this automatically for you already. ### `rpId` Must match the `rp.id` option during passkey registration. Passkeys are domain bound, so it's not possible to use a passkey registered with `rp.id` set to "foo.com" and use it on "bar.com". This is a core anti-phishing counter-measure. ### `allowCredentials` List of objects restricting which credentials can be used during authentication. This is crucial to specify if you're using [non-discoverable credentials](/features/authentication/passkeys/discoverable-vs-non-discoverable#non-discoverable-credentials) or if you want to tailor browser prompts to the right type of transport. Each object in this list has an ID (the credential ID) and a list of transports (e.g. "hybrid", "internal", "usb", etc). The `transports` list is **optional** but results in better, more targeted prompts. For example, here are screenshot of targeted prompts captured on Chrome, on a MacBook laptop: | `transports: ["internal"]` | `transports: ["usb"]` | `transports: ["hybrid"]` | | ------------------------------------------------------------------------------ | ------------------------------------------------------------------------- | --------------------------------------------------------------------------- | | authentication prompt with transports: internal | authentication prompt with transports: usb | authentication prompt with transport: hybrid | The credential ID needs to be passed as a buffer but is returned from registration as a base64-encoded value: make sure to decode it (in JavaScript: `Buffer.from(storedCredentialId, "base64")`) to avoid issues. If the wrong credential ID is specified, `transports: ["internal"]` is set, browsers error right away because they can enumerate internal credentials. Chrome, for example, displays the following error: Chrome error when no matching passkey has been found for the provided Credential ID However, if the wrong credential ID is specified without `transports` set (or with other-than-internal `transports` set), browsers won't error right away because they can't enumerate external credentials. They will display an error once the user has pressed their security key or gone through the cross-device passkey flow: Chrome error when the credential ID used by the user is not in the allowCredentials list ### `attestation` See [`attestation`](#attestation) above. ### `timeout` See [`timeout`](#timeout) above. ### `UserVerification` See [`UserVerification`](#userverification) above. # Proxying signed requests Source: https://docs.turnkey.com/features/authentication/proxying-signed-requests Turnkey has an open CORS policy for its public API. This means your frontend can choose to POST sign requests straight to `https://api.turnkey.com`. Your frontend can also choose to forward the requests via a backend server (which POSTs the signed request to Turnkey). How should you decide what to do? Here are some considerations: * A backend proxy can be useful if you need to inspect and persist activity results. For example: if your users are creating wallets, you might want to persist the addresses. If your users are signing transactions, you might want to broadcast on their behalf. * Another reason why a backend server could be beneficial is monitoring, feature toggles, and validation: with a proxy you're able to control which requests are proxied and which aren't. You can also perform additional validation before signed requests are forwarded to Turnkey. * POSTing signed requests directly from your app frontend to Turnkey saves you the burden of running a proxy server, and takes you out of the loop so that your end-users interact directly with Turnkey. This is a "hands-off" approach that can work well if you want to give your end-users maximum flexibility and ownership over their sub-organization. For a working end-to-end implementation, see the [with-proxy-signed-requests example](https://github.com/tkhq/sdk/tree/main/examples/advanced/with-proxy-signed-requests). # Sessions Source: https://docs.turnkey.com/features/authentication/sessions Turnkey sessions allow a user to take multiple, contiguous actions in a defined period of time. ## What is a session? Such actions can be divided into two buckets: * Read operations: Retrieving data (e.g., viewing wallet balances) * Write operations: Modifying data or performing sensitive actions (e.g., signing transactions) ## How can I create a session? ### Read-only sessions In terms of end-user experience, a read-only session might make sense in low-touch applications where users are primarily reading data (think viewing wallets and their balances). As for implementation, there are a few ways a developer can achieve read-only access on behalf of a user. Note: an end-user (sub-organization) falls hierarchically under the developer (parent-organization). #### Parent organization access By default, a parent organization has read access to all of its sub-organizations’ data. This means you can set up a federated model where the client makes requests to a backend (containing the parent organization’s API key credentials), the backend populates the requested data, and returns it back to the client. From an implementation perspective, each read request (i.e. `get` or `list`) requires an `organizationId` parameter. Populate that field with the sub-organization’s ID in order to get its data. #### Client side access Separately, if you would like the client to have all read requests encapsulated (instead of reading data via a proxy like in the previous approach), the client can initiate a read-only session via a [CreateReadOnlySession activity](/api-reference/activities/create-read-only-session). This activity returns a session string that, if passed into an HTTP request via `X-Session` header, gives permission to perform reads. Note that because this is an activity performed by an end user, it still requires authentication (for example, via passkey). Turnkey’s current SDKs, including `@turnkey/react-wallet-kit` and `@turnkey/core`, do not support read-only sessions. These SDKs are designed around cryptographically stamped, read-write sessions and do not expose the divergent request paths required for token-based read-only authentication. If you need read-only session support, you must either interact with the Turnkey API directly and attach the session token to requests manually, or use older / legacy SDK [implementations](https://github.com/tkhq/sdk/blob/6b3ea14d1184c5394449ecaad2b0f445e373823f/packages/sdk-browser/src/sdk-client.ts#L231-L255) that still support token-based read-only sessions. For most applications, read-write sessions are recommended. By default, a parent organization already has read access to all of its sub-organizations’ data, allowing clients to fetch read-only data via a backend using the parent organization’s API credentials, without requiring a separate read-only client session. ### Read-write sessions In contrast to read-only sessions, a read-write session makes sense when a user would like to make several authenticated write requests in a window of time. There are a few ways to achieve this: #### Creating a read-write session There are several mechanisms to obtain read-write sessions: OTP, OAuth, Passkey sessions, and Session refreshing Read-write sessions Our SDK contains several abstractions that manage authentication. You can checkout all of our examples leveraging these examples [here](https://github.com/tkhq/sdk/tree/main/examples) **Note:** The session JWT is only metadata signed by Turnkey that references the client side stored API keypair, and is useful for verifying the session server-side or associating metadata, but it cannot be used to authenticate requests to Turnkey’s API. Only the session keypair can be used to create valid `x-stamp` signatures for API requests to Turnkey. In other words, solely the session JWT cannot be used to stamp requests outside of the client context. ### Mechanisms There are two primary mechanisms we offer that provide client side key generation and signing to support read-write sessions. #### IndexedDB (web only): For web apps that want stronger session persistence without relying on iframes or exposing credentials to your app’s JavaScript runtime, Turnkey supports using the [SubtleCrypto](https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto) API to generate unextractable asymmetric key pairs and store them securely in the browser’s IndexedDB. This approach enables long-lived, client-held sessions that survive page reloads, tab closures, and even browser restarts – **without ever exposing the private key** to your JavaScript code. Turnkey’s SDK provides helpers to: * Create a new session by generating a P-256 key pair via `crypto.subtle.generateKey()` * Sign requests * Store and retrieve the key using IndexedDB under a given session ID * Abstractions built on top of the `IndexedDBStamper` that simplify authentication flows This is currently the **most persistent** session model for modern browsers that support WebCrypto. It is especially valuable in Progressive Web App (PWA) contexts or when iframe and Local Storage approaches are insufficient. To see the IndexedDB-backed session mechanism in action, check out our Turnkey react-wallet-kit [playground](https://github.com/tkhq/sdk/tree/main/examples/demos/react-wallet-kit-playground) or dedicated authentication examples like [oauth](https://github.com/tkhq/sdk/tree/main/examples/authentication/oauth), [email OTP](https://github.com/tkhq/sdk/tree/main/examples/authentication/otp-auth), and [external wallet authentication](https://github.com/tkhq/sdk/tree/main/examples/authentication/wallet-auth). Our [Web demo application](https://github.com/tkhq/sdk/tree/main/examples/demos/with-react-wallet-kit) hosted at [wallets.turnkey.com](https://wallets.turnkey.com) showcases complete end-to-end authentication flows and client-side session persistence backed by IndexedDB. #### SecureStorage (mobile only) Secure Storage operates essentially the same as IndexedDB with respect to authentication flows for Turnkey except it is mobile native and keys are generated using @turnkey/crypto rather than WebCrypto. #### LocalStorage: Another option is to create an API key and store it directly within Local Storage. However, this is a riskier setup than IndexedDb/SecureStorage as anyone who is able to access this client-side API key has full access to a User. ### Sessions FAQ Once a user has a valid session, it is trivial to use that session to create a new session. The `refreshSession` abstraction will create a brand new session and automatically store the resulting new session in local storage. In order to delete a session, simply remove all user-related artifacts from Local Storage. ```ts theme={"system"} /** * Clears out all data pertaining to a user session. * * @returns {Promise} */ logout = async (): Promise => { await removeStorageValue(StorageKeys.Client); await removeStorageValue(StorageKeys.Session); return true; }; ``` The expiration of session keys can be specified to any amount of time using the `expirationSeconds` parameter. The default length is 900 seconds (15 minutes). A user can have up to 10 expiring API keys at any given time. If you create an expiring API key that exceeds that limit, Turnkey automatically deletes one of your existing keys using the following priority: * Expired API keys are deleted first * If no expired keys exist, the oldest unexpired key is deleted If you are looking to invalidate existing sessions, you can use the `invalidateExisting` parameter for all `_LOGIN` activities. This will clear all existing session keys. Absolutely! Through leveraging IndexedDb you can handle sessions in the same way for Web and PWAs. However, for React Native/Mobile applications you will need to leverage Secure Storage. # SMS authentication Source: https://docs.turnkey.com/features/authentication/sms SMS authentication enables users to authenticate their Turnkey account using their phone number via a 6-9 digit or bech32 alphanumeric one-time password (OTP). When authenticated, users receive an expiring API key stored in memory within an iframe, which functions like a session key to access their wallet. ## Access and pricing SMS authentication is available to all Enterprise customers. To enable this feature, please reach out to the Turnkey team ([help@turnkey.com](mailto:help@turnkey.com)). SMS pricing is usage-based and varies depending on the country of the destination phone number and the carrier. Prices are shown in U.S. cents per outbound SMS message segment. Taxes/surcharges separate. Select your country below to view pricing. ## Prerequisites Make sure you have set up your primary Turnkey organization with at least one API user that can programmatically initiate OTP and create sub-organizations. Check out our [Quickstart guide](/get-started/quickstart) if you need help getting started. To allow an API user to initiate email auth, you'll need the following policy in your main organization: ```json theme={"system"} { "effect": "EFFECT_ALLOW", "consensus": "approvers.any(user, user.id == '')", "condition": "(activity.resource == 'AUTH' && activity.action == 'CREATE') || (activity.resource == 'OTP' && activity.action == 'CREATE') || (activity.resource == 'OTP' && activity.action == 'VERIFY') || (activity.resource == 'ORGANIZATION' && activity.action == 'CREATE')" } ``` ## How it works SMS authentication uses three activities: 1. `INIT_OTP_V3` — initiates a secure OTP flow and sends a 6–9 digit or alphanumeric OTP to the specified phone number. The response includes an `otpEncryptionTargetBundle` which is used in OTP verification. 2. `VERIFY_OTP_V2` — securely verifies the code and returns a signed verificationToken JWT 3. `OTP_LOGIN_V2` — validates the verificationToken and returns a session (signed with the verification token key) ## Implementation ### Initiating SMS authentication The flow begins with a new activity of type `ACTIVITY_TYPE_INIT_OTP_V3` using the parent organization id with these parameters: * `otpType`: specify `"OTP_TYPE_SMS"` * `contact`: user's phone number * `emailCustomization`: optional parameters for customizing emails * `userIdentifier`: optional parameter for rate limiting SMS OTP requests per user. We recommend generating this server-side based on the user's IP address or public key. See the [OTP Rate Limits](#otp-rate-limits) section below for more details. * `alphanumeric`: optional parameter for making this code bech32 alphanumeric or not. default: true * `otpLength`: optional parameter for selecting the length of the OTP. default: 9 * `expirationSeconds`: optional validity window (defaults to 5 minutes) #### One-time password sandbox environment To test OTP codes in our sandbox environment you can use the following: * `alphanumeric` must be set to `false` * `otpLength` must be set to `6` * Phone Number: +1 999-999-9999 * OTP Code: `000000` In the sandbox environment, SMS delivery is simulated. Use the fixed OTP code `000000` (with the returned otpId) when calling `ACTIVITY_TYPE_VERIFY_OTP_V2` with the parent organization ID to obtain a verificationToken JWT: * `otpId`: ID from the init activity * `encryptedOtpBundle`: bundle generated using the otpEncryptionTargetBundle received during `ACTIVITY_TYPE_INIT_OTP_V3` and contains the 6-9 digit or alphanumeric code received via SMS, and the public key of a client-side generated keypair. * `expirationSeconds`: optional validity window (defaults to 1 hour) After receiving the verification token, users complete OTP authentication flow with `ACTIVITY_TYPE_OTP_LOGIN_V2` using the sub-organization ID associated with the contact from the first step: * `publicKey`: public key to add to organization data associated with the signing key in IndexedDB or SecureStorage. * `verificationToken`: JWT returned from successful `VERIFY_OTP` activity * `clientSignature`: This proves authorization for the verification token being used, and is generated using the keypair whose public key was provided in the `encryptedOtpBundle` during verification. * `expirationSeconds`: optional validity window (defaults to 15 minutes) * `invalidateExisting`: optional boolean to invalidate previous login sessions ## Authorization SMS authentication requires proper permissions through policies or parent organization status. ## Enabling/disabling SMS auth ### For top-level organizations SMS authentication is disabled by default. Enable it using `ACTIVITY_TYPE_SET_ORGANIZATION_FEATURE`: ```bash theme={"system"} turnkey request --host api.turnkey.com --path /public/v1/submit/set_organization_feature --body '{ "timestampMs": "'"$(date +%s)"'000", "type": "ACTIVITY_TYPE_SET_ORGANIZATION_FEATURE", "organizationId": "", "parameters": { "name": "FEATURE_NAME_SMS_AUTH" } }' --organization ``` ### For sub-organizations * SMS auth is enabled by default * Disable during creation using `disableSmsAuth: true` in the `CreateSubOrganizationIntentV7` activity * Disable after creation using `ACTIVITY_TYPE_REMOVE_ORGANIZATION_FEATURE` with feature name `FEATURE_NAME_SMS_AUTH` ## Implementation notes * Users are limited to 10 long-lived API keys and 10 expiring API keys * When the expiring API key limit is reached, the oldest key is automatically discarded ## OTP rate limits In order to safeguard users, Turnkey enforces rate limits for OTP auth activities. If a `userIdentifier` parameter is provided, the following limits are enforced: * 3 requests per 3 minutes per unique `userIdentifier` * 3 retries max per code, after which point that code will be locked * 3 active codes per user, each with a 5 minute TTL # Social logins Source: https://docs.turnkey.com/features/authentication/social-logins Social logins provide a familiar and convenient way for users to access applications using their existing accounts from popular platforms like Google, Apple, Facebook, X/Twitter, etc. Under the hood, this functionality is powered by OAuth - a robust auth protocol which enables secure user verification through OpenID Connect ([OIDC](https://openid.net/specs/openid-connect-core-1_0.html)) tokens. This feature is available exclusively for sub-organization users. Similar to [email auth](/features/authentication/email), social login authentication is ideal for users who prefer not to manage API keys or [passkeys](/features/authentication/passkeys/introduction) directly. This makes it particularly well-suited for onboarding users who are comfortable with traditional web2-style accounts but may be unfamiliar with cryptographic keys and credentials. An example implementing social login authentication for an organization can be found in our SDK repo [here](https://github.com/tkhq/sdk/tree/main/examples/authentication/oauth). ## Types of social login providers Turnkey supports two different types of Social Login Providers: 1. **OIDC Providers** (Google, Apple, Auth0, Cognito…) These providers issue your app an **OIDC ID Token** identifying an end-user, which can subsequently be passed to Turnkey as a means of authentication. 2. **OAuth 2.0-Only Providers** (X/Twitter, Discord…) These providers do *not* issue **OIDC ID Tokens** themselves, and instead provide only bare-bones OAuth 2.0. To work around this limitation, Turnkey runs the **OAuth 2.0 Authorization Code + PKCE** flow, calls the provider’s `who-am-I` endpoint using your app's credentials, and then uses the returned user data to **issue a short-lived OIDC ID token**. In effect, Turnkey acts as an "*OIDC Wrapper*" for these OAuth 2.0 Services. While the backend flows associated with these two types of Providers differ upstream of **OIDC ID Token** generation, they converge at that point and have no downstream differences. In both cases, the goal is to get an **OIDC ID Token** identifying the end user. ### Social login provider types - comparison The table below can be helpful in understanding the similarities and differences between the two types of Social Login Providers that Turnkey supports: | **Provider Type** | **OIDC Provider** | **OAuth 2.0-Only Providers** | | ----------------- | ---------------------------------------------- | ----------------------------------------------------------------- | | Providers | Google, Apple, Facebook, Auth0, Cognito | X/Twitter, Discord | | Token Transport | Returned to your App by Provider | Returned by Turnkey after the **OAuth 2.0 Auth Code + PKCE** flow | | Issuer (`iss`) | Provider (iss = Provider URL) | Turnkey (iss = Turnkey URL) | | Audience (`aud`) | Provider’s `client_id` for your app | Provider’s `client_id` for your app | | Subject (`sub`) | Provider’s subject (stable user ID) | Derived from ID `who-am-I` response (e.g., `x:123456789`) | | Nonce (`nonce`) | Sent to Provider; echoed in ID token | Sent to Turnkey; echoed in ID token. | | Refresh/access | If the Provider returns them, you may use them | Not provided. | ## Roles and responsibilities * **Turnkey**: Runs verifiable infrastructure to create credentials, verify OIDC tokens and, in the case of **OAuth 2.0-Only Providers**, issue them as well. * **Parent**: That's you! **For the rest of this guide we'll assume you, the reader, are a Turnkey customer**. We assume that you have: * An existing Turnkey organization (we'll refer to this organization as "the parent organization") * A web application frontend (we'll refer to this as just "app" or "web app") * A backend able to sign and POST Turnkey activities ("backend" or "parent backend") * **End-User**: The end-user is a user of your web app. They have an account with Google. * **OIDC Provider**: A provider able to authenticate your End-Users and provide OIDC tokens as proof. We'll use [Google](https://developers.google.com/identity/openid-connect/openid-connect) as an example. * **OAuth 2.0-Only Provider**: A provider of OAuth 2.0-based Authorization, for which Turnkey is able to act as an "*OIDC Wrapper*". ## Authentication sequence diagrams The sequence diagrams below display the differing flows for the two types of Social Login Providers. ### OIDC provider ```mermaid theme={"system"} sequenceDiagram participant User participant Frontend participant OAuth Provider participant Backend participant Turnkey Frontend->>Frontend: Create API keypair User->>Frontend: Clicks "Log in with " Frontend->>OAuth Provider: Start OAuth flow with nonce=sha256(API publicKey) OAuth Provider->>User: Prompt to grant permission User->>OAuth Provider: Grants permission OAuth Provider->>Frontend: Return oidcToken Frontend->>Backend: Send oidcToken + API publicKey Backend->>Turnkey: Gets subOrgIds with that associated oidcToken Turnkey->>Backend: Return subOrgId (or null) alt SubOrgId not found Backend->>Turnkey: Create sub-org using oidcToken Turnkey->>Backend: Return new subOrgId end Backend->>Turnkey: Call oauth_login with oidcToken, API publicKey Turnkey->>Backend: Return session JWT Backend->>Frontend: Return session JWT ``` The frontend generates an API keypair before starting the OAuth login flow. This keypair will later become the session keypair once the user is authenticated via Turnkey. The user begins the login process by clicking "Log in with \" on the frontend. When starting the OAuth request to the provider, the frontend sets the `nonce` to `sha256(publicKey)` based on the API public key. This binds the resulting OIDC token to the keypair. The OAuth provider prompts the user to grant permission to share their identity. Once approved, the OAuth provider returns an `oidcToken` to the frontend. The frontend sends the `oidcToken` and API public key to your backend. The backend gets subOrgIds that are associated with that `oidcToken`. If no sub-organization exists, it creates one using the identity in the token. The backend calls `oauth_login` with the `oidcToken`, and API public key. Turnkey validates that the token’s `nonce` matches `sha256(publicKey)` and returns a session JWT. The backend sends this JWT to the frontend. Your frontend now treats the API keypair as the session keypair. It can use the private key to sign requests to Turnkey using the `x-stamp` header. ### OAuth 2.0-only provider ```mermaid theme={"system"} sequenceDiagram participant User participant Frontend participant OAuth Provider participant Backend participant Turnkey User->>Frontend: Clicks "Log in with " Frontend->>OAuth Provider: Start OAuth flow OAuth Provider->>User: Prompt to grant permission User->>OAuth Provider: Grants permission OAuth Provider->>Frontend: User redirected to redirect_uri and delivered auth_code Frontend->>Backend: User calls with redirect_uri and auth_code Backend->>Turnkey: Send auth_code + redirect_uri via `OAuth2Authenticate` call Turnkey->>Backend: Return OIDC Token Backend->>Turnkey: Gets subOrgIds with that associated oidcToken Turnkey->>Backend: Return subOrgId (or null) alt SubOrgId not found Backend->>Turnkey: Create sub-org using oidcToken Turnkey->>Backend: Return new subOrgId end Backend->>Turnkey: Call oauth_login with oidcToken, API publicKey Turnkey->>Backend: Return session JWT Backend->>Frontend: Return session JWT ``` The frontend generates an API keypair before starting the OAuth login flow. This keypair will later become the session keypair once the user is authenticated via Turnkey. The user begins the login process by clicking "Log in with \" on the frontend. The frontend initiates the OAuth Authentication flow with the provider. The OAuth provider prompts the user to grant permission to share their identity. Once approved, the OAuth provider returns an `oidcToken` to the frontend. The provider delivers a short-lived auth\_code via the redirect\_uri. The backend exchanges the auth\_code + redirect\_uri for an OIDC ID Token using the `OAuth2Authenticate` activity. The backend gets subOrgIds that are associated with that `oidcToken`. If no sub-organization exists, it creates one using the identity in the token. The backend calls `oauth_login` with the `oidcToken`, and API public key. The backend sends this JWT to the frontend. NOTE: For this flow, the `nonce` is *not* required to match `sha256(publicKey)`. Your frontend now treats the API keypair as the session keypair. It can use the private key to sign requests to Turnkey using the `x-stamp` header. ## What does Turnkey use from the OIDC tokens to prove identity? Turnkey parses and validates the following fields from the OIDC token to confirm the user's identity: * `issuer` (iss) – The OAuth provider that issued the token (e.g., `https://accounts.google.com`) * `audience` (aud) – The OAuth app’s client ID * `subject` (sub) – The unique identifier for the user in the OAuth provider's system **Note:**\ Some OAuth providers (like Google) encourage you to register separate client IDs for each platform (e.g., web, iOS, Android). However, as discussed above, in the Turnkey flow the `aud` claim from the OIDC token is used as part of how sub-organizations are identified. If a user logs in on one platform using the web client ID, and then later logs in on another platform using a different iOS client ID, the two tokens will have different `aud` values. Because of this, Turnkey will not consider them the same identity. To ensure users are recognized consistently across platforms, you must either use the same OAuth web client ID everywhere, or register multiple platform identities using `oidcClaims` — see [Multi-platform OAuth identities](#multi-platform-oauth-identities) below. ## Multi-platform OAuth identities When a user authenticates on a different platform, their OIDC token will have a different `aud`, and Turnkey won't match it to their existing identity. `oidcClaims` lets you pre-register additional platform audiences without requiring a token for each one — you supply the `{ iss, sub, aud }` claims directly to register additional platform identities for the same user. ### How it works `oidcClaims` is available when creating sub-organizations, adding OAuth providers to existing users, or creating users. Each entry in `oauthProviders` accepts either an `oidcToken` or an `oidcClaims` object: ```typescript theme={"system"} // Verified — requires a signed token from the provider { providerName: "Google iOS", oidcToken: "eyJhbGci..." } // Verified via the accompanying oidcToken — register additional audiences directly { providerName: "Google Android", oidcClaims: { iss, sub, aud } } ``` ### Example A user signs up on iOS. You receive their OIDC token, decode the `sub` and `iss`, and register all three platform identities in a single `CREATE_SUB_ORGANIZATION` call: ```json theme={"system"} { "oauthProviders": [ { "providerName": "Google iOS", "oidcToken": "eyJhbGciOiJSUzI1NiIs..." }, { "providerName": "Google Android", "oidcClaims": { "iss": "https://accounts.google.com", "sub": "118121659617646047510", "aud": "com.yourapp.android" } }, { "providerName": "Google Web", "oidcClaims": { "iss": "https://accounts.google.com", "sub": "118121659617646047510", "aud": "com.yourapp.web" } } ] } ``` When the user later opens your Android or Web app and authenticates with Google, the identity is found and they're logged in. The same pattern works with `CREATE_OAUTH_PROVIDERS` to add platform identities to an existing user. ## OIDC token verification All OIDC tokens are verified inside of Turnkey's [secure enclaves](/security/secure-enclaves). We've designed a new secure enclave to fetch TLS content securely and bring [non-repudiation](https://en.wikipedia.org/wiki/Non-repudiation#In_digital_security) on top of TLS content: our TLS fetcher returns a URL and the fetched content, signed by the TLS fetcher's quorum key. By trusting the TLS fetcher quorum key, other Turnkey enclaves can bring TLS-fetched data into their computation safely. Verifying OIDC token is the first computation which requires this! To verify an OIDC token, other Turnkey enclaves receive the OIDC token as well as: * the signed content of the issuer's OpenId configuration. OpenId configuration **must** be hosted under `/.well-known/openid-configuration` for each domain. For Google for example, the issuer configuration is at [`accounts.google.com/.well-known/openid-configuration`](https://accounts.google.com/.well-known/openid-configuration). This JSON document contains, among other thing, a `jwksUri` key. The value for this key is a URL hosting the list of currently-valid OIDC token signers. * the signed content of the issuer's `jwksUri` (e.g., for Google, the `jwksUri` is [`googleapis.com/oauth2/v3/cert`](https://www.googleapis.com/oauth2/v3/certs)). This is a list of public keys against which the secure enclave can verify tokens. Note: **these public keys rotate periodically** (every \~6hrs), hence it's not possible to hardcode these public keys in our secure enclave code directly. We have to fetch them dynamically! With all of that, an enclave can independently verify an OIDC token without making outbound requests. Once the token is parsed and considered authentic, our enclaves match the `iss`, `aud` and `sub` attributes against the registered OAuth providers on the Turnkey sub-organization. We also check `exp` to make sure the OIDC token is not expired, and the `nonce` attribute (see next section). **Registration vs. login tokens** The token passed at registration (`createSubOrganization` or `createOauthProviders`) goes through the same enclave verification — signature checked against the issuer's JWKS — but its purpose is different: Turnkey extracts the `iss`, `sub`, and `aud` claims and stores them as the user's identity. The token itself is not retained. On every subsequent login, a fresh token is presented. Turnkey verifies its signature independently, then matches its `iss`, `sub`, and `aud` against the stored fingerprint to identify the user. The registration and login tokens are never compared to each other — what links them is the shared identity claims, not the tokens themselves. ## Nonce restrictions in OIDC tokens Our [`OAUTH_LOGIN`](https://docs.turnkey.com/api-reference/activities/login-with-oauth) activity requires 2 parameters minimum: * `oidcToken`: the base64 OIDC token * `publicKey`: the client-side public key generated by the user In order to prevent OIDC tokens from being used against multiple public keys, our enclaves parse the OIDC token and, as part of the validation logic, enforce that the `nonce` claim is set to `sha256(publicKey)`. For example, if the public key is `0394e549c71fa99dd5cf752fba623090be314949b74e4cdf7ca72031dd638e281a`, our enclaves expect the OIDC token nonce to be `1663bba492a323085b13895634a3618792c4ec6896f3c34ef3c26396df22ef82`. This restriction only applies during **authentication** (`OAUTH` activity). Registration via `CREATE_OAUTH_PROVIDER` and `CREATE_SUB_ORGANIZATION` activities is not affected since these activities do not accept a `publicKey` and do not return encrypted credentials as a result. If your OAuth provider does not allow you to customize `nonce` claims, Turnkey also accepts and validates `tknonce` claims. This is an alternative claim that will be considered. Only one of (`nonce`, `tknonce`) needs to be set to `sha256(publicKey)`; not both. ## OAuth vs. OIDC [OAuth2.0](https://datatracker.ietf.org/doc/html/rfc6749) is a separate protocol from [OIDC](https://openid.net/specs/openid-connect-core-1_0.html), with distinct goals: * "OAuth2.0" is an authorization framework * "OIDC" is an authentication framework We chose to name this feature "OAuth" because of the term familiarity: most Turnkey customers will have to setup an "OAuth" app with Google, and the user experience is often referred to as "OAuth" flows regardless of the protocol underneath. ## OIDC providers Below, some details and pointers about specific providers we've worked with before. If yours isn't listed below it does not mean it can't be supported: any OIDC provider should work with Turnkey's OAuth. ### Google This provider is extensively tested and supported. We've integrated it in our demo wallet (hosted at [https://wallet.tx.xyz](https://wallet.tx.xyz)), along with Apple and Facebook: OAuth demo wallet The code is open-source, feel free to [check it out](https://github.com/tkhq/demo-embedded-wallet) for reference. The exact line where the OAuth component is loaded is here: [ui/src/screens/LandingScreen.tsx](https://github.com/tkhq/demo-embedded-wallet/blob/d4ec308e9ce0bf0da7b64da2b39e1a80c077eb82/ui/src/screens/LandingScreen.tsx#L384). The main documentation for Google OIDC is available [here](https://github.com/tkhq/demo-embedded-wallet/blob/bf0e2292cbd2ee9cde6b241591b077fadf7ee71b/src/components/auth.tsx#L157). ### Apple Apple integration is also extensively tested and supported, and is integrated into our demo wallet (hosted at [https://wallet.tx.xyz](https://wallet.tx.xyz)). The code provides an [example component](https://github.com/tkhq/demo-embedded-wallet/blob/bf0e2292cbd2ee9cde6b241591b077fadf7ee71b/src/components/apple-auth.tsx) as well as an [example redirect handler](https://github.com/tkhq/demo-embedded-wallet/blob/bf0e2292cbd2ee9cde6b241591b077fadf7ee71b/src/app/\(landing\)/oauth-callback/apple/page.tsx). Documentation for Apple OIDC can be found [here](https://developer.apple.com/documentation/signinwithapple/authenticating-users-with-sign-in-with-apple). ### Facebook Facebook OIDC requires a [manual flow with PFKE](https://developers.facebook.com/docs/facebook-login/guides/advanced/oidc-token/) (Proof for Key Exchange). This flow requires a few extra steps compared with Apple or Google. Specifically: * You will need to generate a **code verifier** that can either be recalled (e.g. from a database) or reassembled in a later request. * You will need to provide a **code challenge** as a parameter of the OAuth redirect that is either the code verifier itself or the hash of the code verifier. * Instead of receiving the OIDC token after the OAuth flow, you will receive an **auth code** that must be exchanged for an OIDC token in a subsequent request. The code verifier and your app's ID are also required in this exchange. In our example demo wallet, we opt to avoid using a database in the authentication process and instead generate our verification code serverside using the hash of a nonce and a secret salt value. The nonce is then passed to and returned from the Facebook API as a **state** parameter (see [the API spec](https://developers.facebook.com/docs/facebook-login/guides/advanced/oidc-token/) for details). Finally, the server reconstructs the verification code by re-hashing the nonce and the the salt. The full flow is displayed below: Facebook OAuth flow Code for the [redirect component](https://github.com/tkhq/demo-embedded-wallet/blob/bf0e2292cbd2ee9cde6b241591b077fadf7ee71b/src/components/facebook-auth.tsx), [OAuth callback](https://github.com/tkhq/demo-embedded-wallet/blob/bf0e2292cbd2ee9cde6b241591b077fadf7ee71b/src/app/\(landing\)/oauth-callback/facebook/page.tsx), and [code exchange](https://github.com/tkhq/demo-embedded-wallet/blob/bf0e2292cbd2ee9cde6b241591b077fadf7ee71b/src/actions/turnkey.ts#L54) are all available in the example wallet repo. If you prefer to use a database such as Redis instead of reassembling the verification code, you can store the verification code and retrieve it in the exchange stage using a lookup key either passed as **state** or stored in local browser storage. ### Auth0 This provider was tested successfully and offers a wide range of authentication factors and integration. For example, Auth0 can wrap Twitter's auth or any other ["Social Connection"](https://marketplace.auth0.com/features/social-connections). In the testing process we discovered that Auth0 admins can manage users freely. Be careful about who can and can't access your Auth0 account: Auth0's management APIs allow for account merging. Specifically, anyone with a `users:update` scope token can call [this endpoint](https://auth0.com/docs/api/management/v2/users/post-identities) to arbitrarily link an identity. For example, if a Google-authenticated user (OIDC token `sub` claim: `google-oauth2|118121659617646047510`) gets merged into a Twitter-authenticated user (OIDC token `sub` claim: `twitter|47169608`), the OIDC token obtained by logging in through Google post-merge will be `twitter|47169608`. This can be surprising and lead to account takeover if an Auth0 admin is malicious. This is documented in Auth0's own docs, [here](https://auth0.com/docs/manage-users/user-accounts/user-account-linking#precautions). ### AWS Cognito Amazon Cognito supports the standard OIDC nonce parameter — you can supply a custom nonce value in the `/oauth2/authorize` request and Cognito will include it in the resulting ID token (as per [AWS documentation](https://docs.aws.amazon.com/cognito/latest/developerguide/authorization-endpoint.html)). ### Social linking Social linking is the concept of automatically linking an email address to a Turnkey user by authenticating with a social provider. This allows an end-user to authenticate with the social provider, or a matching email address. Currently, we only allow automatic linking for Google social logins. The cases are as follows: 1. The end-user authenticates with Google. Their email address is automatically linked to their authentication methods and considered “verified,” allowing them to log in with email OTP or email auth in the future. 2. The end-user authenticates with a Google email address (e.g., @gmail.com) via email OTP or email auth. If they later authenticate with Google, the Google OIDC provider will automatically be added as a valid login method, provided the email matches. 3. The end-user has existing non-Google authentication methods (e.g. phone number, passkeys, etc.) and later adds Google OIDC as a login method (via [CREATE\_OAUTH\_PROVIDERS](/api-reference/activities/create-oauth-providers#api-key)). The email address in the Google account will be automatically marked as "verified" and linked to the existing user. For more information on how to implement social linking, see the [social linking code example](/solutions/embedded-wallets/integration-guide/react/auth). ## Setup for OAuth 2.0-only providers ### Setting up X/Twitter Navigate to the [X developer portal](https://developer.twitter.com/en/portal/dashboard) and create/setup your app. In the **Keys and Tokens** section, you'll need to save your **Client ID** and **Client Secret** so that these values can be uploaded to Turnkey's servers: alt text #### Required scopes In order for Turnkey to access the `/2/users/me` endpoint, the following scopes must be set during Authorization: * `tweet.read` * `user.read` ### Setting up Discord Navigate to the [Discord developer portal](https://discord.com/developers) and create/setup your app. In the **General Information** section, you'll need to save your **Client ID** and **Client Secret** so that these values can be uploaded to Turnkey's servers: alt text #### Required scopes In order for Turnkey to access the `/api/users/@me` endpoint, the following scopes must be set during Authorization: * `identify` * `email` ### Client secret upload For every OAuth 2.0-Only Social Provider that you wish to integrate with, you must upload the **Client ID** and **Client Secret** issued by that Provider to Turnkey's Servers. In order to protect these sensitive credentials, they will be encrypted to the Quorum Key of the TLS Fetcher enclave, which ensures they cannot be accessed outside of that environment. You can upload these credentials through the Turnkey Dashboard. In the **Embedded Wallets → Configuration** section of the dashboard, head to the **OAuth 2.0** tab and click **Add Credential**. OAuth2.0 providers configuration Select the provider you want to add from the dropdown, and fill in the required fields. You can find these values in the provider's developer console. Any secrets will automatically be encrypted before uploading to Turnkey. Adding an OAuth2.0 provider Once uploaded, you can then use the **Credential Id** from the table shown to make requests to the `OAUTH2_AUTHENTICATE` activity. Facebook OAuth flow You can also see the example [here](https://github.com/tkhq/sdk/blob/main/examples/authentication/with-x/credential-upload.tsx) demonstrating how to encrypt and upload your client secrets using our SDK instead. ### Returning the encrypted bearer token When using OAuth 2.0-Only Social Providers, it is also possible to have the bearer token returned by the `OAuth2Authenticate` endpoint, which can be useful if you would like your app to have additional integrations involving this Social Provider. In order to guarantee the secure transfer of the bearer token, it must be encrypted to a P256 Encryption Key inside our secure enclave, returned to the caller, and then finally decrypted. Therefore, the return of the encrypted bearer token is dependent on the caller providing an optional `bearerTokenTargetPublicKey` parameter in the request to `OAuth2Authenticate`. An example demonstrating this flow can be seen [here](https://github.com/tkhq/sdk/blob/main/examples/authentication/with-x/src/app/auth/turnkey/x/route.ts). # Overview Source: https://docs.turnkey.com/features/ip-allowlisting/overview Restrict API access to your Turnkey organization based on the source IP address of incoming requests. IP Allowlist is a security feature that lets you define a set of trusted CIDR blocks (IP ranges) at the parent organization level, ensuring that only requests originating from known, authorized networks can reach your organization's API. This feature applies to the parent organization only; sub-organizations are not subject to IP allowlist enforcement and cannot configure their own allowlists. Applies to all API requests made to your organization, regardless of which API key is used. Acts as a global default. Applies only to requests authenticated with a specific API key. Overrides the organization-level allowlist for that key when present. This feature is ideal for: * Locking down production API keys to specific server IPs * Preventing API access from outside your organization's network * Enforcing per-key access controls across different environments ## Before you begin Enabling an organization-level allowlist with no CIDR rules configured will **block all API traffic**. Stage your rules with `enabled: false` first, verify they're correct, then set `enabled: true`. * **IP allowlisting applies to the parent organization only.** Sub-organizations do not inherit the parent's allowlist rules and cannot create their own. API requests that authenticate against a sub-organization are not evaluated against any IP allowlist. * **The org-level allowlist must be enabled for API key-level rules to take effect.** If the org-level allowlist is disabled, API key-level allowlists are not enforced. * **Dashboard actions are never subject to IP allowlisting.** You can always use the Dashboard to manage your configuration, even if you misconfigure your rules via API. * **Auth-proxy requests are exempt from IP allowlisting.** Requests signed by your organization's auth-proxy are not evaluated against allowlist rules. * **Unresolvable source IPs default to fail-closed.** In rare cases, intermediary infrastructure may prevent Turnkey from resolving a request's source IP. The `onEvaluationError` parameter controls whether these requests are allowed (fail-open) or denied (fail-closed). It defaults to `DENY`. **IP Allowlisting** is available to [**Enterprise clients**](https://www.turnkey.com/pricing) on the **Scale tier** or higher. If you would like to access this feature please reach out to your Turnkey representative. ## How it works Submit one or more CIDR blocks (e.g., `192.168.1.0/24`) with optional human-readable labels (e.g., `"Office VPN"`). When you're ready, set `enabled: true` to begin enforcement. Via the Dashboard, you can add rules and enable separately. Via the API, you can define rules and enable in a single `set_ip_allowlist` call — but we recommend staging rules with `enabled: false` first to verify your configuration. Any API request whose source IP does not fall within an allowed CIDR block is rejected automatically. Query the current allowlist with `get_ip_allowlist`, then resubmit the full updated rule set via `set_ip_allowlist`. There is no partial-update operation — each call fully replaces the existing rules. IP Allowlist operations follow Turnkey's [activity model](/features/transaction-management). Creating or removing an allowlist is an auditable activity that goes through policy evaluation and approval before execution. ## Organization-level vs. API key-level | Aspect | Organization-level | API key-level | | --------------------- | ---------------------------- | ---------------------------------------------- | | Scope | All API requests for the org | Requests using a specific API key only | | `publicKey` parameter | Omitted or `null` | Set to the API key's public key | | `enabled` parameter | Required (`true` or `false`) | Not applicable — always enforced if present | | Precedence | Default for all keys | Overrides the org-level allowlist for that key | | Limit | One per organization | One per API key | ### Precedence rules * The org-level allowlist **must be enabled** for API key-level allowlists to be evaluated. * If an API key has its own allowlist with one or more rules, only that key-level allowlist is checked for requests using that key. If the key-level allowlist exists but has no rules, evaluation falls back to the org-level allowlist. * If an API key does not have its own allowlist, the org-level allowlist is checked (if enabled). * If neither exists, requests are allowed from any IP. ## CIDR rules ### Format Both IPv4 and IPv6 are supported. The maximum prefix length is `/20` for IPv4 and `/48` for IPv6. | Format | Examples | | ------ | -------------------------------------------------------------- | | IPv4 | `10.0.0.0/20`, `192.168.1.0/24`, `203.0.113.42/32` (single IP) | | IPv6 | `2001:db8::/48`, `::1/128` (single IP) | CIDRs are normalized on submission — e.g., `192.168.1.100/24` becomes `192.168.1.0/24`. ### Labels Each rule accepts an optional `label` string for human-readable identification (e.g., `"Office VPN"`, `"Production Server"`). Labels are stored and returned in responses but have no effect on enforcement. ### Limits and validation * Maximum of **10 IPv4 CIDRs** and **10 IPv6 CIDRs** per allowlist (20 total) * Duplicate CIDRs within a single submission are automatically deduplicated — only the first occurrence and its label are kept * The `rules` array can be empty (creates an allowlist with no rules) * Invalid CIDRs are rejected with an error indicating the index and value that failed ### Replacement semantics `set_ip_allowlist` always **fully replaces** the existing rule set. To add a single rule without losing existing ones, first retrieve the current rules with `get_ip_allowlist`, append your new rule, then resubmit the complete list. ## API reference All endpoints use `HTTP POST` and require a signed request body stamped with your API key. | Endpoint | Description | | -------------------------------------------- | --------------------------------- | | `POST /public/v1/submit/set_ip_allowlist` | Create or update an IP allowlist | | `POST /public/v1/submit/remove_ip_allowlist` | Remove an IP allowlist | | `POST /public/v1/query/get_ip_allowlist` | Retrieve the current IP allowlist | ### Set IP allowlist Creates or updates an IP allowlist. If one already exists for the specified scope, it is fully replaced. ```json Request body theme={"system"} { "type": "ACTIVITY_TYPE_SET_IP_ALLOWLIST", "timestampMs": "", "organizationId": "", "parameters": { "rules": [ { "cidr": "", "label": "" } ], "enabled": true, "publicKey": "", "onEvaluationError": "DENY" } } ``` | Field | Type | Required | Description | | ------------------------------ | ------- | -------- | ---------------------------------------------------------------------------------- | | `type` | string | Yes | Must be `"ACTIVITY_TYPE_SET_IP_ALLOWLIST"` | | `timestampMs` | string | Yes | Current timestamp in milliseconds (epoch) — used for request liveness verification | | `organizationId` | string | Yes | Your parent organization ID | | `parameters.rules` | array | Yes | Array of allowlist rules. Can be empty. | | `parameters.rules[].cidr` | string | Yes | CIDR block (e.g., `"192.168.1.0/24"`, `"2001:db8::/48"`) | | `parameters.rules[].label` | string | No | Optional human-readable label (e.g., `"Office VPN"`) | | `parameters.enabled` | boolean | No | Whether the allowlist is enforced. Only meaningful for org-level policies. | | `parameters.publicKey` | string | No | Public key of an API key. If omitted, the allowlist applies at the org level. | | `parameters.onEvaluationError` | string | No | `"ALLOW"` or `"DENY"` — controls behavior when the source IP cannot be determined | ```json Response theme={"system"} { "activity": { "id": "", "organizationId": "", "status": "ACTIVITY_STATUS_COMPLETED", "type": "ACTIVITY_TYPE_SET_IP_ALLOWLIST", "intent": { "setIpAllowlistIntent": { "rules": [ { "cidr": "10.0.0.0/20", "label": "Office" }, { "cidr": "192.168.1.0/24", "label": "VPN" } ], "enabled": true } }, "result": { "setIpAllowlistResult": {} } } } ``` ### Remove IP allowlist Deletes an IP allowlist and all its associated rules. After removal, access falls back to the next applicable allowlist or is allowed from all IPs. ```json Request body theme={"system"} { "type": "ACTIVITY_TYPE_REMOVE_IP_ALLOWLIST", "timestampMs": "", "organizationId": "", "parameters": { "publicKey": "" } } ``` | Field | Type | Required | Description | | ---------------------- | ------ | -------- | ----------------------------------------------------------------------------------------------------- | | `type` | string | Yes | Must be `"ACTIVITY_TYPE_REMOVE_IP_ALLOWLIST"` | | `timestampMs` | string | Yes | Current timestamp in milliseconds (epoch) | | `organizationId` | string | Yes | Your parent organization ID | | `parameters.publicKey` | string | No | If omitted, removes the org-level allowlist. If set, removes the allowlist for that specific API key. | ### Get IP allowlist Retrieves the current IP allowlist and rules for an organization or specific API key. ```json Request body theme={"system"} { "organizationId": "", "publicKey": "" } ``` | Field | Type | Required | Description | | ---------------- | ------ | -------- | ------------------------------------------------------------------------------------------------- | | `organizationId` | string | Yes | Your parent organization ID | | `publicKey` | string | No | If provided, returns the allowlist for that API key. If omitted, returns the org-level allowlist. | ```json Response theme={"system"} { "allowlist": { "organizationId": "", "publicKey": "", "enabled": true, "rules": [ { "cidr": "10.0.0.0/20", "label": "Office", "createdAt": "1717000000000" }, { "cidr": "192.168.1.0/24", "label": "VPN", "createdAt": "1717000000000" } ] } } ``` If the allowlist has been removed, `get_ip_allowlist` returns an `allowlist` object with an empty `rules` array. ### Data types #### `IpAllowlistRule` (response) | Field | Type | Required | Description | | ----------- | ------ | -------- | ---------------------------------------------- | | `cidr` | string | Yes | CIDR block | | `label` | string | No | Human-readable label (empty string if not set) | | `createdAt` | string | No | Creation timestamp as millisecond epoch string | #### `IpAllowlist` (response) | Field | Type | Required | Description | | ---------------- | ------------------- | -------- | --------------------------------------------------------------------- | | `organizationId` | string | Yes | The organization this allowlist belongs to | | `publicKey` | string | No | The API key this applies to. `null` for org-level policies. | | `enabled` | boolean | No | Whether the allowlist is active. Only present for org-level policies. | | `rules` | `IpAllowlistRule[]` | Yes | Array of allowlist rules | ## Code examples ```shell theme={"system"} curl -X POST https://api.turnkey.com/public/v1/submit/set_ip_allowlist \ -H "Content-Type: application/json" \ -H "X-Stamp: " \ -d '{ "type": "ACTIVITY_TYPE_SET_IP_ALLOWLIST", "timestampMs": "1717000000000", "organizationId": "", "parameters": { "enabled": true, "rules": [ { "cidr": "10.0.0.0/20", "label": "Office" }, { "cidr": "192.168.1.0/24", "label": "VPN" } ] } }' ``` ```shell theme={"system"} curl -X POST https://api.turnkey.com/public/v1/submit/set_ip_allowlist \ -H "Content-Type: application/json" \ -H "X-Stamp: " \ -d '{ "type": "ACTIVITY_TYPE_SET_IP_ALLOWLIST", "timestampMs": "1717000000000", "organizationId": "", "parameters": { "publicKey": "", "rules": [ { "cidr": "10.0.1.0/24", "label": "Production Server" } ] } }' ``` ```shell theme={"system"} curl -X POST https://api.turnkey.com/public/v1/query/get_ip_allowlist \ -H "Content-Type: application/json" \ -H "X-Stamp: " \ -d '{ "organizationId": "" }' ``` Since `set_ip_allowlist` always replaces all rules, adding a single rule requires fetching first, then resubmitting the full list. ```shell theme={"system"} # 1. Get the current allowlist curl -X POST https://api.turnkey.com/public/v1/query/get_ip_allowlist \ -H "Content-Type: application/json" \ -H "X-Stamp: " \ -d '{ "organizationId": "" }' # 2. Resubmit with existing rules + new rule appended curl -X POST https://api.turnkey.com/public/v1/submit/set_ip_allowlist \ -H "Content-Type: application/json" \ -H "X-Stamp: " \ -d '{ "type": "ACTIVITY_TYPE_SET_IP_ALLOWLIST", "timestampMs": "1717000000000", "organizationId": "", "parameters": { "enabled": true, "rules": [ { "cidr": "10.0.0.0/20", "label": "Office" }, { "cidr": "192.168.1.0/24", "label": "VPN" }, { "cidr": "203.0.113.0/24", "label": "New Rule" } ] } }' ``` ```shell theme={"system"} curl -X POST https://api.turnkey.com/public/v1/submit/remove_ip_allowlist \ -H "Content-Type: application/json" \ -H "X-Stamp: " \ -d '{ "type": "ACTIVITY_TYPE_REMOVE_IP_ALLOWLIST", "timestampMs": "1717000000000", "organizationId": "", "parameters": {} }' ``` # Aptos support on Turnkey Source: https://docs.turnkey.com/features/networks/aptos ## Address derivation Turnkey supports Aptos address derivation with `ADDRESS_TYPE_APTOS`. Aptos addresses are derived from the Ed25519 curve, which Turnkey fully supports. ## Transaction construction and signing Turnkey supports Aptos transaction signing through our core signing capabilities. We have an example repository that demonstrates how to construct and sign Aptos transactions: * [`examples/chain-integrations/with-aptos`](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-aptos): demonstrates transaction construction and broadcast on Aptos. ## Example Here's a comprehensive example showing how to integrate Turnkey with the Aptos SDK for transaction signing: ```typescript theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; import { AptosClient, AptosAccount, TxnBuilderTypes, BCS, TransactionBuilder, HexString, } from "aptos"; // Custom Turnkey signer for Aptos class TurnkeyAptosSigner { private turnkeyClient: Turnkey; private aptosClient: AptosClient; private address: string; private organizationId: string; constructor( apiPrivateKey: string, apiPublicKey: string, organizationId: string, address: string, nodeUrl: string = "https://fullnode.mainnet.aptoslabs.com/v1" ) { this.turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPrivateKey, apiPublicKey, defaultOrganizationId: organizationId, }); this.aptosClient = new AptosClient(nodeUrl); this.address = address; this.organizationId = organizationId; } // Get the account address getAddress(): string { return this.address; } // Sign a transaction using Turnkey async signTransaction( rawTxn: TxnBuilderTypes.RawTransaction ): Promise { // Serialize the raw transaction to BCS const serializer = new BCS.Serializer(); rawTxn.serialize(serializer); const toSign = serializer.getBytes(); // Sign the serialized transaction with Turnkey const signResult = await this.turnkeyClient.signRawPayload({ organizationId: this.organizationId, signWith: this.address, payload: Buffer.from(toSign).toString("hex"), encoding: "hex", }); // Return the signed transaction bytes return Buffer.from(signResult.signature, "hex"); } // Submit a transaction async submitTransaction(payload: any): Promise { try { // Create a raw transaction from the payload const rawTxn = await this.createRawTransaction(payload); // Sign the transaction const signature = await this.signTransaction(rawTxn); // Get the authenticator const authenticator = new TxnBuilderTypes.TransactionAuthenticatorEd25519( new TxnBuilderTypes.Ed25519PublicKey( // Note: In a real implementation, you would need to get the actual public key new Uint8Array(32) // Placeholder - replace with actual public key ), new TxnBuilderTypes.Ed25519Signature(signature) ); // Create a signed transaction const signedTxn = new TxnBuilderTypes.SignedTransaction( rawTxn, authenticator ); // Submit the transaction const pendingTxn = await this.aptosClient.submitSignedBCSTransaction( BCS.bcsToBytes(signedTxn) ); return pendingTxn.hash; } catch (error) { console.error("Error submitting transaction:", error); throw error; } } // Helper method to create a raw transaction private async createRawTransaction( payload: any ): Promise { const account = await this.aptosClient.getAccount(this.address); const chainId = await this.aptosClient.getChainId(); // Create a raw transaction return new TxnBuilderTypes.RawTransaction( TxnBuilderTypes.AccountAddress.fromHex(this.address), BigInt(account.sequence_number), payload, BigInt(2000), // Max gas amount BigInt(100), // Gas unit price BigInt(Math.floor(Date.now() / 1000) + 30), // Expiration timestamp (30 seconds from now) new TxnBuilderTypes.ChainId(chainId) ); } } // Example usage: Transfer coins async function transferCoins() { const signer = new TurnkeyAptosSigner( process.env.API_PRIVATE_KEY!, process.env.API_PUBLIC_KEY!, process.env.ORGANIZATION_ID!, process.env.APTOS_ADDRESS!, // Your Aptos address in Turnkey "https://fullnode.testnet.aptoslabs.com/v1" // Testnet URL ); const recipientAddress = "0x..."; // Recipient address const amount = 1000000; // Amount in octas (1 APT = 100,000,000 octas) // Create a transfer transaction payload const payload = new TxnBuilderTypes.TransactionPayloadEntryFunction( TxnBuilderTypes.EntryFunction.natural( "0x1::coin", "transfer", [ new TxnBuilderTypes.TypeTagStruct( TxnBuilderTypes.StructTag.fromString("0x1::aptos_coin::AptosCoin") ), ], [ BCS.bcsToBytes( TxnBuilderTypes.AccountAddress.fromHex(recipientAddress) ), BCS.bcsSerializeUint64(amount), ] ) ); try { const txnHash = await signer.submitTransaction(payload); console.log(`Transaction submitted successfully! Hash: ${txnHash}`); return txnHash; } catch (error) { console.error("Error transferring coins:", error); throw error; } } ``` ## Aptos network support Turnkey supports: * Aptos Mainnet * Aptos Testnet * Aptos Devnet ## Key features for Aptos * **Ed25519 Signing**: Turnkey fully supports the Ed25519 curve used by Aptos * **BCS Format Support**: Sign transactions serialized in the Binary Canonical Serialization format * **Integration Example**: Our example repository provides a reference implementation for integrating with the Aptos ecosystem ## Benefits of using Turnkey with Aptos * **Secure Key Management**: Private keys are securely stored in Turnkey's infrastructure * **Policy Controls**: Apply custom policies to authorize transactions based on criteria * **Developer-Friendly**: Integrate with existing Aptos development workflows * **Multi-environment Support**: Use the same code across testnet and mainnet environments ## Move development Aptos utilizes the Move programming language for smart contracts. When developing Move smart contracts on Aptos, Turnkey can securely manage your private keys for: * Deploying Move modules * Executing Move functions * Managing account resources If you're building on Aptos and need assistance with your Turnkey integration, feel free to contact us at [hello@turnkey.com](mailto:hello@turnkey.com), on [X](https://x.com/turnkeyhq/), or [on Slack](https://join.slack.com/t/clubturnkey/shared_invite/zt-3aemp2g38-zIh4V~3vNpbX5PsSmkKxcQ). # Bitcoin support on Turnkey Source: https://docs.turnkey.com/features/networks/bitcoin ## BIP32 and BIP44: the basis for Turnkey wallets [BIP32](https://en.bitcoin.it/wiki/BIP_0032) and [BIP44](https://en.bitcoin.it/wiki/BIP_0044) are standards developed in the Bitcoin ecosystem. Turnkey closely follows this to power [Wallets](/features/wallets) since they're adopted within Bitcoin and outside, spanning many other ecosystems. ## BIP39: mnemonics Turnkey supports importing and exporting keys in mnemonics form, following [BIP39](https://en.bitcoin.it/wiki/BIP_0039). This standard is now a de-facto standard across virtually all blockchains today. ## Address derivation You can derive Bitcoin addresses when creating a Turnkey wallet or private key. The address types we support currently: * P2PKH (Pay-To-Public-Key-Hash) * P2SH (Pay-To-Script-Hash) * P2WPKH (Pay-to-Witness-Public-Key-Hash) -- [segwit-enabled](https://learnmeabitcoin.com/technical/upgrades/segregated-witness/) * P2WSH (Pay-to-Witness-Script-Hash) -- [segwit-enabled](https://learnmeabitcoin.com/technical/upgrades/segregated-witness/) * P2TR (Pay-to-Taproot) -- [taproot-enabled](https://learnmeabitcoin.com/technical/upgrades/taproot/) Bitcoin addresses change depending on the network you're using (more precisely, their prefix!). When you derive an address the network will be part of the address format. We support the following networks: * Mainnet (`MAINNET`) * Testnet (`TESTNET`) * Regtest (`REGTEST`) * Signet (`SIGNET`) For example: * To derive a P2TR address on testnet, use `ADDRESS_FORMAT_BITCOIN_TESTNET_P2TR`. * To derive a P2SH address on mainnet, use `ADDRESS_FORMAT_BITCOIN_MAINNET_P2SH`. ## Schnorr signatures and tweaks The historical signature scheme for Bitcoin is [ECDSA](https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm). Turnkey supports ECDSA of course, but we also support [Schnorr signatures](https://en.wikipedia.org/wiki/Schnorr_signature) for Taproot addresses. To sign with Schnorr, pass a taproot (P2TR) address inside of your activity's `signWith` parameter. Turnkey's signer will switch to Schnorr and apply the correct cryptographic [tweak](https://github.com/bitcoin/bips/blob/master/bip-0341.mediawiki#constructing-and-spending-taproot-outputs) before signing. ## Policy-enabled Bitcoin transaction signing Turnkey has built a Bitcoin transaction parser which runs in a secure enclave, to enable Bitcoin-based policies in the policy engine. To enable more policy engine use cases, and facilitate transaction construction completely, policy-enabled Bitcoin transactions requires passing a hex serialized representation of a Partially Signed Bitcoin Transaction (PSBT) to our `SIGN_TRANSACTION` endpoint using the transaction type `TRANSACTION_TYPE_BITCOIN`. ### What are PSBTs and why do we use them? Partially Signed Bitcoin Transaction or PSBT is a data format for passing around Bitcoin transactions to signing services. The PSBT format contains raw unsigned transaction data, along with extra “context” data required to get the transaction signed. Most modern wallets support and use PSBTs for transaction signing. For Turnkey’s policy-enabled Bitcoin transaction signing flow, PSBTs provide the context needed for the policy engine to make decisions based on transaction content, to generate the actual payloads that need to be signed (sighashes), and to reinsert those signed sighashes in the correct place. For more information on PSBTs look here: [https://learnmeabitcoin.com/technical/transaction/psbt/](https://learnmeabitcoin.com/technical/transaction/psbt/) ### How to use Turnkey’s policy-enabled Bitcoin transaction signing flow The transaction signing flow works as follows: * Client creates Bitcoin policies for enabling or restriction transaction signing using the `bitcoin.tx` namespace. For reference look at the Policy Launguage documentation [language section](/features/policies/language#bitcoin) or the [Bitcoin policy examples](/features/policies/examples/bitcoin) documentation * Client constructs a PSBT (using a library like bitcoinjs-lib\[[https://github.com/bitcoinjs/bitcoinjs-lib](https://github.com/bitcoinjs/bitcoinjs-lib)]) representing the transaction they need signed, hex serializes it and passes in the string of the hex representation of the PSBT into Turnkey’s Sign Transaction endpoint with type: `TRANSACTION_TYPE_BITCOIN` * The `SIGN TRANSACTION` endpoint constructs the sighashes ONLY for inputs which are to be signed by the signing resource which was specified in the `SIGN TRANSACTION` request, and based on policy evaluation, signs these sighashes and reinserts them into the correct corresponding inputs in the PSBT. For more details on how reinsertion works across each address derivation type, look below. * Client receives hex representation of PSBT with reinserted signatures, continues signing process for other inputs if needed, finalizes inputs, and broadcasts. Note: Turnkey does NOT automatically finalize transactions for you. Turnkey will generate the sighashes for ALL inputs to be signed by the signing resource provided, sign the sighashes, reinsert the signed sighashes into the PSBT (as described in detail for each address derviation type below), and provide the updated PSBT back to the user as the signed payload WITHOUT finalizing. Moreover, if the PSBT represents a transaction that requires signing with a Turnkey signing resource, but is a non-supported signing use case (like a P2SH wrapped transaction input or a P2TR script path signing input), the transaction will be rejected! Before using Turnkey's policy-enabled `SIGN_TRANSACTION` flow, read the below PSBT requirements and assumptions to make sure that we support your specific use-case! ### Technical specifics on Turnkey's Bitcoin transaction signing support For each chain with policy engine support, Turnkey's `SIGN TRANSACTION` API endpoint provides the experience of transaction signing and reinsertion - where the transaction is signed by the specified signing resource and reinserted into the provided transaction as per the rules of the chain in question. With Bitcoin, given the plethora of different locking and unlocking scripts that are possible, Turnkey has currently limited the scope of support of the SIGN TRANSACTION endpoint to the single standard flow for each of the following address derivation types: P2PKH, P2SH, P2WPKH, P2WSH and P2TR. We also assume the most common or default sighash type for each address derivation type (`SIGHASH_TYPE_ALL` for P2PKH, P2SH, P2WPKH and P2WSH and `SIGHASH_TYPE_DEFAULT` for P2TR) Notably, we do not support sighash generation and reinsertion according to wrapped types like P2SH-P2WPKH and P2SH-P2WSH, or for Taproot (P2TR) script path signing (only Taproot key path signing is currently supported). Note: If you are implementing Bitcoin transaction signing for one of the above use-cases involving signing wrapped inputs like P2SH-P2WPKH or P2SH-P2WSH, or for P2TR script path signing, or with the usage of a non-standard sighash type you can use the `SIGN_RAW_PAYLOAD` endpoint to sign pre-generated sighashes, and use a library like bitcoinjs-lib\[[https://github.com/bitcoinjs/bitcoinjs-lib](https://github.com/bitcoinjs/bitcoinjs-lib)] to handle sighash generation and reinsertion as per your use-case. For specific technical context on how Turnkey does reinsertion across address types: #### P2PKH, P2SH, P2WPKH, P2WSH PSBT Input Requirements for Legacy and Segwit * We assume usage of Sighash Type SIGHASH\_TYPE\_ALL for all Legacy and Segwit inputs * For Legacy inputs (P2PKH, P2SH), we require that the `non_witness_utxo` field of the corresponding input IS populated, and the `witness_utxo` field IS NOT populated * For Segwit inputs (P2WPKH, P2WSH), we require that the `witness_utxo` field of the corresponding input IS populated, and the `non_witness_utxo` field IS NOT populated * For P2SH inputs, we require that the `redeem_script` field of the corresponding input IS populated * For P2WSH inputs, we require that the `witness_script` field of the corresponding input IS populated For Legacy and Segwit Bitcoin address derivation types, for each input corresponding to the Turnkey signing resource specified in the `SIGN TRANSACTION` call, Turnkey constructs the DER encoded signature of the sighash and reinserts it into the Partial Signatures field of each relevant input in the PSBT, corresponding to the public key of the signing resource. NOTE: For constructing and reinserting sighashes for Legacy and Segwith Bitcoin address derivation types, by default, we use the sighash type `SIGHASH_ALL` as is the convention for these types. Context on Sighash types, conventions, and how it affects signing can be found on Learn Me a Bitcoin’s signature page: [https://learnmeabitcoin.com/technical/keys/signature/](https://learnmeabitcoin.com/technical/keys/signature/) #### P2TR PSBT Input Requirements for Taproot * We assume usage of Sighash Type SIGHASH\_TYPE\_DEFAULT for all Taproot inputs * For Taproot inputs we require that the `witness_utxo` field of the corresponding input IS populated, and the `non_witness_utxo` field IS NOT populated * For Taproot inputs we support key path signing, and NOT script path signing and require that the `tap_scripts`, `tap_merkle_root` and `tap_script_sigs` fields ARE NOT populated Turnkey supports transaction reinsertion Bitcoin transactions with P2TR inputs for Key Path signing ONLY. At the moment we do not support reinsertion for Taproot script path signing. For Taproot Key Path signing, for each input corresponding to the Turnkey signing resource specified in the `SIGN TRANSACTION` call, Turnkey constructs the schnorr signature of the sighash and reinserts it into the Taproot Key Spend Signature field of each relevant input in the PSBT. NOTE: For constructing and reinserting sighashes for Taproot Bitcoin address derivation types, by default, we use the sighash type `SIGHASH_DEFAULT` type as is the convention. Context on signing, and sighash conventions for Taproot can be found on Learn Me a Bitcoin’s Taproot page: [https://learnmeabitcoin.com/technical/upgrades/taproot/](https://learnmeabitcoin.com/technical/upgrades/taproot/) ## SDK example If you want to get started with Bitcoin we encourage you to look at the following SDK example: [`examples/chain-integrations/with-bitcoin`](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-bitcoin). It showcases transaction construction and signing with [`bitcoinjs-lib`](https://github.com/bitcoinjs/bitcoinjs-lib), a widely used JS library. This demo also contains a [policy-gated signing flow](https://github.com/tkhq/sdk/blob/main/examples/chain-integrations/with-bitcoin/src/signBtcTxWithPolicy.ts) that creates a Turnkey policy restricting Bitcoin transactions to an allowlisted receiving address and then signs a PSBT as a non-root user subject to that policy. Let us know if you're interested in using it. We have not yet published it as a standalone NPM package, but could do it if we hear enough interest! # Canton support on Turnkey Source: https://docs.turnkey.com/features/networks/canton ## Address derivation Canton identities are derived from the Ed25519 curve, which Turnkey fully supports. Rather than deriving a single chain-specific address, Canton uses a two-step process: Turnkey generates an Ed25519 key pair (using `ADDRESS_FORMAT_COMPRESSED` with `CURVE_ED25519`), and the resulting public key is then registered with a specific Canton network node. Registration creates a new **Party** and returns its `PartyId` along with a Canton-internal fingerprint of your public key. The party participates in network activity by identifying itself with its `PartyId` and fingerprint. Note that a party is not a global concept (unlike e.g. ENS) — it lives only on the node where it was registered. ## Transaction construction and signing Turnkey supports Canton transaction signing through our core signing capabilities, using the `SignRawPayload` endpoint to sign transaction hashes with Ed25519. We have an example repository that demonstrates how to construct and sign Canton transactions: * [`examples/chain-integrations/with-canton`](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-canton): demonstrates party registration, transaction construction and broadcast on Canton. ## Example Here's a comprehensive example showing how to register a party and sign a Canton transaction with Turnkey: ```typescript theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; import { Curve } from "@turnkey/core"; import { uint8ArrayFromHexString } from "@turnkey/encoding"; import { createLedgerApiClient } from "@/api/ledger/client"; import { v7 as uuidv7 } from "uuid"; // Initialize the Turnkey client const turnkey = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPrivateKey: process.env.API_PRIVATE_KEY!, apiPublicKey: process.env.API_PUBLIC_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const client = turnkey.apiClient(); // A Canton Ledger API client (local sandbox, or a live node via CANTON_LEDGER_API_URL) const ledgerClient = createLedgerApiClient({ baseUrl: process.env.CANTON_LEDGER_API_URL || "http://localhost:6864", }); // 1/ Create a wallet with an Ed25519 account. // Canton keys use ADDRESS_FORMAT_COMPRESSED on the Ed25519 curve. const { walletId } = await client.createWallet({ walletName: "Canton Wallet", accounts: [ { curve: Curve.ED25519, pathFormat: "PATH_FORMAT_BIP32", path: "m/44'/0'/0'/0/0", addressFormat: "ADDRESS_FORMAT_COMPRESSED", }, ], }); const { accounts } = await client.getWalletAccounts({ walletId }); const ed25519Account = accounts.find(({ curve }) => curve === Curve.ED25519)!; // 2/ Register the public key with a Canton node to create a Party. const { data: synchronizersData } = await ledgerClient.GET( "/v2/state/connected-synchronizers", ); const synchronizerId = synchronizersData!.connectedSynchronizers![0].synchronizerId; const keyData = Buffer.from(ed25519Account.publicKey!, "hex").toString("base64"); const { data: partyTopology } = await ledgerClient.POST( "/v2/parties/external/generate-topology", { body: { synchronizer: synchronizerId, partyHint: `party-${uuidv7()}`, publicKey: { keySpec: "SIGNING_KEY_SPEC_EC_CURVE25519", format: "CRYPTO_KEY_FORMAT_RAW", keyData, }, }, }, ); // Sign the topology multi-hash with Turnkey. Ed25519 signatures are the // concatenation of r and s (there is no v component). const multiHashPayload = Buffer.from( partyTopology!.multiHash, "base64", ).toString("hex"); const signedMultiHash = await client.signRawPayload({ signWith: ed25519Account.address, payload: multiHashPayload, encoding: "PAYLOAD_ENCODING_HEXADECIMAL", hashFunction: "HASH_FUNCTION_NOT_APPLICABLE", }); const multiHashSignature = uint8ArrayFromHexString( signedMultiHash.r + signedMultiHash.s, ); // Allocate the party on the node. The topology result includes your PartyId // and the Canton-internal fingerprint of your public key. await ledgerClient.POST("/v2/parties/external/allocate", { body: { waitForAllocation: true, synchronizer: synchronizerId, onboardingTransactions: partyTopology!.topologyTransactions.map( (transaction) => ({ transaction }), ), multiHashSignatures: [ { format: "SIGNATURE_FORMAT_CONCAT", signature: Buffer.from(multiHashSignature).toString("base64"), signedBy: partyTopology!.publicKeyFingerprint, signingAlgorithmSpec: "SIGNING_ALGORITHM_SPEC_ED25519", }, ], }, }); const partyId = partyTopology!.partyId; // 3/ Create a user associated with the party. const userId = `user-${uuidv7()}`; await ledgerClient.POST("/v2/users", { body: { user: { id: userId, partyId } }, }); // 4/ Prepare a transaction, then sign its hash with Turnkey. const { data: prepared } = await ledgerClient.POST( "/v2/interactive-submission/prepare", { body: { commandId: `command-${uuidv7()}`, synchronizerId, userId, actAs: [partyId], hashingSchemeVersion: "HASHING_SCHEME_VERSION_V3", commands: [ // ...your Daml commands, e.g. a CreateCommand on a template ], }, }, ); // The Canton API returns a prepared transaction hash (base64). Convert it to // hex and sign it with Turnkey (no additional hashing needed here). const preparedTransactionHash = prepared!.preparedTransactionHash; // base64 const txPayload = Buffer.from(preparedTransactionHash, "base64").toString("hex"); const signedTx = await client.signRawPayload({ signWith: ed25519Account.address, payload: txPayload, encoding: "PAYLOAD_ENCODING_HEXADECIMAL", hashFunction: "HASH_FUNCTION_NOT_APPLICABLE", }); const txSignature = uint8ArrayFromHexString(signedTx.r + signedTx.s); // 5/ Execute the signed transaction. await ledgerClient.POST( "/v2/interactive-submission/executeAndWaitForTransaction", { body: { preparedTransaction: prepared!.preparedTransaction, submissionId: `submission-${uuidv7()}`, userId, hashingSchemeVersion: "HASHING_SCHEME_VERSION_V3", deduplicationPeriod: { Empty: {} }, partySignatures: { signatures: [ { party: partyId, signatures: [ { format: "SIGNATURE_FORMAT_CONCAT", signature: Buffer.from(txSignature).toString("base64"), signedBy: partyTopology!.publicKeyFingerprint, signingAlgorithmSpec: "SIGNING_ALGORITHM_SPEC_ED25519", }, ], }, ], }, }, }, ); ``` ## Canton network support Because there is no public Canton testnet, Turnkey's signing works against: * A local Canton network (spun up via `docker compose` / `dpm sandbox`) * A live Canton node (pointed to via the `CANTON_LEDGER_API_URL` environment variable) ## Key features for Canton * **Ed25519 Signing**: Turnkey fully supports the Ed25519 curve used by Canton * **External party registration**: Register your Turnkey-managed public key with a Canton node to obtain a `PartyId` and fingerprint * **Interactive submission support**: Sign prepared transaction hashes for both v2 and v3 hashing schemes * **Integration Example**: Our example repository provides a reference implementation for integrating with the Canton ecosystem ## Benefits of using Turnkey with Canton * **Secure Key Management**: Private keys are securely stored in Turnkey's infrastructure * **Policy Controls**: Apply custom policies to authorize signing based on criteria * **Developer-Friendly**: Integrate with existing Canton development workflows * **Multi-environment Support**: Use the same code across a local sandbox and live nodes ## Daml development Canton applications are written in the Daml smart contract language. When building Daml applications on Canton, Turnkey can securely manage your private keys for: * Deploying DARs (Daml Archive packages) * Executing commands on Daml contracts * Managing external party identities If you're building on Canton and need assistance with your Turnkey integration, feel free to contact us at [hello@turnkey.com](mailto:hello@turnkey.com), on [X](https://x.com/turnkeyhq/), or [on Slack](https://join.slack.com/t/clubturnkey/shared_invite/zt-3aemp2g38-zIh4V~3vNpbX5PsSmkKxcQ). # Cardano support on Turnkey Source: https://docs.turnkey.com/features/networks/cardano ## Address derivation Cardano support is at the **curve level**: Turnkey holds an Ed25519 key pair (`ADDRESS_FORMAT_COMPRESSED` with `CURVE_ED25519`) and returns the public key, from which you derive the Cardano address **client-side** (the payment credential is the Blake2b-224 hash of the public key). The example below uses [MeshJS](https://meshjs.dev/), but any Cardano library works. ## Transaction construction and signing Turnkey supports Cardano transaction signing through our core signing capabilities, using the `SignRawPayload` endpoint to sign the transaction body hash with Ed25519. Construction, fee calculation, and submission are handled by your Cardano library of choice — the example below uses [MeshJS](https://meshjs.dev/). We have an example repository that demonstrates how to construct and sign Cardano transactions: * [`examples/chain-integrations/with-cardano`](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-cardano): demonstrates address derivation, transaction construction, and broadcast on Cardano. ## Example Here's a practical example showing how to derive an address, then build, sign, and submit a Cardano transaction with Turnkey: ```typescript theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; import { MeshTxBuilder, KoiosProvider } from "@meshsdk/core"; import { EnterpriseAddress, CredentialType, Hash28ByteBase16, VkeyWitness, TransactionWitnessSet, Ed25519PublicKeyHex, Ed25519SignatureHex, Serialization, resolveTxHash, addVKeyWitnessSetToTransaction, } from "@meshsdk/core-cst"; import { blake2b } from "@noble/hashes/blake2b"; import { bytesToHex } from "@noble/hashes/utils"; // CARDANO_PUBLIC_KEY is your Turnkey Ed25519 account's public key (hex); for an // ADDRESS_FORMAT_COMPRESSED account it doubles as `signWith`. const { ORGANIZATION_ID, API_PUBLIC_KEY, API_PRIVATE_KEY, CARDANO_PUBLIC_KEY } = process.env; // Address network id: 1 = mainnet, 0 = any testnet (preprod/preview). const NETWORK = "preprod"; // "preprod" | "preview" | "mainnet" const NETWORK_ID = NETWORK === "mainnet" ? 1 : 0; const turnkey = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPrivateKey: API_PRIVATE_KEY!, apiPublicKey: API_PUBLIC_KEY!, defaultOrganizationId: ORGANIZATION_ID!, }); const client = turnkey.apiClient(); // Koios: a free, public Cardano API (no signup). "api" = mainnet. const provider = new KoiosProvider(NETWORK === "mainnet" ? "api" : NETWORK); async function main() { // Derive the enterprise address client-side (Blake2b-224 of the public key). const pubKeyBytes = Buffer.from(CARDANO_PUBLIC_KEY!, "hex"); const paymentKeyHash = bytesToHex(blake2b(pubKeyBytes, { dkLen: 28 })); const cardanoAddress = EnterpriseAddress.fromCredentials(NETWORK_ID, { hash: Hash28ByteBase16(paymentKeyHash), type: CredentialType.KeyHash, }) .toAddress() .toBech32() .toString(); // Build an unsigned transaction (1 ADA back to ourselves). const utxos = await provider.fetchAddressUTxOs(cardanoAddress); const txBuilder = new MeshTxBuilder({ fetcher: provider, submitter: provider, }); const unsignedTx = await txBuilder .setNetwork(NETWORK) .txOut(cardanoAddress, [{ unit: "lovelace", quantity: "1000000" }]) .changeAddress(cardanoAddress) .selectUtxosFrom(utxos) .complete(); // Sign the tx body hash with Turnkey. Ed25519 does not pre-hash, so use // HASH_FUNCTION_NOT_APPLICABLE; signWith is the account key, not the address. const txBodyHash = resolveTxHash(unsignedTx); const { r, s } = await client.signRawPayload({ signWith: CARDANO_PUBLIC_KEY!, payload: txBodyHash, encoding: "PAYLOAD_ENCODING_HEXADECIMAL", hashFunction: "HASH_FUNCTION_NOT_APPLICABLE", }); // Assemble the vkey witness (signature is r + s, no v) and attach it. const vkeyWitness = new VkeyWitness( Ed25519PublicKeyHex(CARDANO_PUBLIC_KEY!), Ed25519SignatureHex(r + s), ); const witnessSet = new TransactionWitnessSet(); witnessSet.setVkeys( Serialization.CborSet.fromCore( [vkeyWitness.toCore()], VkeyWitness.fromCore, ), ); const signedTx = addVKeyWitnessSetToTransaction( unsignedTx, witnessSet.toCbor(), ); // Submit the signed transaction. const submittedTxHash = await provider.submitTx(signedTx); console.log("Transaction submitted:", submittedTxHash); } main().catch((err) => { console.error("Error:", err); process.exit(1); }); ``` ## Cardano network support A Cardano address encodes only a **network id** — `1` for mainnet, `0` for *any* testnet — so preprod and preview share the same id. The specific network is chosen by your provider and the builder's `setNetwork`: | Network | Builder `setNetwork` | Address `NETWORK_ID` | | --------------- | -------------------- | -------------------- | | Mainnet | `mainnet` | `1` | | Preprod testnet | `preprod` | `0` | | Preview testnet | `preview` | `0` | ## Key features for Cardano * **Ed25519 Signing**: Turnkey fully supports the Ed25519 curve used by Cardano * **Client-side address derivation**: Derive enterprise or base addresses from your Turnkey-managed public key using any Cardano library * **Raw Transaction Signing**: Sign any Cardano transaction format by signing its Blake2b-256 body hash * **Integration Example**: Our example repository provides a reference implementation for integrating with the Cardano ecosystem ## Benefits of using Turnkey with Cardano * **Secure Key Management**: Private keys never leave Turnkey's secure infrastructure * **Policy Controls**: Apply custom policies to authorize signing based on criteria * **Developer-Friendly**: Integrate with existing Cardano development workflows (MeshJS, CSL, Lucid) * **Multi-network Support**: Use the same code across mainnet and the preprod/preview testnets If you're building on Cardano and need assistance with your Turnkey integration, feel free to contact us at [hello@turnkey.com](mailto:hello@turnkey.com), on [X](https://x.com/turnkeyhq/), or [on Slack](https://join.slack.com/t/clubturnkey/shared_invite/zt-3aemp2g38-zIh4V~3vNpbX5PsSmkKxcQ). # Cosmos support on Turnkey Source: https://docs.turnkey.com/features/networks/cosmos ## Address derivation Turnkey supports Cosmos address derivation. The address formats we support follow the [Cosmos SDK](https://docs.cosmos.network/) standard for bech32 addresses. ## Transaction construction and signing To construct and sign Cosmos transactions with Turnkey, we offer: * [`@turnkey/cosmjs`](https://www.npmjs.com/package/@turnkey/cosmjs): exports a `TurnkeyDirectWallet` that serves as a drop-in replacement for a CosmJS direct wallet. It includes support for `signDirect`. See it in action in our example: * [`examples/chain-integrations/with-cosmjs`](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-cosmjs): demonstrates transaction construction and broadcast on Cosmos. ## Example Here's a minimal example showing how to initialize a Turnkey signer for Cosmos and perform basic operations: ```typescript example.ts [expandable] theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; import { TurnkeyDirectWallet } from "@turnkey/cosmjs"; import { toHex } from "@cosmjs/encoding"; import { SigningStargateClient } from "@cosmjs/stargate"; // Initialize the Turnkey client const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPrivateKey: process.env.API_PRIVATE_KEY, apiPublicKey: process.env.API_PUBLIC_KEY, defaultOrganizationId: process.env.ORGANIZATION_ID, }); const signer = await initializeCosmosSigner(turnkeyClient); // Connect to a Cosmos chain RPC endpoint const rpcEndpoint = "https://rpc.celestia-arabica-11.com"; const client = await SigningStargateClient.connectWithSigner( rpcEndpoint, signer ); // Get account balance const balance = await client.getAllBalances(signer.address); const recipient = "celestia1vsvx8n7f8dh5udesqqhgrjutyun7zqrgehdq2l"; const amount = coins(1000, "utia"); const fee = calculateFee(200000, GasPrice.fromString("0.01usei")); const result = await client.sendTokens( signer.address, recipient, amount, fee, "Sent via Turnkey" ); const result = await signingClient.sendTokens( signer.address, recipient, [{ denom: "utia", amount: transactionAmount }], { amount: [{ denom: "utia", amount: "20000" }], gas: "200000", }, "Hello from Turnkey!" ); ``` ```typescript wallet.ts [expandable] theme={"system"} import { type TurnkeyApiClient } from "@turnkey/sdk-server"; import { TurnkeyDirectWallet } from "@turnkey/cosmjs"; // Connect to Cosmos and initialize signer export async function initializeCosmosSigner(turnkeyClient: TurnkeyApiClient) { // Create a Turnkey-powered Cosmos signer const signer = await TurnkeyDirectWallet.init({ config: { client: turnkeyClient.apiClient(), organizationId: process.env.ORGANIZATION_ID, signWith: process.env.COSMOS_ADDRESS, // Your Cosmos address in Turnkey }, prefix: "cosmos", // Change to the appropriate chain prefix (e.g., "celestia", "osmo", etc.) }); // Get the account details const accounts = await wallet.getAccounts(); const account = accounts[0]; console.log("Cosmos wallet address:", account.address); console.log("Public key:", toHex(account.pubkey)); return signer; } ``` ## Supported cosmos chains Turnkey supports various Cosmos ecosystem chains for address derivation and signing, including but not limited to: * Cosmos Hub (ATOM) * Celestia * Osmosis * Injective * Juno * Stargaze * Akash * Secret Network ## Key features * **Drop-in Replacement**: `TurnkeyDirectWallet` works as a direct replacement for standard CosmJS signers * **Chain Agnostic**: Works with any Cosmos SDK-based chain by changing the prefix * **Secure Signing**: All private keys remain secure in Turnkey's infrastructure * **Policy Control**: Apply custom signing policies to control transaction approvals If you are using a Cosmos chain we do not explicitly support, feel free to contact us at [hello@turnkey.com](mailto:hello@turnkey.com), on [X](https://x.com/turnkeyhq/), or [on Slack](https://join.slack.com/t/clubturnkey/shared_invite/zt-3aemp2g38-zIh4V~3vNpbX5PsSmkKxcQ). # Doge Source: https://docs.turnkey.com/features/networks/doge ## Address derivation Turnkey supports Doge address derivation with `ADDRESS_FORMAT_DOGE_MAINNET` and `ADDRESS_FORMAT_DOGE_TESTNET` address formats. Doge addresses are derived from the secp256k1 curve, which Turnkey fully supports. ## Transaction construction and signing Turnkey supports Doge transaction signing through the core signing capabilities. Check out the [examples/chain-integrations/with-doge](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-doge) repository that demonstrates how to construct, sign and broadcast a Doge P2PKH transaction on Testnet. ### Key features 1. Automatically fetch UTXOs (unspent coins), select enough inputs to cover the send amount and transaction fee. 2. Build Doge testnet transaction (inputs, outputs, change). 3. Compute sighashes & sign with Turnkey. 4. Insert signatures & pubkeys into the inputs. 5. Serialize and broadcast the raw transaction via Electrs testnet demo API. 6. Poll for confirmations until the tx is mined ## Benefits of using Turnkey with Doge * **Secure Key Management**: Private keys never leave Turnkey’s secure infrastructure * **Developer Friendly**: Integrate with existing Doge development workflows * **Signing Policies**: Apply custom policies to control transaction approvals * **Multi-address Support**: Manage multiple Doge addresses under a single organization # Ethereum (EVM) support on Turnkey Source: https://docs.turnkey.com/features/networks/ethereum ## Address derivation Turnkey supports EVM address derivation with `ADDRESS_TYPE_ETHEREUM`. This address format is valid across all EVM chains and L2s. ## Transaction construction and signing To construct and sign an EVM transaction with Turnkey, we offer: * [@turnkey/viem](https://github.com/tkhq/sdk/tree/main/packages/viem): contains a `createAccount` method to create a Turnkey-powered [custom account](https://viem.sh/docs/accounts/local) which [Viem](https://viem.sh/) can use seamlessly. * [@turnkey/ethers](https://github.com/tkhq/sdk/tree/main/packages/ethers): contains a `TurnkeySigner` which implements Ethers' `AbstractSigner` interface. See [Ethers docs](https://docs.ethers.org/v6/api/providers/abstract-signer/#AbstractSigner). ## Transaction management and gas sponsorship Turnkey's [Transaction Management](/features/transaction-management) handles the full lifecycle of EVM transactions — construction, broadcast, nonce management, and status monitoring — down to a few API calls. ### What Turnkey auto-fills When you submit a transaction via `ethSendTransaction`, Turnkey automatically manages: * **Nonce**: set correctly to order transactions and prevent conflicts * **Gas estimation**: calculated to ensure inclusion under current network conditions * **Priority fee (tip)**: set to target timely block inclusion per EIP-1559 ### Gas sponsorship (fee abstraction) Set `sponsor: true` to enable fee sponsorship — your users never need to hold native tokens to pay gas. Turnkey covers fees on your behalf and passes costs through as a monthly line item. **Supported networks:** * Base (eip155:8453) * Polygon (eip155:137) * Ethereum (eip155:1) * Arbitrum (eip155:42161) * Tempo (eip155:4217) * BNB Chain (eip155:56) * Base Sepolia, Polygon Amoy, Ethereum Sepolia, Arbitrum Sepolia, Tempo Moderato, BNB Chain Testnet (testnets) To enable gas sponsorship, ensure it is activated in your Turnkey dashboard before setting `sponsor: true`. ### Non-sponsored transactions Set `sponsor: false` to have gas paid by the sender's wallet. Turnkey still manages nonce, gas estimation, tip fees, broadcast, and status monitoring — you just don't get fee abstraction. ### Transaction status After broadcast, Turnkey monitors your transaction until it is included in a block or fails, with structured error decoding for smart contract reverts. Query status via the [Get Send Transaction Status](/api-reference/queries/get-send-transaction-status) endpoint. For a full walkthrough, see [Sending Sponsored EVM Transactions](/features/transaction-management/sending-sponsored-transactions). ## Transaction parsing, policies, and signing Turnkey has built an EVM parser which runs in a secure enclave, to parse unsigned EVM transactions and extract useful metadata: transaction source, destination, amount, chain ID, and more. See the `EthereumTransaction` struct in our [policy language](/features/policies/language) page for a full list. As a bonus, Turnkey also takes care of combining the signature with the original payload if you use the `SIGN_TRANSACTION` activity types: the input is the unsigned payload (RLP encoded), and the output is the signed RLP encoded transaction, ready to be broadcast! Additionally, Turnkey supports signing operations over EIP-712 Typed Data payloads, with an accompanying `eth.eip_712` namespace in our policy engine that can be used for gatekeeping. Additional details can be found [here](https://docs.turnkey.com/networks/ethereum#eip-712). ### Ethereum ABIs You can use Ethereum ABIs in conjunction with our policy engine to secure users' transactions. See [the guide](/features/policies/smart-contract-interfaces) for more details. ### What transaction types does Turnkey support? Turnkey supports the following transaction types: `legacy, EIP-2930 (Type 1), EIP-1559 (Type 2), EIP-4844 (Type 3), EIP-7702 (Type 4)`. These transactions will get parsed by our transaction parser, and are compatible with our [policy engine](https://docs.turnkey.com/concepts/policies/overview). ### EIP-4844 (type 3) support You can use Turnkey’s `SignTransaction` endpoint to parse and sign Type 3 transactions, which conform to the [EIP-4844 standard](https://github.com/ethereum/EIPs/blob/master/EIPS/eip-4844.md). We’ve also added Type 3 support to our policy engine by including the parameter `max_fee_per_blob_gas`. More details about our policy engine language can be found [here](https://docs.turnkey.com/concepts/policies/language#struct), and an example demonstrating how to use `@turnkey/viem` to sign Type 3 transactions can be found [here](https://github.com/tkhq/sdk/blob/main/examples/chain-integrations/with-viem/src/eip4844/signTransaction.ts). Note: for Type 3 transactions, we are specifically handling parsing for payloads containing only the transaction payload body, without any wrappers around blobs, commitments, or proofs. Accepted: `tx_payload_body`, defined as: `rlp([chain_id, nonce, max_priority_fee_per_gas, max_fee_per_gas, gas_limit, to, value, data, access_list, max_fee_per_blob_gas, blob_versioned_hashes, y_parity, r, s])` Rejected: `rlp([tx_payload_body, blobs, commitments, proofs])` * See that this is effectively wrapping the same tx\_payload\_body shape (defined above) alongside other blob-specific data * We do not sign payloads that conform to this format. Payloads that consists of `rlp([tx_payload_body, blobs, commitments, proofs])` are not transactions, they're messages which are part of the gossip protocol to persist blobs on the beacon chain. In other words, they're not meant to be signed: the signatures / integrity is taken care of with the signed commitments & proofs inside of these messages. See [https://github.com/ethereum/EIPs/blob/master/EIPS/eip-4844.md#blob-transaction](https://github.com/ethereum/EIPs/blob/master/EIPS/eip-4844.md#blob-transaction) and [https://github.com/ethereum/EIPs/blob/master/EIPS/eip-4844.md#networking](https://github.com/ethereum/EIPs/blob/master/EIPS/eip-4844.md#networking), respectively, for more. ### EIP-7702 (type 4) support In addition to adding support for Type 3 transactions, Turnkey now also supports Type 4 transactions, which conform to the [EIP-7702 standard](https://github.com/ethereum/EIPs/blob/master/EIPS/eip-7702.md). From [https://eip7702.io/](https://eip7702.io/): ```text theme={"system"} EIP-7702 gives superpowers to EOAs. Specifically, it allows any EOA to set its code based on any existing smart contract. To do so, an EOA owner would sign an authorization that could then be submitted by anyone as part of the new transaction type. The code will be valid until replaced by another authorization. The authorization could be given for a single chain, or all chains at once. This setup allows an EOA to mimic a smart contract account, particularly allowing transaction bundling, gas sponsorships, and custom permissioning schemes. ``` You can take advantage of Type 4 transaction support on Turnkey to: 1. Enable gasless transaction experiences: Design applications where transactions can be sponsored by third parties, removing the ETH requirement barrier for new users and simplifying onboarding. 2. Create seamless applications with transaction batching: Bundle multiple operations into single transactions, significantly reducing gas costs and improving UX for complex DeFi or high-frequency trading. 3. Implement flexible authentication systems: Build applications that can leverage passkeys and biometrics while maintaining compatibility with existing EOA infrastructure and reputation systems. For a turnkey solution to gasless transactions using EIP-7702, check out the [Gas Station SDK](/sdks/web3/gas-station), which provides clean abstractions for authorization, intent signing, and paymaster execution. Type 4 transaction support is also live for our policy engine. Details about our engine language can be found [here](https://docs.turnkey.com/concepts/policies/language#struct), and an example demonstrating how to use @turnkey/viem to sign Type 4 transactions can be found [here](https://github.com/tkhq/sdk/blob/main/examples/chain-integrations/with-viem/src/eip7702/signTransaction.ts). ### EIP-712 At a high level, you can sign EIP-712 payloads using Turnkey in a few ways. #### Raw digest You can pre-compute the hash of the EIP-712 payload body, and sign it directly using Turnkey. Here's an example in JavaScript pseudocode: ```javascript theme={"system"} const typedData = { domain: { name: "Ether Mail", version: "1", chainId: 1, verifyingContract: "0xCcCCccccCCCCcCCCCCCcCcCccCcCCCcCcccccccC", }, types: { Person: [ { name: "name", type: "string" }, { name: "wallet", type: "address" }, ], Mail: [ { name: "from", type: "Person" }, { name: "to", type: "Person" }, { name: "contents", type: "string" }, ], }, primaryType: "Mail", message: { from: { name: "Cow", wallet: "0xCD2a3d9F938E13CD947Ec05AbC7FE734Df8DD826", }, to: { name: "Bob", wallet: "0xbBbBBBBbbBBBbbbBbbBbbbbBBbBbbbbBbBbbBBbB", }, contents: "Hello, Bob!", }, } // This simply hashes the typed data using keccak256, ultimately producing a signable digest const hashedPayload = hashTypedData(typedData); const { activity, r, s, v } = await turnkeyClient.signRawPayload({ organizationId: "", signWith: ", payload: hashedPayload, encoding: "PAYLOAD_ENCODING_HEXADECIMAL", hashFunction: "HASH_FUNCTION_NO_OP", }); ``` The caveat with this approach is that Turnkey will receive a raw digest and only that; therefore, you cannot write policies enforcing rules against the fields of the EIP-712 payload body. #### Encoded If you *do* want to write policies enforcing rules against the fields of the EIP-712 payload body, you will need to pass over the payload serialized (not hashed!), with the `payloadEncoding` type as `"PAYLOAD_ENCODING_EIP712"`. This way, you can write Policy Conditions which directly reference the attributes of this Typed Data. This can be used to support integrations involving Hyperliquid, ERC-2612 Permits, or ERC-3009 Transfers, among many others. Here's the same example, but with slight modifications in order to allow policies targeting attributes of the Typed Data: ```javascript theme={"system"} const typedData = { domain: { name: "Ether Mail", version: "1", chainId: 1, verifyingContract: "0xCcCCccccCCCCcCCCCCCcCcCccCcCCCcCcccccccC", }, types: { Person: [ { name: "name", type: "string" }, { name: "wallet", type: "address" }, ], Mail: [ { name: "from", type: "Person" }, { name: "to", type: "Person" }, { name: "contents", type: "string" }, ], }, primaryType: "Mail", message: { from: { name: "Cow", wallet: "0xCD2a3d9F938E13CD947Ec05AbC7FE734Df8DD826", }, to: { name: "Bob", wallet: "0xbBbBBBBbbBBBbbbBbbBbbbbBBbBbbbbBbBbbBBbB", }, contents: "Hello, Bob!", }, } // This gets the typed data into a format to send over to Turnkey; note that this is *not* equivalent to generating a hash of the typed data const serializedPayload = serializeTypedData(typedData); const { activity, r, s, v } = await turnkeyClient.signRawPayload({ organizationId: "", signWith: ", payload: serializedPayload, encoding: "PAYLOAD_ENCODING_EIP712", // this is crucial! hashFunction: "HASH_FUNCTION_NO_OP", }); ``` This is ultimately how our Viem and Ethers implementations pass Typed Data over to Turnkey for signing. #### Examples SDK examples demonstrating the signing side of the above-mentioned integrations can be found below: * Using `ethers`: * [hyperliquid](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-ethers/src/eip712/hyperliquid.ts) * [erc-2612](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-ethers/src/eip712/erc2612_permit.ts) * [erc-3009](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-ethers/src/eip712/erc3009_transfer.ts) * Using `viem`: * [hyperliquid](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-viem/src/eip712/hyperliquid.ts) * [erc-2612](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-viem/src/eip712/erc2612_permit.ts) * [erc-3009](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-viem/src/eip712/erc3009_transfer.ts) You can also find examples of EIP-712-aware Policies associated with these integrations on [our policy examples page](https://docs.turnkey.com/concepts/policies/examples/ethereum##allow-signing-of-eip-712-payloads-for-hyperliquid-approveagent-operations). ## Account abstraction Turnkey is built to be flexible: a lot of our customers use Turnkey as a smart contract signer, alongside other types of signers. This is so common that AA wallet providers have integrated Turnkey as a default solution in their documentation. Refer to our [AA Wallet](/features/wallets/aa-wallets) documentation for further information. ## EIP-1193 provider We've published an experimental package, which adheres to the [EIP-1193](https://eips.ethereum.org/EIPS/eip-1193) standard. It's built to integrate seamlessly with a broad spectrum of EVM-compatible chains, offering capabilities like account management, transaction signing, and blockchain interaction. ## Wallet signer Did you know? Turnkey activities can be signed with an API key, a passkey...or any Ethereum wallet if you use our package! ## Examples and demos A lot of our demos use EVM chains and capabilities. The most complete demo is our **Demo Embedded wallet**, a fully-functional, hosted wallet which showcases (among other things) send and receive functionality on Sepolia. Try it out at [wallet.tx.xyz](https://wallet.tx.xyz)! The code behind this demo is open-source, available at [https://github.com/tkhq/demo-embedded-wallet/](https://github.com/tkhq/demo-embedded-wallet/) If you're looking for shorter, more focused examples, here are a few worth checking out: * [with-ethers](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-ethers): demonstrates how to use Turnkey with Ethers * [with-viem](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-viem): demonstrates how to use Turnkey with Viem * [with-zerodev-aa](https://github.com/tkhq/sdk/tree/main/examples/account-abstraction/with-zerodev-aa): demonstrates how to use Turnkey with Zerodev + Viem to create sponsored transactions, and also EIP-7702 (Type 4) transactions * [with-biconomy-aa](https://github.com/tkhq/sdk/tree/main/examples/account-abstraction/with-biconomy-aa): demonstrates how to use Turnkey with Biconomy + Ethers / Viem to create sponsored transactions, including an example using Biconomy's Nexus Client * [with-eth-passkeys-signer](https://github.com/tkhq/sdk/tree/main/examples/demos/with-eth-passkeys-galore): demonstrates both Ethers and Viem integrations, with an optional Biconomy account abstraction integration. * [with-gnosis](https://github.com/tkhq/sdk/tree/main/examples/account-abstraction/with-gnosis): shows how to use Turnkey with [Gnosis (Safe)](https://safe.global/). * [with-uniswap](https://github.com/tkhq/sdk/tree/main/examples/defi/with-uniswap): shows how to use Turnkey with Uniswap, using Ethers. * [with-eip-1193-provider](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-eip-1193-provider): short example focused on EIP-1193 provider usage. ## Which EVM chains does Turnkey support? Turnkey supports the EVM chains below for address derivation and signing arbitrary transactions: * Arbitrum * Aurora * Avalanche C chain * Avalanche Fuji * Base * Berachain * BNB Smart Chain * Celo * Chiliz * Cronos * EON * Ethereum * Fantom * Flare * Gnosis * Holesky Redstone * Holesky Garnet * Hyperliquid * Lukso * Linea * Monad * Moonbeam * Optimism * Palm * Polygon * Redstone * Robinhood Chain * Scroll * zkSync * Zora If you are using an EVM chain we do not support, feel free to contact us at [hello@turnkey.com](mailto:hello@turnkey.com), on [X](https://x.com/turnkeyhq/), or [on Slack](https://join.slack.com/t/clubturnkey/shared_invite/zt-3aemp2g38-zIh4V~3vNpbX5PsSmkKxcQ). # Hyperliquid support on Turnkey Source: https://docs.turnkey.com/features/networks/hyperliquid ## Address derivation Turnkey supports Hyperliquid (EVM) address derivation with `ADDRESS_TYPE_ETHEREUM`. This address format is valid across all of the Hyperliquid ecosystem (HyperCore and HyperEVM). ## Transaction construction and signing To construct and sign a Hyperliquid (EVM) transaction with Turnkey, we offer: * [@turnkey/viem](https://github.com/tkhq/sdk/tree/main/packages/viem): contains a `createAccount` method to create a Turnkey-powered [custom account](https://viem.sh/docs/accounts/local) which [Viem](https://viem.sh/) can use seamlessly. * [@turnkey/ethers](https://github.com/tkhq/sdk/tree/main/packages/ethers): contains a `TurnkeySigner` which implements Ethers' `AbstractSigner` interface. See [Ethers docs](https://docs.ethers.org/v6/api/providers/abstract-signer/#AbstractSigner). ## Transaction parsing, policies, and signing Please refer to our [Ethereum network page](/features/networks/ethereum) for details on transaction parsing, policies, and signing, as Hyperliquid shares the same EVM architecture. However, HyperCore notably uses EIP-712 messages to perform various actions. More information on defining EIP-712 policies, see [here](../networks/ethereum#eip-712). Additionally, top-level policy details can be found [here](/features/policies/language). For an example of how to construct a policy targeting such Hyperliquid-specific EIP-712 messages, see [here](/features/policies/examples/ethereum#allow-signing-of-eip-712-payloads-for-hyperliquid-approveagent-operations). # IOTA support on Turnkey Source: https://docs.turnkey.com/features/networks/iota ## Address derivation Turnkey fully supports IOTA addresses derived from the Ed25519 curve. ## Transaction construction and signing Turnkey supports IOTA transaction signing through the core signing capabilities. We provide an example repository that demonstrates how to construct and sign IOTA transactions: * [`examples/chain-integrations/with-iota`](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-iota): demonstrates transaction construction and broadcast on IOTA. ## Example Here's a practical example showing how to integrate Turnkey with the [IOTA SDK](https://docs.iota.org/developer/ts-sdk/typescript/): ```typescript expandable theme={"system"} import * as dotenv from 'dotenv'; import * as path from 'path'; import { IotaClient, getFullnodeUrl } from '@iota/iota-sdk/client'; import { Transaction } from '@iota/iota-sdk/transactions'; import { Ed25519PublicKey } from '@iota/iota-sdk/keypairs/ed25519'; import { messageWithIntent } from '@iota/iota-sdk/cryptography'; import { Turnkey } from '@turnkey/sdk-server'; import { blake2b } from '@noble/hashes/blake2b'; import { bytesToHex } from '@noble/hashes/utils'; dotenv.config({ path: path.resolve(process.cwd(), '.env.local') }); function toSerializedSignature({ signature, pubKey, }: { signature: Uint8Array; pubKey: Ed25519PublicKey; }): string { const scheme = new Uint8Array([0x00]); // ED25519 flag const pubKeyBytes = pubKey.toRawBytes(); const serialized = new Uint8Array( scheme.length + signature.length + pubKeyBytes.length ); serialized.set(scheme, 0); serialized.set(signature, scheme.length); serialized.set(pubKeyBytes, scheme.length + signature.length); return Buffer.from(serialized).toString('base64'); } async function main() { // load the variables from .env // IOTA_ADDRESS and IOTA_PUBLIC_KEY of the Turnkey signer const { ORGANIZATION_ID, API_PRIVATE_KEY, API_PUBLIC_KEY, IOTA_ADDRESS, IOTA_PUBLIC_KEY, } = process.env; if (IOTA_ADDRESS === undefined || IOTA_PUBLIC_KEY === undefined) { throw new Error('IOTA_ADDRESS or IOTA_PUBLIC_KEY not set in .env.local'); } // sending to the same address const recipient = IOTA_ADDRESS; const amount = 1_000_000n; // 0.001 IOTA const turnkeyClient = new Turnkey({ apiBaseUrl: 'https://api.turnkey.com', apiPrivateKey: API_PRIVATE_KEY!, apiPublicKey: API_PUBLIC_KEY!, defaultOrganizationId: ORGANIZATION_ID!, }); const provider = new IotaClient({ url: getFullnodeUrl('testnet') }); const publicKey = new Ed25519PublicKey(Buffer.from(IOTA_PUBLIC_KEY!, 'hex')); // if (publicKey.toIotaAddress() !== IOTA_ADDRESS) { // throw new Error('IOTA_PUBLIC_KEY does not match IOTA_ADDRESS'); // } // fetch the user's IOTA coin objects const coins = await provider.getCoins({ owner: IOTA_ADDRESS!, coinType: '0x2::iota::IOTA', }); if (!coins.data.length) throw new Error('No IOTA coins'); const tx = new Transaction(); tx.setSender(IOTA_ADDRESS!); tx.setGasPrice(await provider.getReferenceGasPrice()); tx.setGasBudget(5_000_000n); tx.setGasPayment([ { objectId: coins.data[0]!.coinObjectId, version: coins.data[0]!.version, digest: coins.data[0]!.digest, }, ]); const coin = tx.splitCoins(tx.gas, [tx.pure('u64', amount)]); tx.transferObjects([coin], tx.pure.address(recipient)); const txBytes = await tx.build(); const intentMsg = messageWithIntent('TransactionData', txBytes); const digest = blake2b(intentMsg, { dkLen: 32 }); const { r, s } = await turnkeyClient.apiClient().signRawPayload({ signWith: IOTA_ADDRESS!, payload: bytesToHex(digest), encoding: 'PAYLOAD_ENCODING_HEXADECIMAL', hashFunction: 'HASH_FUNCTION_NOT_APPLICABLE', }); const signature = Buffer.from(r + s, 'hex'); const serialized = toSerializedSignature({ signature, pubKey: publicKey }); const result = await provider.executeTransactionBlock({ transactionBlock: Buffer.from(txBytes).toString('base64'), signature: serialized, requestType: 'WaitForEffectsCert', options: { showEffects: true }, }); console.log('Transaction digest:', result.digest); } main().catch((err) => { console.error('Error:', err); process.exit(1); }); ``` ## IOTA network support Turnkey supports: * IOTA Mainnet * IOTA Testnet * IOTA Devnet ## Key features for IOTA * **Ed25519 Signing**: Turnkey fully supports the Ed25519 curve used by IOTA * **Raw Transaction Signing**: Sign any IOTA transaction format with Turnkey's flexible signing API * **Integration Example**: Our example repository provides a reference implementation ## Benefits of using Turnkey with IOTA * **Secure Key Management**: Private keys never leave Turnkey's secure infrastructure * **Developer Friendly**: Integrate with existing IOTA development workflows * **Signing Policies**: Apply custom policies to control transaction approvals * **Multi-user Support**: Manage multiple IOTA addresses under a single organization If you're building on IOTA and need assistance with Turnkey integration, feel free to contact us at [hello@turnkey.com](mailto:hello@turnkey.com), on [X](https://x.com/turnkeyhq/), or [on Slack](https://join.slack.com/t/clubturnkey/shared_invite/zt-3aemp2g38-zIh4V~3vNpbX5PsSmkKxcQ). # Movement Source: https://docs.turnkey.com/features/networks/movement Movement support on Turnkey ## Address derivation Turnkey supports Movement address derivation. Movement is built on the Move VM and uses Ed25519 cryptography, which Turnkey fully supports. ## Transaction construction and signing Turnkey supports Movement transaction signing through our core signing capabilities. We provide an example repository that demonstrates how to construct and sign Movement transactions: * [`examples/chain-integrations/with-movement`](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-movement): demonstrates transaction construction and broadcast on Movement. ## Example Here's a comprehensive example showing how to integrate Turnkey with Movement for transaction signing: ```typescript [expandable] theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; import { MovementClient, AptosAccount, TxnBuilderTypes, BCS, HexString } from "movement-sdk"; // Custom Turnkey signer for Movement class TurnkeyMovementSigner { private turnkeyClient: Turnkey; private movementClient: MovementClient; private address: string; private organizationId: string; constructor( apiPrivateKey: string, apiPublicKey: string, organizationId: string, address: string, nodeUrl: string = "https://seed-node1.movementlabs.xyz" ) { this.turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPrivateKey, apiPublicKey, defaultOrganizationId: organizationId }); this.movementClient = new MovementClient(nodeUrl); this.address = address; this.organizationId = organizationId; } // Get the account address getAddress(): string { return this.address; } // Sign a raw payload using Turnkey async signRawPayload(payload: Uint8Array): Promise { const hexPayload = Buffer.from(payload).toString('hex'); const signResult = await this.turnkeyClient.signRawPayload({ organizationId: this.organizationId, signWith: this.address, payload: hexPayload, encoding: "hex" }); return Buffer.from(signResult.signature, 'hex'); } // Submit a transaction to Movement async submitTransaction(payload: any): Promise { try { // Get account info for sequence number const accountInfo = await this.movementClient.getAccount(this.address); const sequenceNumber = BigInt(accountInfo.sequence_number); // Get chain ID for the transaction const chainId = await this.movementClient.getChainId(); // Build raw transaction const rawTx = new TxnBuilderTypes.RawTransaction( // Account address TxnBuilderTypes.AccountAddress.fromHex(this.address), // Sequence number sequenceNumber, // Transaction payload payload, // Max gas BigInt(10000), // Gas unit price BigInt(100), // Expiration timestamp (30 seconds from now) BigInt(Math.floor(Date.now() / 1000) + 30), // Chain ID new TxnBuilderTypes.ChainId(chainId) ); // Serialize the transaction const serializer = new BCS.Serializer(); rawTx.serialize(serializer); const toSign = serializer.getBytes(); // Sign the transaction const signature = await this.signRawPayload(toSign); // In a real implementation, you would need the actual public key from the address // Here we use a placeholder const dummyPublicKey = new TxnBuilderTypes.Ed25519PublicKey(new Uint8Array(32)); // Create authenticator const authenticator = new TxnBuilderTypes.TransactionAuthenticatorEd25519( dummyPublicKey, new TxnBuilderTypes.Ed25519Signature(signature) ); // Create signed transaction const signedTx = new TxnBuilderTypes.SignedTransaction( rawTx, authenticator ); // Submit transaction const txnResponse = await this.movementClient.submitTransaction( BCS.bcsToBytes(signedTx) ); return txnResponse.hash; } catch (error) { console.error("Error submitting transaction:", error); throw error; } } } // Example usage: Transfer MOV tokens async function transferMovTokens() { const signer = new TurnkeyMovementSigner( process.env.API_PRIVATE_KEY!, process.env.API_PUBLIC_KEY!, process.env.ORGANIZATION_ID!, process.env.MOVEMENT_ADDRESS!, // Your Movement address in Turnkey "https://testnet.movementlabs.xyz" // Use testnet URL for development ); const recipientAddress = "0x..."; // Recipient address const amount = 1000000; // Amount (adjust decimal places as needed) // Create a transfer transaction payload const payload = new TxnBuilderTypes.TransactionPayloadEntryFunction( TxnBuilderTypes.EntryFunction.natural( "0x1::coin", "transfer", [new TxnBuilderTypes.TypeTagStruct( TxnBuilderTypes.StructTag.fromString("0x1::mov_coin::MOV") )], [ BCS.bcsToBytes(TxnBuilderTypes.AccountAddress.fromHex(recipientAddress)), BCS.bcsSerializeUint64(amount) ] ) ); try { const txnHash = await signer.submitTransaction(payload); console.log(`Transaction submitted successfully! Hash: ${txnHash}`); return txnHash; } catch (error) { console.error("Error transferring tokens:", error); throw error; } } ## Movement network support Turnkey supports: * Movement Mainnet * Movement Testnet ## Key features for Movement * **Ed25519 Signing**: Turnkey fully supports the Ed25519 curve used by Movement * **BCS Format Support**: Sign transactions serialized in the Binary Canonical Serialization format * **Integration Example**: Our example repository provides a reference implementation for integrating with the Movement ecosystem ## Benefits of using Turnkey with Movement * **Secure Private Keys**: Keys are securely stored in Turnkey's infrastructure * **Customizable Policies**: Implement rules to control when and how transactions are signed * **Developer-Friendly**: Seamless integration with existing Movement development workflows * **Enterprise-Ready**: Built for production environments with high security requirements ## Move smart contract development Movement leverages the Move VM for smart contracts. When developing Move smart contracts on Movement, Turnkey can securely manage your private keys for: * Deploying Move modules * Publishing packages * Executing Move functions * Managing onchain resources If you're building on Movement and need assistance with your Turnkey integration, feel free to contact us at [hello@turnkey.com](mailto:hello@turnkey.com), on [X](https://x.com/turnkeyhq/), or [on Slack](https://join.slack.com/t/clubturnkey/shared_invite/zt-3aemp2g38-zIh4V~3vNpbX5PsSmkKxcQ). ``` # Others Source: https://docs.turnkey.com/features/networks/others **Can't find your preferred network?**\ Turnkey is chain-agnostic, and our flexible infrastructure is built to support underlying cryptographic curves, instead of specific chains and assets. If your chain isn't mentioned, check if the underlying curve is compatible – we support signing for all chains and assets on the **Ed25519, Secp256k1, and P256** curves. This includes chains like: * Algorand * Avalanche * Cardano * Dogecoin * Filecoin * Hedera * Litecoin * Monero * NEAR * Polkadot * Stellar * Tezos * TON (The Open Network) * XRP * …and more! If you're unsure whether your chain is supported, don't hesitate to [get in touch](https://www.turnkey.com/contact-us). **Code example**\ Learn how to use Turnkey to interact with over 60 blockchain networks via this [external demo](https://github.com/AdamikHQ/adamik-tutorial/tree/signer-turnkey). Adamik's terminal-based application provides a user-friendly interface to explore the following multichain capabilities, powered by Turnkey: * Generating secure cryptographic keys * Creating addresses for different networks * Viewing account balances and token holdings * Preparing, signing, and broadcasting transactions * Visualizing API interactions in real time **Want more support?**\ We are continuously evaluating and adding support for emerging assets and protocols. If there are specific networks you'd like to see us offer deeper support for, or if you're looking for more code examples, please let us know by contacting us at [hello@turnkey.com](mailto:hello@turnkey.com), on X, or on Slack. # Overview Source: https://docs.turnkey.com/features/networks/overview Turnkey operates at the **cryptographic curve** level rather than specific assets. As a result Turnkey is asset agnostic and can be used with any type of asset as long as we support the underlying curve. ## Multichain support at Turnkey Turnkey is extremely flexible and supports all EVM and SVM chains, along with a vast majority of chains and assets across crypto. You don’t have to wait for us to add your preferred network. This is because while other wallet infrastructure solutions focus on setting up support for each chain individually after they launch, Turnkey's low-level approach focuses on supporting the underlying cryptographic curves: Secp256k1, Ed25519, and P256. As a result, Turnkey is asset agnostic and can be used with any type of asset, as long as we support its corresponding curve. ## What is Turnkey's approach to supporting crypto assets? Turnkey follows a tiered approach to supporting digital assets, ranging from supporting cryptographic curve support, to advanced transaction parsing and policy management. Each tier deepens the level of functionality, as outlined below: **Tier 1: Curve-level support** Cryptographic curves are our fundamental primitive, allowing Turnkey private keys to store and sign for any cryptocurrency that uses a supported curve. We currently support SECP256k1, Ed25519, and P256 curves. **Tier 2: Address derivation** Turnkey abstracts address generation, automatically deriving addresses for supported cryptocurrencies. For a full list of address formats you can derive on Turnkey, refer to [Address formats and Curves](/features/wallets). **Tier 3: SDK for transaction construction and signing** Our SDK provides tools and scripts to help in constructing and signing basic transactions, enabling an even smoother integration. **Tier 4: Transaction parsing and policy creation** At our highest level of support, Turnkey offers the ability to parse transactions and define custom policies based on transaction parameters. | Tier | Depth of support | EVM | SVM | BTC | ATOM | TRON | SUI | APT | TON | XRP | SEI | | ------ | :------------------------------- | --- | --- | --- | ---- | ---- | --- | --- | --- | --- | --- | | Tier 1 | Curve-level | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | | Tier 2 | Address derivation | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | | Tier 3 | SDK construction and signing | ✓ | ✓ | | | | | | | | | | Tier 4 | Transaction parsing and policies | ✓ | ✓ | ✓ | | ✓ | | | | | | We are continuously evaluating and adding support for emerging assets and protocols. If there are specific cryptocurrencies you'd like to see us offer deeper support for, please let us know by contacting us at [hello@turnkey.com](mailto:hello@turnkey.com), on [X](https://x.com/turnkeyhq/), or [on Slack](https://join.slack.com/t/clubturnkey/shared_invite/zt-3aemp2g38-zIh4V~3vNpbX5PsSmkKxcQ). For more details about each ecosystem, refer to the pages below: # Sei support on Turnkey Source: https://docs.turnkey.com/features/networks/sei ## Address derivation Turnkey supports Sei address derivation. Sei is part of the Cosmos ecosystem and uses the bech32 address format with the `sei` prefix. Addresses are derived using the SECP256k1 curve. ## Transaction construction and signing Since Sei is based on the Cosmos SDK, you can leverage our Cosmos support for transaction construction and signing: * [`@turnkey/cosmjs`](https://www.npmjs.com/package/@turnkey/cosmjs): our CosmJS integration works with Sei as well, allowing you to use a `TurnkeyDirectWallet` as a drop-in replacement. ## Example Here's a practical example showing how to use Turnkey with Sei for a complete transaction flow: ```typescript example.ts [expandable] theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; import { SigningStargateClient, GasPrice, calculateFee, } from "@cosmjs/stargate"; import { coins } from "@cosmjs/amino"; // Import the initializeSeiSigner function from wallet.ts import { initializeSeiSigner } from "./wallet"; // Initialize the Turnkey client const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPrivateKey: process.env.API_PRIVATE_KEY, apiPublicKey: process.env.API_PUBLIC_KEY, defaultOrganizationId: process.env.ORGANIZATION_ID, }); const signer = await initializeSeiSigner(turnkeyClient); // Connect to Sei network - use the appropriate endpoint for mainnet/testnet const rpcEndpoint = "https://sei-rpc.polkachu.com"; // Example RPC endpoint const client = await SigningStargateClient.connectWithSigner( rpcEndpoint, signer, { gasPrice: GasPrice.fromString("0.01usei"), } ); const recipient = "sei1recipient..."; // Recipient address const amount = coins(1000000, "usei"); // 1 SEI const fee = calculateFee(200000, GasPrice.fromString("0.01usei")); const result = await client.sendTokens( signer.address, recipient, amount, fee, "Sent via Turnkey" ); console.log("Transaction hash:", result.transactionHash); ``` ```typescript wallet.ts [expandable] theme={"system"} import { type TurnkeyApiClient } from "@turnkey/sdk-server"; import { TurnkeyDirectWallet } from "@turnkey/cosmjs"; // Connect to Sei and initialize signer export async function initializeSeiSigner(turnkeyClient: TurnkeyApiClient) { // Create a Turnkey-powered Sei signer const signer = await TurnkeyDirectWallet.init({ config: { client: turnkeyClient.apiClient(), organizationId: process.env.ORGANIZATION_ID, signWith: process.env.SEI_ADDRESS, // Your Sei address in Turnkey }, prefix: "sei", // Using the Sei prefix }); // Get the account details const accounts = await signer.getAccounts(); const account = accounts[0]; console.log("Sei signer address:", account.address); console.log("Public key:", account.pubkey); return signer; } ``` ## Sei network support Turnkey supports: * Sei Mainnet (Pacific-1) * Sei Testnet (Atlantic-2) ## Key features for Sei * **Cosmos SDK Compatibility**: Leverage the same tools used for Cosmos ecosystem * **SECP256k1 Support**: Full support for Sei's cryptographic requirements * **Flexible Signing**: Sign any Sei transaction format with Turnkey's signing API ## DApp integration For DApp developers looking to integrate with Sei, you can use Turnkey as a secure key management solution and combine it with: * [Sei.js](https://www.npmjs.com/package/@sei-js/core) - Official JavaScript library for Sei * [CosmJS](https://github.com/cosmos/cosmjs) - Popular JavaScript client library for the Cosmos ecosystem ## Benefits of using Turnkey with Sei * **Enhanced Security**: Private keys never leave Turnkey's secure infrastructure * **Simplified Key Management**: No need to manage private keys in your application * **Policy Control**: Apply transaction policies to control what can be signed * **Multi-environment Support**: Use the same code across testnet and mainnet If you're building on Sei and need assistance with your Turnkey integration, feel free to contact us at [hello@turnkey.com](mailto:hello@turnkey.com), on [X](https://x.com/turnkeyhq/), or [on Slack](https://join.slack.com/t/clubturnkey/shared_invite/zt-3aemp2g38-zIh4V~3vNpbX5PsSmkKxcQ). # Solana (SVM) support on Turnkey Source: https://docs.turnkey.com/features/networks/solana ## Address derivation Turnkey supports Solana address derivation with `ADDRESS_TYPE_SOLANA`. Solana addresses are a simple encoding of the ed25519 public key. ## Transaction construction and signing To construct and sign a Solana transaction we offer a `@turnkey/solana` NPM package. It offers a `TurnkeySigner` which integrates our remote signer with the official Solana [`web3js`](https://github.com/solana-foundation/solana-web3.js) library. ## Transaction management and gas sponsorship Turnkey's [Transaction Management](/features/transaction-management) handles the full lifecycle of Solana transactions — construction, broadcast, and status monitoring — down to a few API calls. ### What Turnkey auto-fills When you submit a transaction via `solSendTransaction`, Turnkey automatically manages: * **Recent blockhash**: fetched and set at broadcast time to ensure validity * **Compute unit limit**: estimated and set to avoid failed transactions * **Priority fee**: set to ensure timely inclusion under current network conditions ### Gas sponsorship (fee abstraction) Set `sponsor: true` to enable fee sponsorship — your users never need to hold SOL to pay transaction fees. Turnkey covers fees on your behalf and passes costs through as a monthly line item. **Supported networks:** * Solana mainnet * Solana devnet (for testing) To enable gas sponsorship, ensure it is activated in your Turnkey dashboard before setting `sponsor: true`. For sponsored Solana flows, especially when you accept prebuilt transactions, see [Solana transaction construction for sponsored flows](/features/networks/solana-transaction-construction) for the current payload constraints and account-creation caveats. ### Solana rent sponsorship Solana rent sponsorship is separate from general gas sponsorship and is disabled by default. If an instruction creates a new account and the user signer is the payer, Turnkey pre-funds that signer for the rent-exempt amount only after you enable `Sponsor Solana Rent` in the dashboard and save the configuration. If those accounts are later closed, the refunded rent follows Solana account rules and can go back to the signer rather than the sponsor. See [Solana Rent Sponsorship](/features/networks/solana-rent-refunds) for setup steps, the dashboard flow, and mitigation guidance. ### Non-sponsored transactions Set `sponsor: false` to have the transaction fee paid by the sender's wallet. Turnkey still manages blockhash, compute units, priority fees, broadcast, and status monitoring — you just don't get fee abstraction. ### Transaction status After broadcast, Turnkey monitors your transaction until it is confirmed or fails. Query status via the [Get Send Transaction Status](/api-reference/queries/get-send-transaction-status) endpoint. For a full walkthrough, see [Sending Sponsored Solana Transactions](/features/transaction-management/sending-sponsored-solana-transactions). ## Transaction parsing, policies, and signing Turnkey has built a Solana parser which runs in a secure enclave, to parse unsigned transactions and extract metadata. Solana transactions are a list of instructions. We offer details about program keys, accounts, signers, and more. See the `SolanaTransaction` struct in our [policy language](/features/policies/language) page for a full list. As a bonus, Turnkey also takes care of combining the signature with the original payload if you use the `SIGN_TRANSACTION` activity types: the input is the unsigned payload, and the output is the signed Solana transaction, ready to be broadcast onchain. ### Solana IDLs You can use Solana IDLs in conjunction with our policy engine to secure users' transactions. See [the guide](/features/policies/smart-contract-interfaces) for more details. ## Import and export formats Turnkey offers wallet or private key imports and export functionality. To be compatible with the Solana ecosystem, we support imports in mnemonics form (for wallet seeds, this is most common) or in base58 format (for single private key import or export). See the [import](/solutions/embedded-wallets/integration-guide/react/using-embedded-wallets) and [export](/solutions/embedded-wallets/integration-guide/react/using-embedded-wallets) guides for more details. ## Wallet signer Did you know? Turnkey activities can be signed with an API key, a passkey...or a Solana wallet if you use our [`@turnkey/wallet-stamper`](https://www.npmjs.com/package/@turnkey/wallet-stamper) package! ## Examples and demos You can find an example of Solana transaction construction and broadcasting using `@turnkey/with-solana` in [`examples/chain-integrations/with-solana`](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-solana). If you want to see [`@turnkey/wallet-stamper`](https://www.npmjs.com/package/@turnkey/wallet-stamper) in action, head to [`examples/authentication/with-wallet-stamper`](https://github.com/tkhq/sdk/tree/main/examples/authentication/with-wallet-stamper). # Solana rent sponsorship Source: https://docs.turnkey.com/features/networks/solana-rent-refunds Understand how Solana rent sponsorship works, when rent is pre-funded, and how to reduce rent-refund leakage in sponsored flows. ## Overview On Solana, fee sponsorship and rent sponsorship are separate concepts. Fee sponsorship covers the network fee for a transaction. Rent sponsorship covers the rent-exempt lamports needed when instructions create new accounts. Rent sponsorship is disabled by default and must be enabled separately in the Turnkey dashboard. When rent is enabled: * If an instruction creates a new account and the user signer is the payer, Turnkey pre-funds that signer for the rent-exempt amount. The amount is based on the size of the new account data and is intended to make the account rent exempt. * Sponsored rent is added to your monthly gas bill and counts toward the same spend limits used for sponsored transaction fees. See [Spend limits](/features/transaction-management#spend-limits). For the broader transaction-construction model behind sponsored Solana flows, including payer behavior and account-creation caveats, see [Solana transaction construction for sponsored flows](/features/networks/solana-transaction-construction). ## Enable rent sponsorship If your product sponsors transactions that create accounts and you want rent covered for your users, you must enable rent sponsorship in the Turnkey dashboard. Here is how you can do this: 1. Enable gas sponsorship. 2. Turn on `Sponsor Solana Rent`. 3. Click `Save Configuration`. Turnkey dashboard showing Sponsor Solana Rent enabled Refunded rent from later-closed accounts follows Solana account rules. It does not automatically return to the sponsor. ## Rent extraction risk Solana accounts can be closed after they're created, and when that happens, the rent previously deposited into the account is returned according to Solana account rules, usually to the configured destination for the close operation. That destination is usually the signer or account owner, not the sponsor that originally funded the rent. This creates a rent extraction risk for sponsored Solana transactions: the sponsor covers the rent needed to create the account, but the refunded rent can later flow back to the signer instead. This means that when your organization pays for rent upfront, and those accounts are later closed, the refunded lamports may go to the signer, not back to you. This can be exploited maliciously, but it also happens naturally in ordinary product flows. A common example is a swap that temporarily wraps SOL into wSOL, uses that account during execution, and then closes the temporary account before the transaction completes. In a self-funded flow, the rent simply returns to the user. In a sponsored flow, that same rent may have been pre-funded by the sponsor and then refunded back to the signer. ## Mitigations and guardrails How you mitigate depends on how much transaction flexibility your product allows, but there are several approaches: * Reuse a constrained set of token accounts where possible instead of creating and closing them repeatedly. * Avoid or strip `CloseAccount` patterns from sponsored flows when that works for your product. * Prefer backend-generated or backend-validated transactions for higher-control flows. * Use spend caps, rate limits, monitoring, and alerts to bound and detect repeated leakage. * Apply policies that constrain account creation and closure in sponsored Solana transactions. * Treat account creation and account closure as first-class review criteria for sponsored Solana transactions. ### Strip `CloseAccount` instructions before submission One practical guardrail is to inspect the transaction payload before submission and remove SPL Token `CloseAccount` instructions. This is especially useful when you receive a prebuilt transaction from a routing service such as Jupiter and want to keep your sponsored flow from immediately refunding rent back to the signer. In the SPL Token program, `CloseAccount` is instruction discriminator `9`. A simple filter can remove those instructions before you hand the transaction to Turnkey: ```ts theme={"system"} const SPL_TOKEN_PROGRAM_IDS = new Set([ "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA", "TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb", ]); const CLOSE_ACCOUNT_INSTRUCTION_DISCRIMINATOR = 9; function isCloseAccountInstruction(ix: TransactionInstruction): boolean { return ( SPL_TOKEN_PROGRAM_IDS.has(ix.programId.toBase58()) && ix.data[0] === CLOSE_ACCOUNT_INSTRUCTION_DISCRIMINATOR ); } const filteredInstructions = txMessage.instructions.filter( (ix) => !isCloseAccountInstruction(ix), ); ``` This does not eliminate all rent-related risk, but it removes one of the most common leakage paths in sponsored swap flows. ### Disable Jupiter auto wrap and unwrap for SOL flows Another useful guardrail is to disable Jupiter's automatic SOL wrapping and unwrapping behavior when you request the swap transaction. When `wrapAndUnwrapSol` is enabled, Jupiter may create a temporary wSOL account for the transaction and then close it before completion. In a sponsored flow, that pattern can create a rent refund path back to the signer. To prevent that, set `wrapAndUnwrapSol` to `false` in the Jupiter API request: ```ts theme={"system"} body: JSON.stringify({ quoteResponse, userPublicKey: request.signWith, wrapAndUnwrapSol: false, dynamicComputeUnitLimit: true, prioritizationFeeLamports: "auto", }) ``` With this setting disabled, your application should manage wSOL explicitly instead of relying on Jupiter to create and close a temporary account on the user's behalf. This higher-control approach is often a better fit for sponsored flows because it lets you: * reuse a persistent wSOL account instead of creating a fresh one per swap * avoid automatic close-account behavior in the routed transaction * review account lifecycle decisions on the backend before submission For products with tighter controls, the strongest approach is usually to combine both mitigations: disable auto wrap and unwrap where possible, and still validate or sanitize the final instruction payload before sending it. ## Key custody matters If end users can export or independently control the signer key, these mitigations are less effective. A user who controls the signer can submit their own transaction to close previously created accounts and reclaim rent, bypassing any filtering your application applies. In these architectures, server-side mitigations like instruction filtering are no longer sufficient on their own. Spend caps, rate limits, monitoring, and policies become your primary line of defense. ## Policy guidance These example deny policies can help reduce common Solana rent-leakage patterns in sponsored flows. ### Deny sponsored Solana `CloseAccount` ```json theme={"system"} { "effect": "EFFECT_DENY", "condition": "solana.tx.instructions.any(i, (i.program_key == 'TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA' || i.program_key == 'TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb') && i.instruction_data_hex == '09')" } ``` ### Deny sponsored Solana account lifecycle ops ```json theme={"system"} { "effect": "EFFECT_DENY", "condition": "solana.tx.instructions.any(i, i.program_key == 'ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL') || solana.tx.instructions.any(i, (i.program_key == 'TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA' || i.program_key == 'TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb') && (i.instruction_data_hex == '09' || i.instruction_data_hex == '11'))" } ``` ## Next steps * See [Solana (SVM) support on Turnkey](/features/networks/solana) * See [Solana transaction construction for sponsored flows](/features/networks/solana-transaction-construction) * See [Sending Sponsored Solana Transactions](/features/transaction-management/sending-sponsored-solana-transactions) * See [Solana policy examples](/features/policies/examples/solana) # Solana transaction construction for sponsored flows Source: https://docs.turnkey.com/features/networks/solana-transaction-construction Understand what Turnkey manages for sponsored Solana transactions, what your application still controls, and the current transaction-construction caveats. ## Overview This page explains how Turnkey handles sponsored Solana transactions at submission time. The focus here is not how to build a Solana transaction from scratch. It is how Turnkey behaves when you submit an unsigned transaction through `solSendTransaction`: which values Turnkey preserves, which values Turnkey fills in if they are missing, and which rent-sponsorship constraints can affect account-creation flows. This is especially relevant if you accept prebuilt transactions from a backend, router, or third-party API. ## What Turnkey auto-manages Turnkey preserves the transaction values you provide where supported and fills in missing broadcast-time fields when needed. * **Recent blockhash**: if your transaction already includes a blockhash, Turnkey uses it as provided. This lets you time-bound the transaction yourself. If you do not provide one, Turnkey fetches and sets a fresh blockhash at broadcast time. * **Compute budget instructions**: if your transaction already includes compute budget instructions for compute unit limit or compute unit price, Turnkey uses those values. If you do not provide them, Turnkey estimates and sets competitive values at broadcast time. * **Broadcast and monitoring**: Turnkey broadcasts the transaction and tracks its lifecycle. You can retrieve the latest status through the [Get Send Transaction Status](/api-reference/queries/get-send-transaction-status) endpoint. ## Current Solana transaction-construction constraints Sponsored Solana transaction support is intentionally conservative in the current implementation. * Turnkey currently requires the `System Program` to appear in the transaction's static account keys, not through an address lookup table. * Turnkey currently supports one Turnkey signer per transaction. * That signer model has an important consequence for account creation in sponsored flows: Turnkey does not currently support top-level `createAccount` or `createAccountWithSeed` instructions, because those outer account-creation instructions require two signatures. In practice, this does not mean account creation is uncommon in sponsored Solana flows. In many applications, accounts are created inside program execution through `invoke_signed` rather than as top-level system instructions. If your sponsored flow depends on account creation, prefer program-driven flows and validate any prebuilt transaction before submission. ## Designing safe sponsored flows For most products, the safest approach is to validate or construct sponsored Solana transactions on the backend rather than blindly forwarding arbitrary user-supplied payloads. Recommended guardrails: * treat account creation and account closure as first-class review criteria * prefer a constrained set of known transaction patterns over arbitrary routed transactions * reuse persistent token accounts where possible instead of creating and closing temporary ones repeatedly * inspect third-party-built transactions before submission, especially when they may wrap and unwrap SOL or close accounts automatically If you use a routing service such as Jupiter, review the final instruction payload carefully. Temporary account creation and `CloseAccount` behavior are common sources of rent leakage and sponsorship surprises. See [Solana Rent Sponsorship](/features/networks/solana-rent-refunds) for refund-path risk and mitigation guidance. ## Next steps * See [Solana (SVM) support on Turnkey](/features/networks/solana) * See [Solana Rent Sponsorship](/features/networks/solana-rent-refunds) * See [Sending Sponsored Solana Transactions](/features/transaction-management/sending-sponsored-solana-transactions) # Spark support on Turnkey Source: https://docs.turnkey.com/features/networks/spark [Spark](https://www.spark.money/) is a Bitcoin Layer 2 that uses FROST threshold signing across a collective of operators to enable fast, low-fee transfers and Lightning payments without giving up self-custody of the underlying BTC. Turnkey provides enclave-based key management for Spark: your identity key, leaf keys, deposit keys, and Lightning preimages are generated and used inside the Turnkey enclave. None of this key material ever leaves it, with the lone exception being the [static deposit flow](#static-deposits-export-a-key-from-the-enclave). This flow, by necessity, exports one deposit key so a Spark Service Provider can process deposits while your wallet is offline, and that key stops mattering once you claim the deposit. If you don't know the protocol, read [Spark core concepts](https://docs.spark.money/learn/core-concepts) and [Sovereignty](https://docs.spark.money/learn/sovereignty) first. This page covers what Turnkey adds to a Spark integration. ## How Spark works (and where Turnkey fits) A Spark *leaf* is an individual unit of BTC held inside the protocol. Leaves are jointly controlled by your identity key and the Spark Operators using FROST threshold signing: no single party can move a leaf, and every leaf operation requires a quorum of operators to co-sign with you. The trust model is **1-of-n**: as long as at least one operator is honest, your funds cannot be stolen. If every operator is unavailable you cannot transact, but you can still exit to Bitcoin L1 using transactions pre-signed at deposit time (see [Security model](#security-model)). Three external roles to know: * **Spark Operator (SO).** A node in the operator collective that holds a threshold key share for every leaf. The current operators are Lightspark and Flashnet. * **Spark Entity (SE).** The SOs acting together. A quorum of the SE is required to authorize any leaf operation. * **Spark Service Provider (SSP).** An application-layer service (a wallet backend, an exchange, etc.) that coordinates flows on your behalf: routing Lightning payments, processing static deposits, submitting transfers. The SSP has no key-share authority over leaves; it relies on the SOs for that. Turnkey is none of these. It runs the secure enclave that holds your identity key and derives leaf keys, deposit keys, and Lightning preimages. When a flow needs your signature, the client calls a Turnkey activity ([`SPARK_SIGN_FROST`](/api-reference/activities/sign-frost-spark), [`SPARK_PREPARE_TRANSFER`](/api-reference/activities/prepare-spark-transfer), [`SPARK_CLAIM_TRANSFER`](/api-reference/activities/claim-spark-transfer), or [`SPARK_PREPARE_LIGHTNING_RECEIVE`](/api-reference/activities/spark-prepare-lightning-receive)) and the enclave does the cryptographic work without returning key material. All communication with SOs and the SSP happens directly from the client; Turnkey is not on those paths. ```mermaid theme={"system"} graph LR subgraph TK["Inside Turnkey"] E["Secure enclave
• holds your keys
• signs (FROST, Schnorr, ECDSA)
• encrypts operator packages
• derives HD subkeys"] end C["Client SDK
(orchestrator)"] subgraph SP["External Spark + L1"] direction TB SO["Spark Operators (SE)"] SSP["Spark Service Provider"] L1["Bitcoin L1"] end E <-->|"signature shares,
encrypted packages"| C C <-->|"FROST + leaf state"| SO C <-->|"Lightning, transfers,
static deposits"| SSP C -->|"signed Bitcoin txs"| L1 ``` Turnkey only connects to the client. SO, SSP, and L1 communication happens directly from the client; Turnkey is not on those paths. ## Address derivation and key types Spark uses a unique BIP-32 purpose number (`8797555`) rather than the standard BIP-44 coin type system. Every Spark key is a hardened child of `m/8797555'/{account}'`, with the next path segment selecting the key type: | Type | Path segment | Per-item derivation | Purpose | | ------------------- | ------------ | --------------------------------------------------------------------- | ---------------------------------------------------------------------------- | | `IDENTITY` | `/0'` | flat (used as is) | Primary wallet identifier; the key behind `ADDRESS_FORMAT_SPARK_*` addresses | | `SIGNING_HD` | `/1'` | hardened child at `u32_be(sha256(leaf_id)[0..4]) % 2^31` | Base key for per-leaf signing keys | | `DEPOSIT` | `/2'` | flat (used as is) | Single-use L1 deposit address | | `STATIC_DEPOSIT_HD` | `/3'` | hardened child at `index` | Reusable deposit addresses (SSP integration) | | `HTLC_PREIMAGE_HD` | `/4'` | not exposed for signing; used only for HMAC-SHA256 inside the enclave | Lightning HTLC preimage generation | The supported `IDENTITY` address formats are: | Network | Address format | HRP | | ------- | ------------------------------ | --------- | | Mainnet | `ADDRESS_FORMAT_SPARK_MAINNET` | `spark` | | Regtest | `ADDRESS_FORMAT_SPARK_REGTEST` | `sparkrt` | When creating a wallet account via the Turnkey dashboard or API, select `ADDRESS_FORMAT_SPARK_MAINNET` or `ADDRESS_FORMAT_SPARK_REGTEST` and the identity path will be set automatically. Only `secp256k1` keys are supported; `ed25519` keys will be rejected. ### Signing configurations When you call [`SIGN_RAW_PAYLOAD`](/api-reference/activities/sign-raw-payload) with a Spark identity address as `signWith`, as in the case of signing Spark token transactions (example [here](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-spark)), Turnkey produces a **plain BIP-340 Schnorr** signature — without the Taproot key tweak that Bitcoin P2TR addresses require (see [Bitcoin Schnorr signatures and tweaks](/features/networks/bitcoin#schnorr-signatures-and-tweaks) for the contrast). Generally, Turnkey will pick the scheme from the address format passed as `signWith`: | `signWith` address | Signing scheme | | --------------------- | ------------------------- | | Bitcoin P2TR | Tweaked Schnorr (BIP-341) | | Spark Mainnet/Regtest | Plain Schnorr (BIP-340) | | All others | ECDSA | The `hashFunction` field should match how the payload was prepared (e.g. `HASH_FUNCTION_NO_OP` for a pre-hashed payload). The returned signature always has `V = "00"` since Schnorr signatures do not carry a recovery ID. This scheme selection applies only to `SIGN_RAW_PAYLOAD`. The Spark-specific activities sign with whatever the protocol expects regardless of address format — for example, [`SPARK_PREPARE_TRANSFER`](/api-reference/activities/prepare-spark-transfer) signs its `transferUserSignature` with the identity key using **ECDSA** (DER-encoded), not Schnorr. This identity-key signing path is sufficient on its own for token operations via the Spark SDK (`@buildonspark/spark-sdk`, `@buildonspark/issuer-sdk`). The FROST-based flows below require the additional Spark-specific activities. For more information on Spark keys and address derivation, see documentation [here](https://docs.spark.money/wallets/identity-key-derivation). ## Turnkey activities for Spark Four activities cover the Spark-specific cryptographic operations. All of them run inside the enclave; none return key material to the client. | Activity | What it does | | ---------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [`SPARK_SIGN_FROST`](/api-reference/activities/sign-frost-spark) | Returns the enclave's FROST signature share for a sighash, or for a batch of them in one call. Used by deposits, withdrawals, transfers, and static deposit claims. | | [`SPARK_PREPARE_TRANSFER`](/api-reference/activities/prepare-spark-transfer) | Sender side of a transfer. Produces an encrypted transfer package: per-leaf key tweaks Feldman-VSS-split for the SOs, the recipient's new leaf key ECIES-encrypted to their identity public key, and your identity-key ECDSA signature over the whole thing. | | [`SPARK_CLAIM_TRANSFER`](/api-reference/activities/claim-spark-transfer) | Receiver side of a transfer. Decrypts the inbound leaf-key ciphertext with your identity key, derives the new leaf key, and packages the claim tweak shares for the SOs. | | [`SPARK_PREPARE_LIGHTNING_RECEIVE`](/api-reference/activities/spark-prepare-lightning-receive) | Returns only the `paymentHash` for a freshly generated Lightning preimage. The preimage itself is created inside the enclave, Feldman-split across the SOs (each share ECIES-encrypted to its operator), and never leaves whole. The hash is what you put in the BOLT11 invoice. | These don't replace Turnkey's existing primitives. Spark flows also use [`CREATE_WALLET_ACCOUNTS`](/api-reference/activities/create-wallet-accounts) to derive new deposit and signing keys, [`SIGN_RAW_PAYLOAD`](/api-reference/activities/sign-raw-payload) for identity-key Schnorr signatures, [`SIGN_TRANSACTION`](/api-reference/activities/sign-transaction) for the Bitcoin L1 transactions that fund deposits or receive cooperative withdrawals, and [`EXPORT_WALLET_ACCOUNT`](/api-reference/activities/export-wallet-account) in exactly one flow — see [Static deposits export a key from the enclave](#static-deposits-export-a-key-from-the-enclave). ## Supported operations Turnkey supports every Spark wallet operation. For a runnable walkthrough of each flow, including the exact sequence of Turnkey, SO, and SSP calls, see the [SDK example](#sdk-example). | Operation | Direction | Turnkey activities used | | ---------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | | Deposit | Bitcoin L1 → Spark (single-use address; also produces the [pre-signed exit transactions](#pre-signed-exit-transactions-are-seed-phrase-equivalent)) | `SIGN_TRANSACTION`, `SPARK_SIGN_FROST` | | Cooperative withdrawal | Spark → Bitcoin L1 (fast path; requires SO co-signing; falls back to unilateral exit below if SOs are unavailable) | `SPARK_SIGN_FROST`, `SPARK_PREPARE_TRANSFER` | | Unilateral exit | Spark → Bitcoin L1 (emergency path; no SO cooperation needed) | none at exit time; broadcasts the [pre-signed transactions](#pre-signed-exit-transactions-are-seed-phrase-equivalent) created during deposit | | Transfer | Spark → Spark | `SPARK_SIGN_FROST`, `SPARK_PREPARE_TRANSFER` (sender); `SPARK_SIGN_FROST`, `SPARK_CLAIM_TRANSFER` (receiver) | | Lightning receive | Lightning → Spark | `SPARK_PREPARE_LIGHTNING_RECEIVE` | | Lightning send | Spark → Lightning | `SPARK_SIGN_FROST`, `SPARK_PREPARE_TRANSFER` | | Static deposit | Bitcoin L1 → Spark (reusable address) | `CREATE_WALLET_ACCOUNTS`, `EXPORT_WALLET_ACCOUNT`, `SIGN_TRANSACTION` | | Token transfer | Spark token operations (mint, transfer) | `SIGN_RAW_PAYLOAD` | ## Security model ### Pre-signed exit transactions must be secured When you deposit BTC into Spark, the deposit flow pre-signs two Bitcoin L1 transactions inside the Turnkey enclave: a branch transaction and a timelocked exit transaction. These are your unilateral exit path. If every Spark Operator goes offline or acts maliciously, you can broadcast them directly to Bitcoin L1 and recover your BTC without operator cooperation. Per the [Spark sovereignty docs](https://docs.spark.money/learn/sovereignty), exiting can take "as little as 100 blocks" (\~16 hours) — the actual wait depends on leaf depth and how recently the leaf was transferred, since timelocks decrement at each transfer. The corollary: **these transactions must be stored durably.** If they are lost and the SOs are unavailable, your recovery path is gone. Treat them with the same care as a seed phrase — durable, encrypted, off-device storage, with backups. Turnkey does not explicitly retain them; it signs them once at deposit time and returns them to the client. SDKs that wrap Spark model this for you: in the Breez SDK, each leaf's pre-signed exit transaction is the [`refund_tx` field on its `TreeNode`](https://github.com/breez/spark-sdk/blob/aef4a0d8939bb6ed86d9b229116afd9d450d8886/crates/spark/src/tree/mod.rs#L161), saved and reloaded through the SDK's `TreeStore`. If you build on such an SDK, configure a durable, backed-up `TreeStore` backend rather than relying on the default in-memory store. This is the property that makes Spark Operator unavailability a *liveness* concern rather than a *safety* concern: you may not be able to transact, but you can always exit. ### Static deposits export a key from the enclave Static deposit addresses are reusable: one address can receive many deposits, each creating a separate Spark leaf. To make that work, the SSP needs to process deposits while your wallet is offline, which means it needs co-signing capability on the static deposit key. Static deposits are the **only** Spark flow that takes a raw private key out of the Turnkey enclave. The flow uses [`EXPORT_WALLET_ACCOUNT`](/api-reference/activities/export-wallet-account) to export the static deposit key so it can be shared with the SSP. Every other Spark flow keeps all key material inside the enclave. This is the intentional custodial tradeoff of static deposits — expected behavior, not a leak. The exported key controls only the **static deposit address**; it cannot move existing leaves or touch your identity key. To minimize exposure while the key is in transit: * Use a fresh ephemeral P-256 keypair for each export and zero it immediately after decrypting. * Transmit the key to the SSP only over an encrypted channel. * Zero the key in your local memory immediately after transmission. **The exported key stops mattering once you claim the deposit.** Claiming runs through [`SPARK_CLAIM_TRANSFER`](/api-reference/activities/claim-spark-transfer), which rotates the leaf to a fresh key derived inside your enclave; after that, the exported static deposit key has no authority over the funds. **The risk window.** A static deposit address is an aggregate of your static deposit key and the Spark Operators' key, so moving funds out of it requires a signature from both. Between the moment funds arrive at the address and the moment you claim them, the SSP holds your half of that key. During this window — and only this window — an SSP that **colludes with the Spark Operators** could co-sign a spend of the unclaimed deposit. This is the same operator-trust boundary described in Spark's [sovereignty model](https://docs.spark.money/learn/sovereignty); use only SSPs you trust, and claim deposits promptly to keep the window short. If you don't need a reusable receiving address, prefer single-use deposits. They keep key material inside the enclave throughout. ### Communication with SOs and the SSP is outside Turnkey Every Spark flow involves direct calls from the client to the Spark Operators (for nonce commitments, partial signatures, leaf state queries, and claim submissions) and, for some flows, to the SSP. Turnkey is not on these network paths and does not see this traffic. The client SDK is responsible for SO and SSP communication; the Turnkey enclave is responsible for the cryptographic operations on key material. The SDK example shows where each of these responsibilities sits. ## SDK example The canonical reference for integrating Turnkey with Spark is [`examples/chain-integrations/with-spark`](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-spark) in the Turnkey SDK monorepo. It contains: * A Turnkey-backed Spark signer (`TurnkeySparkSigner`) that plugs into the Spark SDK. * Token-operation scripts (create, mint, transfer) using the issuer SDK. * (Coming soon) End-to-end runnable flows for deposit, transfer (send + claim), withdrawal, Lightning receive and send, and static deposit. * Comments mapping each step to the actor model above. If you're integrating Spark, start with the SDK example and refer back to this page for the conceptual model and the security notes. ## Additional resources * [Spark addressing specification](https://docs.spark.money/wallets/addressing) * [Spark identity-key derivation](https://docs.spark.money/wallets/identity-key-derivation) * [BIP-340: Schnorr Signatures for secp256k1](https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki) If you're building on Spark and have questions about integrating with Turnkey, contact us at [hello@turnkey.com](mailto:hello@turnkey.com), on [X](https://x.com/turnkeyhq/), or [on Slack](https://join.slack.com/t/clubturnkey/shared_invite/zt-3aemp2g38-zIh4V~3vNpbX5PsSmkKxcQ). # Stacks Source: https://docs.turnkey.com/features/networks/stacks ## Address derivation Turnkey supports Stacks address derivation with `ADDRESS_FORMAT_COMPRESSED` and `ADDRESS_FORMAT_UNCOMPRESSED` address formats. Stacks addresses are derived from the secp256k1 curve, which Turnkey fully supports. ## Transaction construction and signing Turnkey supports Stacks transaction signing through the core signing capabilities. We have an example repository that demonstrates how to construct and sign Stacks transactions: > [examples/chain-integrations/with-stacks:](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-stacks) A sample script that demonstrates how to sign a [Stacks](https://docs.hiro.so/stacks/stacks.js) transaction with Turnkey. Stacks uses the secp256k1 cryptographic curve for transaction signing, but there is some specific data formatting that takes place for the [signing process](https://github.com/stacksgov/sips/blob/main/sips/sip-005/sip-005-blocks-and-transactions.md#transaction-signing-and-verifying). ## Key features for Stacks * **secp256k1 signing**: Turnkey fully supports secp256k1 curve used by Stacks * **Raw Transaction Signing**: Sign any Stacks transaction format with Turnkey's flexible signing API * **Integration Example**: Our example repository provides a reference implementation ## Benefits of using Turnkey with Stacks * **Secure Key Management**: Private keys never leave Turnkey’s secure infrastructure * **Developer Friendly**: Integrate with existing Stacks development workflows * **Signing Policies**: Apply custom policies to control transaction approvals * **Multi-address Support**: Manage multiple Stacks addresses under a single organization # Sui support on Turnkey Source: https://docs.turnkey.com/features/networks/sui ## Address derivation Turnkey supports Sui address derivation with `ADDRESS_TYPE_SUI`. Sui addresses are derived from the Ed25519 curve, which Turnkey fully supports. ## Transaction construction and signing Turnkey supports Sui transaction signing through the core signing capabilities. We provide an example repository that demonstrates how to construct and sign Sui transactions: * [`examples/chain-integrations/with-sui`](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-sui): demonstrates transaction construction and broadcast on Sui. ## Example Here's a practical example showing how to integrate Turnkey with the [Sui SDK](https://sdk.mystenlabs.com/typescript): ```typescript expandable theme={"system"} import * as dotenv from 'dotenv'; import * as path from 'path'; import { SuiClient, getFullnodeUrl } from '@mysten/sui/client'; import { Transaction } from '@mysten/sui/transactions'; import { Ed25519PublicKey } from '@mysten/sui/keypairs/ed25519'; import { messageWithIntent } from '@mysten/sui/cryptography'; import { Turnkey } from '@turnkey/sdk-server'; import { blake2b } from '@noble/hashes/blake2b'; import { bytesToHex } from '@noble/hashes/utils'; dotenv.config({ path: path.resolve(process.cwd(), '.env.local') }); function toSerializedSignature({ signature, pubKey, }: { signature: Uint8Array; pubKey: Ed25519PublicKey; }): string { const scheme = new Uint8Array([0x00]); // ED25519 flag const pubKeyBytes = pubKey.toRawBytes(); const serialized = new Uint8Array( scheme.length + signature.length + pubKeyBytes.length ); serialized.set(scheme, 0); serialized.set(signature, scheme.length); serialized.set(pubKeyBytes, scheme.length + signature.length); return Buffer.from(serialized).toString('base64'); } async function main() { // load the variables from .env // SUI_ADDRESS and SUI_PUBLIC_KEY of the Turnkey signer const { ORGANIZATION_ID, API_PRIVATE_KEY, API_PUBLIC_KEY, SUI_ADDRESS, SUI_PUBLIC_KEY, } = process.env; // sending to the same address const recipient = SUI_ADDRESS; const amount = 1_000_000n; // 0.001 SUI const turnkeyClient = new Turnkey({ apiBaseUrl: 'https://api.turnkey.com', apiPrivateKey: API_PRIVATE_KEY!, apiPublicKey: API_PUBLIC_KEY!, defaultOrganizationId: ORGANIZATION_ID!, }); const provider = new SuiClient({ url: getFullnodeUrl('testnet') }); const publicKey = new Ed25519PublicKey(Buffer.from(SUI_PUBLIC_KEY!, 'hex')); if (publicKey.toSuiAddress() !== SUI_ADDRESS) { throw new Error('SUI_PUBLIC_KEY does not match SUI_ADDRESS'); } // fetch the user's SUI coin objects const coins = await provider.getCoins({ owner: SUI_ADDRESS!, coinType: '0x2::sui::SUI', }); if (!coins.data.length) throw new Error('No SUI coins'); const tx = new Transaction(); tx.setSender(SUI_ADDRESS!); tx.setGasPrice(await provider.getReferenceGasPrice()); tx.setGasBudget(5_000_000n); tx.setGasPayment([ { objectId: coins.data[0]!.coinObjectId, version: coins.data[0]!.version, digest: coins.data[0]!.digest, }, ]); const coin = tx.splitCoins(tx.gas, [tx.pure('u64', amount)]); tx.transferObjects([coin], tx.pure.address(recipient)); const txBytes = await tx.build(); const intentMsg = messageWithIntent('TransactionData', txBytes); const digest = blake2b(intentMsg, { dkLen: 32 }); const { r, s } = await turnkeyClient.apiClient().signRawPayload({ signWith: SUI_ADDRESS!, payload: bytesToHex(digest), encoding: 'PAYLOAD_ENCODING_HEXADECIMAL', hashFunction: 'HASH_FUNCTION_NOT_APPLICABLE', }); const signature = Buffer.from(r + s, 'hex'); const serialized = toSerializedSignature({ signature, pubKey: publicKey }); const result = await provider.executeTransactionBlock({ transactionBlock: Buffer.from(txBytes).toString('base64'), signature: serialized, requestType: 'WaitForEffectsCert', options: { showEffects: true }, }); console.log('Transaction digest:', result.digest); } main().catch((err) => { console.error('Error:', err); process.exit(1); }); ``` ## Sui network support Turnkey supports: * Sui Mainnet * Sui Testnet * Sui Devnet ## Key features for Sui * **Ed25519 Signing**: Turnkey fully supports the Ed25519 curve used by Sui * **Raw Transaction Signing**: Sign any Sui transaction format with Turnkey's flexible signing API * **Integration Example**: Our example repository provides a reference implementation ## Benefits of using Turnkey with Sui * **Secure Key Management**: Private keys never leave Turnkey's secure infrastructure * **Developer Friendly**: Integrate with existing Sui development workflows * **Signing Policies**: Apply custom policies to control transaction approvals * **Multi-user Support**: Manage multiple Sui addresses under a single organization If you're building on Sui and need assistance with Turnkey integration, feel free to contact us at [hello@turnkey.com](mailto:hello@turnkey.com), on [X](https://x.com/turnkeyhq/), or [on Slack](https://join.slack.com/t/clubturnkey/shared_invite/zt-3aemp2g38-zIh4V~3vNpbX5PsSmkKxcQ). # Tempo support on Turnkey Source: https://docs.turnkey.com/features/networks/tempo Tempo is a general-purpose blockchain optimized for payments. Tempo is designed to be a low-cost, high-throughput blockchain with user and developer features targeting modern payment systems including first-class stablecoin support. More on [Tempo here](https://docs.tempo.xyz/). ## Address derivation Turnkey supports Tempo address derivation with `ADDRESS_TYPE_ETHEREUM`. ## Transaction construction and signing Turnkey supports both transaction types on Tempo: * [Ethereum legacy transactions](https://docs.tempo.xyz/quickstart/evm-compatibility#transaction-differences) with full parsing & policy support * Tempo transactions with full parsing & policy support via the `tempo.tx` namespace Tempo transactions natively support batched calls — multiple calls can be sent atomically in a single transaction. See the [policy language reference](/features/policies/language#tempo) and [Tempo policy examples](/features/policies/examples/tempo) for details on governing Tempo transactions. ## Examples We have an example repository that demonstrates how to construct and sign Tempo transactions: * [`examples/chain-integrations/with-tempo`](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-tempo): demonstrates single and batched (multicall) transaction construction and broadcast on Tempo, including fee sponsorship. Legacy Ethereum transactions on Tempo can be utilized on Turnkey with [viem](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-viem) and [ethers](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-ethers). ## Tempo network support Turnkey supports: * Tempo Mainnet * Tempo Testnet (Moderato) ## Key features for Tempo * **Full policy engine support**: Govern Tempo transactions with granular policies using the `tempo.tx` namespace — control call destinations, function selectors, gas limits, fee tokens, and more * **Batch call support**: Write policies over Tempo's native batch calls using `tempo.tx.calls` with list quantifiers (`all`, `any`, `count`) * **Raw calldata inspection**: Inspect ABI-encoded arguments in call input data using [slicing](/features/policies/examples/tempo#raw-calldata-inspection) (e.g. `tempo.tx.calls[0].input[34..74]`) * **Out of the box Legacy EVM TX support**: Turnkey fully supports the legacy transaction type on Tempo * **Native gas sponsorship**: Our example repository provides a reference implementation for building transactions with Tempo's native gas sponsorship ## Benefits of using Turnkey with Tempo * **Secure Key Management**: Private keys are securely stored in Turnkey's infrastructure * **Policy Controls**: Apply custom policies to authorize transactions based on criteria including call destinations, function selectors, and calldata contents * **Developer-Friendly**: Integrate with existing Tempo development workflows * **Multi-environment Support**: Use the same code across testnet and mainnet environments If you're building on Tempo and need assistance with your Turnkey integration, feel free to contact us at [hello@turnkey.com](mailto:hello@turnkey.com), on [X](https://x.com/turnkeyhq/), or [on Slack](https://join.slack.com/t/clubturnkey/shared_invite/zt-3aemp2g38-zIh4V~3vNpbX5PsSmkKxcQ). # Tron support on Turnkey Source: https://docs.turnkey.com/features/networks/tron ## Address derivation Turnkey supports Tron address derivation with `ADDRESS_TYPE_TRON`. Tron addresses are derived from the same SECP256k1 curve that is used for Ethereum addresses, but with a different address encoding format. ## Transaction construction and signing Tron's transaction format is supported for signing in Turnkey. You can use the core signing capabilities to sign Tron transactions by constructing the transaction following the Tron protocol specifications and then using Turnkey's signing API. ## Example Here's a more complete example of how to integrate Turnkey with TronWeb for transaction signing: ```typescript [expandable] theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; import { TronWeb } from "tronweb"; // Initialize Turnkey client const turnkeyClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPrivateKey: process.env.API_PRIVATE_KEY, apiPublicKey: process.env.API_PUBLIC_KEY, defaultOrganizationId: process.env.ORGANIZATION_ID, }); // Initialize TronWeb without a private key const tronWeb = new TronWeb({ fullHost: "https://api.shasta.trongrid.io", // Testnet }); const turnkeyAddress = process.env.TRON_ADDRESS; // Your Tron address in Turnkey const recipientAddress = "TYour_Recipient_Address"; const amount = 100; // Amount in SUN (1 TRX = 1,000,000 SUN) // 1. Create an unsigned transaction const unsignedTx = await tronWeb.transactionBuilder.sendTrx( recipientAddress, amount, turnkeyAddress ); // Sign with Turnkey const { r, s, v } = await turnkeyClient.apiClient().signRawPayload({ organizationId: process.env.ORGANIZATION_ID, signWith: turnkeyAddress, payload: unsignedTx.raw_data_hex, encoding: "PAYLOAD_ENCODING_HEXADECIMAL", }); // Add the signature to the transaction unsignedTx["signature"] = r + s + v; // 3. Broadcast the signed transaction const result = await tronWeb.trx.sendRawTransaction(unsignedTx); console.log("Transaction sent! ID:", result.txid); ``` ## Tron transaction types You can use Turnkey to sign various Tron transaction types: * TRX transfers * TRC10 token transfers * TRC20 token transfers (smart contract interactions) * Smart contract deployments * Smart contract function calls * Delegate/UnDelegate resource to another user * Freeze/Unfreeze TRX to receives resources * Update account permission to implement multisig ## Networks Turnkey supports: * Tron Mainnet * Tron Shasta Testnet * Tron Nile Testnet ## Policy engine integration The policy engine currently supports the following Tron contract types: * TransferContract - TRX transfers * TriggerSmartContract - Smart contract, including but not limited to TRC-20, invocations * DelegateResourceContract - Delegate resources, bandwidth or energy, to another user, use for gas sponsorship * UnDelegateResourceContract - UnDelegate the resources delegated to an user * FreezeBalanceV2Contract - Freeze TRX to receive bandwidth or energy * UnfreezeBalanceV2Contract - Unfreeze frozen TRX * AccountPermissionUpdateContract - Update permissions on an account, can be used for [multisig](https://developers.tron.network/docs/multi-signature) A full field breakdown can be found in our [policy language definition](/features/policies/language) and examples can be found in [Tron policy examples](/features/policies/examples/tron) To reference a Tron contract in the policy language you must specify the index of the contract in the contracts array: `tron.tx.contract[0]`. While Tron only currently supports 1 contract in this array, this could change in the future. ## Integration with Tron tools Turnkey can be integrated with popular Tron development tools such as: * [TronWeb](https://github.com/tronprotocol/tronweb) - The official JavaScript API for interacting with the Tron network * [TronBox](https://github.com/tronprotocol/tronbox) - A development framework for Tron smart contracts ## Benefits of using Turnkey with Tron * **Enhanced Security**: Private keys never leave Turnkey's secure infrastructure * **Policy Controls**: Apply transaction policies to control what can be signed * **Simplified Key Management**: No need to manage private keys in your application code * **Multi-signature Support**: Enable quorum-based approvals for transactions If you have any questions about using Turnkey with Tron or need assistance with integration, feel free to contact us at [hello@turnkey.com](mailto:hello@turnkey.com), on [X](https://x.com/turnkeyhq/), or [on Slack](https://join.slack.com/t/clubturnkey/shared_invite/zt-3aemp2g38-zIh4V~3vNpbX5PsSmkKxcQ). # Organizations Source: https://docs.turnkey.com/features/organizations An organization is a logical grouping of resources (e.g. users, policies, wallets). These resources can only be accessed by authorized and permissioned users within the organization. Resources are not shared between organizations. ## Root quorum All organizations are controlled by a [Root Quorum](/features/users/root-quorum) which contains the root users and the required threshold of approvals to take any action. Only the root quorum can update the root quorum or feature set. ## Features Organization features are Turnkey product offerings that organizations can opt-in to or opt-out of. Note that these features can be set and updated using the activities `ACTIVITY_TYPE_SET_ORGANIZATION_FEATURE` and `ACTIVITY_TYPE_REMOVE_ORGANIZATION_FEATURE`. The following is a list of such features: | Name | Description | Default | Notes | | -------------------------------- | --------------------------------------------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | FEATURE\_NAME\_EMAIL\_AUTH | Enables email bundle authentication | Enabled | The `email_auth` activity can only be initiated by a parent organization for a sub-organization. | | FEATURE\_NAME\_OTP\_EMAIL\_AUTH | Enables email OTP authentication | Enabled | The `init_otp`, `verify_otp` and `otp_login` activities can only be initiated by a parent organization for a sub-organization. | | FEATURE\_NAME\_WEBAUTHN\_ORIGINS | The origin Webauthn credentials are scoped to | Disabled | Parent organization feature applies to all sub-organizations. If not enabled, sub-organizations default to allowing all origins: "\*". For Passkey WaaS, we highly recommend enabling this feature. Example value: "[https://www.turnkey.com"](https://www.turnkey.com%22) | | FEATURE\_NAME\_WEBHOOK | A URL to receive activity notification events | Disabled | Example value: "[https://your.service.com/webhook"](https://your.service.com/webhook%22) | ## Permissions All activity requests are subject to enforcement by Turnkey's policy engine. The policy engine determines if a request is allowed by checking the following: * Does this request violate our feature set? * Email auth cannot be initiated if disabled * Should this request be denied by default? * All import requests must target your own user * Does this request meet the root quorum threshold? * What is the outcome of evaluating this request against all organization policies? Outcomes include: * `OUTCOME_ALLOW`: the request is allowed to process * `OUTCOME_REQUIRES_CONSENSUS`: the request needs additional approvals * `OUTCOME_REJECTED`: the request should be rejected * `OUTCOME_DENY_EXPLICIT`: the request has been explicitly denied via policies * `OUTCOME_DENY_IMPLICIT`: the request has been implicitly denied as no policies grant the required permissions * Should this request be allowed by default? * Users can manage their own credentials unless policies explicitly deny this ## Resource limits Organizations have [resource limits](/reference/resource-limits) for performance and security considerations. If you're bumping into these limits, check out sub-organizations below. ## Sub-organizations A sub-organization is an isolated organization that has a pointer to a parent organization. The parent organization has **read** access to all sub-organizations, but no **write** access. This means users within the parent organization have no ability to use wallets or alter any resources in the sub-organization. For more information on sub-organizations and common use cases for this functionality, follow along in the next section. # End-User Delegated Agent Signing Source: https://docs.turnkey.com/features/policies/delegated-access/agentic-wallets Let embedded wallet users delegate scoped signing authority to AI agents, controlled by granular policies ## What is an agentic wallet? An agentic wallet is a crypto wallet that an AI agent or automated backend can operate programmatically—signing transactions, interacting with smart contracts, and executing onchain strategies without requiring human approval for every action. This enables a new class of onchain applications: * Autonomous trading bots * DeFi yield optimizers * AI portfolio managers * Automated payment processors * Multi-agent coordination systems **The core challenge is trust.** Giving an agent unrestricted access to a wallet's private key is dangerous. The solution is **delegated access with granular policy controls**: the agent gets a credential that can only perform specific actions, and every signing request is evaluated against those rules before the enclave produces a signature. ## Why build on Turnkey * **Private keys never leave the secure enclave** - Unlike solutions that expose raw keys, Turnkey generates and stores keys in hardware-backed secure enclaves. Your agent authenticates via an API key and receives signatures—it never touches the private key itself. * **Sub-100ms signing latency** - Signing speeds 100x faster than MPC-based alternatives, enabling agents to react to market movements and onchain events in real time. [Transaction Management](/features/transaction-management) automates construction, gas sponsorship, and broadcasting. * **Granular policy engine** - Every signing request is evaluated by Turnkey's [Policy Engine](/features/policies/overview) inside the secure enclave before a signature is produced. Scope exactly what the agent can sign by recipient address, contract address, function selector, chain ID, and transaction value limits. * **Multi-chain support** - One integration covers EVM chains, Solana, Bitcoin, Tron, and any blockchain using supported cryptographic curves. * **Consensus for high-stakes actions** - For sensitive operations, require both the agent and a human (or another agent) to approve a transaction before it executes. Provides defense-in-depth even if the agent behaves unexpectedly. * **Framework agnostic** - Low-level cryptographic primitives without imposing opinions on your agent architecture. Integrates naturally with LangChain, CrewAI, Vercel AI SDK, and agentic protocols like x402 and OpenClawd. ## Architecture The diagram below shows how an AI agent gets scoped access through [Delegated Access](/features/policies/delegated-access/overview): Agentic Wallet 1. **Setup**: The end user (root) creates a Delegated Access user and policies 2. **Request**: The AI agent sends signing requests using its API key 3. **Evaluation**: The Policy Engine evaluates the request inside the secure enclave 4. **Execution**: If approved, the wallet signs and the transaction is broadcast. If denied, it's rejected before a signature is produced. ### Three critical properties * **Separation of control**: The end user owns the wallet and sets the rules. The agent operates within those rules. * **Zero key exposure**: The agent never touches the private key. It receives signatures, not keys. * **Cryptographic enforcement**: Policies are evaluated in the secure enclave—no way to bypass them from application code. ## Quick start For a working end-to-end implementation, see the [with-agent-wallet example](https://github.com/tkhq/sdk/tree/main/examples/access-control/with-agent-wallet) — it covers wallet creation, agent user setup, policy creation, and a human approval flow. ### 1. create the wallet Each agentic wallet lives in a Turnkey sub-organization: ```typescript theme={"system"} const suborgParams = { userName: "User", customWallet: { walletName: "Agent-Enabled Wallet", walletAccounts: [{ curve: "CURVE_SECP256K1", pathFormat: "PATH_FORMAT_BIP32", path: "m/44'/60'/0'/0/0", addressFormat: "ADDRESS_FORMAT_ETHEREUM", }], }, }; ``` ### 2. add the agent as a delegated access user Create a P-256 API key user for your agent: ```typescript theme={"system"} import { fetchOrCreateP256ApiKeyUser } from "@turnkey/react-wallet-kit"; const daUser = await fetchOrCreateP256ApiKeyUser({ publicKey: agentPublicKey, createParams: { userName: "Trading Agent", apiKeyName: "Agent API Key", }, }); ``` **Key point**: The DA user has zero permissions by default. You must explicitly define what it can do. ### 3. define policies Scope the agent's authority with policies: ```typescript theme={"system"} const policies = [{ policyName: "Allow agent to send to treasury", effect: "EFFECT_ALLOW", consensus: `approvers.any(user, user.id == '${daUser.userId}')`, condition: `eth.tx.to == '${TREASURY_ADDRESS}'`, }]; await fetchOrCreatePolicies({ policies }); ``` For more complex scoping: ```json theme={"system"} { "effect": "EFFECT_ALLOW", "consensus": "approvers.any(user, user.id == '')", "condition": "eth.tx.to == '' && eth.tx.data[0..10] == '0x38ed1739' && eth.tx.chain_id == 1" } ``` ### 4. sign transactions Initialize the agent's Turnkey client and sign: ```typescript theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; import { TurnkeySigner } from "@turnkey/ethers"; const turnkey = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPrivateKey: process.env.AGENT_PRIVATE_KEY!, apiPublicKey: process.env.AGENT_PUBLIC_KEY!, defaultOrganizationId: subOrgId, }); const signer = new TurnkeySigner({ client: turnkey.apiClient(), organizationId: subOrgId, signWith: walletAddress, }); const tx = await signer.connect(provider).sendTransaction({ to: TREASURY_ADDRESS, value: ethers.parseEther("0.1"), }); ``` ## Common patterns ### Autonomous trading agent An AI agent that analyzes market data and executes trades on a DEX. The agent has a dedicated wallet with policies scoped to the DEX router contract and specific token pairs. For higher-value trades, a consensus policy requires both the agent and a risk-assessment service (another Turnkey user) to approve the transaction. ### DeFi yield optimizer An agent that moves user funds between yield protocols. Policies restrict the agent to a whitelist of approved protocol contracts and deposit/withdraw functions only. Use Turnkey's [smart contract interface upload feature](/features/policies/smart-contract-interfaces) to write policies against decoded ABI parameters. ### Automated payment processor A backend that sweeps user deposits to an omnibus wallet and processes payouts. The agent operates on an organization-level wallet with policies that restrict signing to specific payout addresses and require multi-party consensus for large transfers. ### Multi-agent coordination Multiple specialized agents share access to a wallet, each with different policy scopes. A research agent can read data and propose transactions; a trading agent can sign to approved contracts; a risk agent must co-approve high-value actions. Turnkey's consensus mechanism makes this natural: each agent is a separate user with its own API key and policy set. ## Security best practices **Principle of Least Privilege**: This is the single most important security practice for agentic wallets. An agent should only be able to do the minimum set of actions required for its task. If your agent sweeps funds to a treasury, it doesn't need permission to call arbitrary contracts. If it trades on Uniswap, restrict it to that router's address and the specific function selectors it uses. **Prefer Client-Side DA Setup**: When the end-user sets up delegated access from the frontend using their authenticated session, the DA user is created as non-root from the start. There is never a window where the agent has elevated privileges. The server-side approach requires temporarily adding the DA user to the root quorum, which introduces risk if the subsequent quorum update fails. **Use DENY Policies as Circuit Breakers**: DENY always overrides ALLOW in Turnkey's policy engine. Use DENY policies as circuit-breakers: for example, a DENY policy that blocks all signing for a specific wallet can be toggled on programmatically if anomalous behavior is detected, and it will override any ALLOW policies in place. **Include Self-Delete Permission**: Give the DA user permission to delete itself for fast remediation if compromised: ```json theme={"system"} { "policyName": "Allow agent to self-delete", "effect": "EFFECT_ALLOW", "consensus": "approvers.any(user, user.id == '')", "condition": "activity.type == 'ACTIVITY_TYPE_DELETE_USERS' && activity.params.user_ids.count() == 1 && '' in activity.params.user_ids" } ``` ### Rotate API keys regularly Use short-lived keys where viable, store in HSMs or secret managers, and monitor usage for anomalies. ### Require consensus for high-value actions For sensitive operations, require multiple approvers: ```json theme={"system"} { "consensus": "approvers.any(user, user.id == '') && approvers.any(user, user.id == '')", "condition": "activity.action == 'SIGN'", "effect": "EFFECT_ALLOW" } ``` ## Next steps
# Server-side delegated access setup Source: https://docs.turnkey.com/features/policies/delegated-access/backend Step by step implementation of the delegated access entirely server-side Before diving in, here’s what this setup accomplishes: You’ll create a **sub-organization** where the **end-user** has full control (root user) and a **Delegated Access (DA) user** (managed by your backend) can sign only specific transactions, for example, sending to approved recipient addresses. This ensures your backend can perform limited, policy-controlled actions on behalf of the user without ever holding their root privileges. The entire setup is initiated by your backend — no end-user interaction is required. A simple example demonstrating the server-side delegated access setup can be found [here](https://github.com/tkhq/sdk/tree/main/examples/access-control/with-delegated/server-side). ## Step-by-step implementation ### Step 1: create a sub-organization with two root users[​](#step-1-create-a-sub-organization-with-two-root-users) * Create your sub-organization with the two root users being: * The end-user * A user you control (we'll call it the ‘Delegated Account’) ```json theme={"system"} { "type": "ACTIVITY_TYPE_CREATE_SUB_ORGANIZATION_V7", "timestampMs": "", "organizationId": "your-organization-id", "parameters": { "subOrganizationName": "", "rootUsers": [ { "userName": "", "userEmail": "enduser@example.com", "authenticators": [ { "authenticatorName": "", "challenge": "", "attestation": { "credentialId": "", "clientDataJson": "", "attestationObject": "", "transports": ["AUTHENTICATOR_TRANSPORT_HYBRID"] } } ], "apiKeys": [], "oidcProviders": [] }, { "userName": "Delegated Account", "userEmail": "(optional)", "authenticators": [], "apiKeys": [ { "apiKeyName": "", "publicKey": "" } ], "oidcProviders": [] } ], "rootQuorumThreshold": 1, "wallet": { "walletName": "Default ETH Wallet", "accounts": [ { "curve": "CURVE_SECP256K1", "pathFormat": "PATH_FORMAT_BIP32", "path": "m/44'/60'/0'/0/0", "addressFormat": "ADDRESS_FORMAT_ETHEREUM" } ] } } } ``` ### Step 2: limit the permissions of the delegated account user via policies * Create a custom policy granting the Delegated Account specific permissions. You might grant that user permissions to: * Sign any transaction * Sign only transactions to a specific address * Create new users in the sub-org * Or any other activity you want to be able to take using your Delegated Account Here’s one example, granting the Delegated Account only the permission to sign ethereum transactions to a specific receiver address: ```json theme={"system"} { "type": "ACTIVITY_TYPE_CREATE_POLICY", "timestampMs": "", "organizationId": "sub-organization-id", "parameters": { "policyName": "Allow Delegated Account to sign transactions to specific address", "policy": { "effect": "EFFECT_ALLOW", "consensus": "approvers.any(user, user.id == )", "condition": "eth.tx.to == " }, } } ``` ### Step 3: remove the delegated account from the root quorum using the delegated account's credentials: ```json theme={"system"} // Update the root quorum of the sub organization to ONLY include the end user, removing the delegated access user { "type": "ACTIVITY_TYPE_UPDATE_ROOT_QUORUM", "timestampMs": "", "organizationId": "", "parameters": { "threshold": 1, "userIds": [ "" ] } } ``` After completing these steps, the sub-organization will have two users: the end-user (the only root-user) and the Delegated Account user, which only has the permissions granted earlier via policies and no longer retains root user privileges. ## Delegated Access code example Below is a code example outlining the implementation of the Delegated Access setup flow described above ```js theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; import dotenv from "dotenv"; dotenv.config(); // Initialize the Turnkey Server Client on the server-side const turnkeyServer = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPrivateKey: process.env.TURNKEY_API_PRIVATE_KEY, apiPublicKey: process.env.TURNKEY_API_PUBLIC_KEY, defaultOrganizationId: process.env.TURNKEY_ORGANIZATION_ID, }).apiClient(); // To create an API key programmatically check https://github.com/tkhq/sdk/blob/main/examples/demos/kitchen-sink/src/sdk-server/createApiKey.ts const publicKey = ""; const curveType = "API_KEY_CURVE_P256"; // this is the default const apiKeys = [ { apiKeyName: "Delegated - API Key", publicKey, curveType, }, ]; // STEP 1: Create a sub org with End User and Delegated Access user in Root Quorum const subOrg = await turnkeyClient.createSubOrganization({ organizationId: process.env.TURNKEY_ORGANIZATION_ID!, subOrganizationName: `Sub Org - With Delegated Access User`, rootUsers: [ { userName: "Delegated Access User", apiKeys, authenticators: [], oauthProviders: [] }, { userName: "End User", userEmail: "", apiKeys: [], authenticators: [], oauthProviders: [] }, ], rootQuorumThreshold: 1, wallet: { "walletName": "Default ETH Wallet", "accounts": [ { "curve": "CURVE_SECP256K1", "pathFormat": "PATH_FORMAT_BIP32", "path": "m/44'/60'/0'/0/0", "addressFormat": "ADDRESS_FORMAT_ETHEREUM" } ] }, }); console.log("sub-org id:", subOrg.subOrganizationId); // Initializing the Turkey client used by the Delegated Access User // Notice the subOrganizationId created above const turnkeyDelegatedAccessClient = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPrivateKey: process.env.DELEGATED_API_PRIVATE_KEY!, apiPublicKey: process.env.DELEGATED_API_PUBLIC_KEY!, defaultOrganizationId: subOrg.subOrganizationId, }).apiClient(); // STEP 2: Create a policy allowing the Delegated access user to send Ethereum transactions to a particular address // Creating a policy for the Delegated account const delegated_userid = subOrg.rootUserIds[0]; const policyName = "Allow Delegated Account to sign transactions to specific address"; const effect = "EFFECT_ALLOW"; const consensus = `approvers.any(user, user.id == '${delegated_userid}')`; const condition = `eth.tx.to == '${process.env.RECIPIENT_ADDRESS}'`; const notes = ""; const { policyId } = await turnkeyDelegated.createPolicy({ policyName, condition, consensus, effect, notes, }); // STEP 3: Update the root quorum to only include the End User, removing the Delegated Access user // Remove the Delegated Account from the root quorum const RootQuorum = await turnkeyDelegated.updateRootQuorum({ threshold: 1, userIds: [subOrg.rootUserIds[1]], // retain the end user }); ``` # Client-side delegated access setup Source: https://docs.turnkey.com/features/policies/delegated-access/frontend Step-by-step guide for adding Delegated Access users and policies entirely client-side Before diving in, here’s what this setup accomplishes: You’ll create a **sub-organization** where the **end-user** has full control (root user) and a **Delegated Access (DA) user** (managed by your backend) can sign only specific transactions, for example, sending to approved recipient addresses. This ensures your backend can perform limited, policy-controlled actions on behalf of the user without ever holding their root privileges. The entire setup is initiated and approved by the end-user through their authenticated session, ensuring all actions occur under their explicit control within their sub-organization. A working example of client-side delegated access and policy validation can be found [here](https://github.com/tkhq/sdk/tree/main/examples/access-control/with-delegated/client-side). ## Step-by-step implementation You can configure **delegated access** entirely on the client side using the Turnkey SDKs — [@turnkey/react-wallet-kit](https://docs.turnkey.com/sdks/react) for React apps, or [@turnkey/core](https://docs.turnkey.com/sdks/typescript-frontend) for other frontend frameworks. This works whether you use the [Auth Proxy](https://docs.turnkey.com/reference/auth-proxy) or your own [backend](https://docs.turnkey.com/sdks/react/advanced-backend-authentication) to provision the sub-organization and issue the user's authenticated session. Both approaches follow the same principle — using an authenticated session to add a Delegated Access (DA) user and defining policies for that user within the sub-organization. ### Step 1: create an embedded wallet In this guide we'll be using [@turnkey/react-wallet-kit](https://www.npmjs.com/package/@turnkey/react-wallet-kit) together with [Auth Proxy](https://docs.turnkey.com/sdks/react/getting-started). * Customize sub-organization creation process in your React application by defining the following TurnkeyProvider configuration. This will add a new Ethereum wallet account alongside the sub-organization creation. ```tsx proviers.tsx theme={"system"} export function Providers({ children }: { children: React.ReactNode }) { const router = useRouter(); const suborgParams = useMemo(() => { const ts = Date.now(); return { userName: `User-${ts}`, customWallet: { walletName: `Wallet-${ts}`, walletAccounts: [ { curve: "CURVE_SECP256K1", pathFormat: "PATH_FORMAT_BIP32", path: "m/44'/60'/0'/0/0", addressFormat: "ADDRESS_FORMAT_ETHEREUM", }, ], }, }; }, []); const turnkeyConfig: TurnkeyProviderConfig = { organizationId: process.env.NEXT_PUBLIC_ORGANIZATION_ID!, authProxyConfigId: process.env.NEXT_PUBLIC_AUTH_PROXY_CONFIG_ID!, auth: { createSuborgParams: { emailOtpAuth: suborgParams, smsOtpAuth: suborgParams, walletAuth: suborgParams, oauth: suborgParams, passkeyAuth: { ...suborgParams, passkeyName: "My Passkey", }, }, }, }; ``` * Handle authentication is using the `handleLogin` function from the useTurnkey hook. It’s idempotent — existing users simply log in to their sub-org. ```tsx page.tsx theme={"system"} "use client"; import { useTurnkey } from "@turnkey/react-wallet-kit"; function LoginButton() { const { handleLogin } = useTurnkey(); return ; } export default function Home() { return ( ); } ``` ### Step 2: create P-256 API key user Next, use the authenticated end-user session to create a **P-256 API key user** whose key is managed by your backend for delegated actions. This will become the Delegated Access (DA) user once you define policies that grant it limited signing permissions. You can create this user at any point, either immediately after login or on-demand when an action (such as placing a limit order) requires delegated access. **Note:** This function is **idempotent** — calling it multiple times with the same publicKey will always return the same user rather than creating a new one. ```tsx src/dashboard/page.tsx theme={"system"} const handleDaSetup = async () => { if (!isHexCompressedPubKey(daPublicKey)) { setPublicKeyErr( "Public key must be a 66-hex-character compressed key (no 0x prefix).", ); return; } setPublicKeyErr(null); try { const res = await fetchOrCreateP256ApiKeyUser({ publicKey: daPublicKey, createParams: { userName: "Delegated Access", apiKeyName: "Delegated User API Key", }, }); setDaUser(res); } catch (err) { console.error("Error setting up DA user:", err); setDaUser({ error: "Failed to set up DA user." }); } }; ``` **Note:** At this stage, the DA user is non-root, so any signing attempts will be denied by the policy engine because: * the user is not part of the root quorum, and * no policy has been added yet to allow that action. ### Step 3: add a restrictive policy Now that you’ve created the P-256 API key user, you can define policies that turn it into a Delegated Access (DA) user) — granting it limited permissions to sign specific transactions. In this example, we’ll allow the DA user to sign Ethereum transactions **only** to a given recipient address. ```tsx src/dashboard/page.tsx theme={"system"} const handleBuildPolicyTemplate = () => { if (!daUser?.userId) { setPolicyError("Set up the Delegated Access user first."); return; } if (!isEthAddress(recipientAddress)) { setRecipientErr("Enter a valid 0x-prefixed, 40-hex Ethereum address."); return; } setRecipientErr(null); setPolicyError(null); const template = [ { policyName: `Allow user ${daUser.userId} to sign only to ${recipientAddress}`, effect: "EFFECT_ALLOW", consensus: `approvers.any(user, user.id == '${daUser.userId}')`, condition: `eth.tx.to == '${recipientAddress}'`, notes: "Allow Delegated Access user to sign Ethereum transactions only to the specified recipient", }, ]; setPolicyJson(JSON.stringify(template, null, 2)); }; // Keep in sync setToAllowed if recipientAddress changes manually useEffect(() => { if (recipientAddress) { setToAllowed(recipientAddress); } }, [recipientAddress]); const handleSubmitPolicies = async () => { setPolicyError(null); setPolicyResult(null); setSubmittingPolicy(true); try { const parsed = JSON.parse(policyJson); if (!Array.isArray(parsed)) { throw new Error("JSON must be an array of policy objects."); } const res = await fetchOrCreatePolicies({ policies: parsed }); setPolicyResult(res); } catch (e: any) { setPolicyError(e?.message || "Failed to submit policies."); } finally { setSubmittingPolicy(false); } }; ``` **Note:** * Reminder, until this policy is added, the DA user cannot sign any transactions — it’s a non-root user with no permissions by default. * The `fetchOrCreatePolicies` method compares the full intent signature of each policy you pass in: * If a policy already exists with the **exact same fields**, it will be reused. * If **any field differs**, even something as small as the policy name or the notes text, it will be treated as a new policy and created again. That's all ! At this point, your DA user is configured with an API key and governed by a restrictive policy. You can now validate by attempting two signatures: one that matches the allowed recipient (success) and one with a different recipient (denied). # Overview Source: https://docs.turnkey.com/features/policies/delegated-access/overview With Turnkey you can create multi-user accounts with flexible co-ownership controls. This primitive enables you to establish delegated access to a user’s wallet, reducing or removing the need for them to manually approve each action. You can provide a smoother user experience while ensuring that end-users maintain full control over their wallets. Delegated access works by creating a specialized business-controlled user within each end-user’s sub-organization that has carefully scoped permissions to perform only specific actions, such as signing transactions to designated addresses. This can enable your backend to do things like: * Automate onchain actions such as staking, redemptions, or limit orders * Sign transactions to whitelisted addresses without user involvement * Perform scheduled operations (e.g. payouts, rebalances) * Respond to specific onchain events programmatically ## Implementation flow You can implement Delegated Access for an embedded wallet in two ways, depending on whether the setup runs from the frontend (recommended) or the backend. ### 1. Frontend (recommended) This approach uses the **end-user’s authenticated session** to configure delegated access directly within their sub-organization. The flow is: * Create an **API-only user (Delegated User)** with an API key authenticator that you control. This key can then be used server-side to sign transactions on the user’s behalf. * Define **policies** for the Delegated User that strictly limit which transactions they are allowed to sign. **Why this approach:** This avoids temporarily granting the Delegated User root access — see [Caution](#caution) for more details. Since you’re using the client-side authenticated session, the API-only user is created directly as a **non-root** user within the sub-organization. **Advantages:** * There’s no possibility of elevated (root-level) access for the delegated user. **Limitations:** * You can’t assume the delegated user or its policies already exist. Before referencing it, you’ll need to call `fetchOrCreateP256ApiKeyUser` and `fetchOrCreatePolicies` to ensure the user and permissions are properly set up. For a detailed step-by-step guide see [Client-side Delegated Access setup](/features/policies/delegated-access/frontend). ### 2. Backend If you prefer to configure delegated access entirely server-side, the flow differs because the end-user in the embedded wallet model does not hold an API key. In this case, you must: * Create the sub-organization with **two root users**: the end-user and your Delegated User (API key authenticator). * Use the delegated access API key to add policies explicitly granting the DA user the limited actions you want them to perform. * Update the root quorum so that only the end-user remains a root user.

Caution ⚠️

When the delegated access setup is performed from the backend, your service (not the end-user) initiates and approves the sub-organization creation, delegated user addition, and root quorum updates. This means the delegated user is temporarily added to the root quorum without direct end-user consent. If any of these operations fail — particularly the quorum update — the delegated user may unintentionally retain root privileges, effectively gaining unrestricted access to the user’s wallet. If you adopt this approach, implement strict validation to confirm that: * The root quorum was successfully updated; and * The delegated user no longer retains unintended permissions once setup completes. **Advantages:** * Guarantees that the delegated user exists and can perform the required actions without additional setup. **Limitations:** * Risk of elevated access if the delegated user isn’t successfully removed as a root user, it may retain unintended control. * Since all actions are service-initiated, there’s no explicit end-user approval in this flow. For most end-user applications, it’s recommended to perform delegated access setup client-side, where all actions are explicitly initiated and approved by the user. For a detailed step-by-step guide see [Server-side Delegated Access setup](/features/policies/delegated-access/backend). ## Frequently asked questions ### Policy design and creation Yes — if the delegated access (DA) user is part of the root quorum, they can create policies unilaterally. Once removed from the root quorum, only the remaining quorum member (typically the end-user) can make further policy changes. Note: This can also be done even if the initiating (delegated) user is not a root user, provided a policy explicitly grants them permission to create policies. However, such a configuration should be carefully scoped — additional restrictive policies are typically required to prevent the delegated user from granting themselves broader or unintended access. When the delegated access setup is performed **client-side**, all actions are initiated and approved by the authenticated end-user within their session. This ensures full transparency and explicit user consent for every operation.
When performed **server-side**, the setup happens without direct user involvement. This approach is generally used only in **enterprise or custodial environments**, where your backend manages sub-organizations and delegated users on behalf of end-users.
For typical end-user applications, the client-side setup is the recommended and more secure approach. As long as the DA user remains authorized, they can remove policies programmatically. If they’ve been removed from the quorum, policy deletion will require the user’s explicit approval. **NOTE:** Turnkey is looking to support the concept of 'one-time-use policies' to make it easier to manage redundant policies. ### Security and risk management Yes — if the key is attached to a broad policy. That’s why it’s important to limit the scope of policies and enforce API hygiene practices. It's also recommended to have a policy in place that would allow this user to self-delete in case of a potential key leak: ```json theme={"system"} { policyName: `Allow the Delegated user to self-delete`, effect: "EFFECT_ALLOW", consensus: `approvers.any(user, user.id == '${delegated_userid}')`, condition: `activity.type == 'ACTIVITY_TYPE_DELETE_USERS' && activity.params.user_ids.count() == 1 && '${delegated_userid}' in activity.params.user_ids`, notes: "Allow the Delegated user to delete itself in case of a key leak" } ``` In effect, yes. The key difference is that granular policies **can restrict** what a DA user can do, offering better security hygiene even if there's still elevated access. Typically this is a combination of, or all of the following practices, though not exclusive to just these: * Using short-lived keys whenever viable * Rotating API keys regularly * Monitoring the usage * Secure storage (e.g. in HSMs or vaults) ### Best practices You can define strict transaction conditions. For example: ```javascript theme={"system"} solana.tx.instructions.count() == 1 && solana.tx.transfers.count() == 1 && solana.tx.transfers.all(transfer, transfer.to == '') ``` You can also consider the following: * Recipient address restrictions (ie allowlisting addresses) * Contract method selectors * Transaction structure invariants * Blockhash constraints (on Solana) Yes — this is a common pattern. You can add a policy per order (limit, stop loss, TWAP, etc.) using either the end-user’s authenticated session or a Delegated Access (DA) user, as long as the DA user has the necessary permissions defined by policy. Turnkey's Policy Engine shines through its flexibility. There are many different approaches you can take based on your requirements, but various themes we see include: * Using **broad policies** with business-controlled API keys * Using \*\*fine-grained policies, \*\*scoped to predictable transaction shapes * Using delegated access to implement **limit orders, automation flows, or advanced trading logic** (e.g. perps, TWAPs) * Ensuring **strong operational security** (e.g. tight scoping & expiring keys) is increasingly common ### EVM and SVM-specific strategies Yes, on Solana via `solana.tx.recent_blockhash`, which restricts a transaction’s validity to a \~60–90 second window. Not ideal for delayed executions (e.g. limit orders), but useful for immediate, single-use actions. Yes, though it’s limited today. You can inspect calldata (e.g., using `eth.tx.data[...]`) and enforce conditions like: ```javascript theme={"system"} eth.tx.to == '' && eth.tx.data[0..4] == '' ``` Granular support for calldata parsing and value limits is coming soon. Not entirely. Even if you allowlist the router, it could still be abused to swap all assets. You can’t control downstream behavior unless you control the contract. > **Suggestion:** Only allow DA keys to interact with contracts you fully trust or control. Limit scope as much as possible (e.g., to specific instructions, amounts, or recipients). # Access control Source: https://docs.turnkey.com/features/policies/examples/access-control This page provides examples of policies governing access generally. #### Allow a specific user to create wallets ```json theme={"system"} { "policyName": "Allow user to create wallets", "effect": "EFFECT_ALLOW", "consensus": "approvers.any(user, user.id == '')", "condition": "activity.resource == 'WALLET' && activity.action == 'CREATE'" } ``` #### Allow users with a specific tag to create users ```json theme={"system"} { "policyName": "Allow user_tag to create users", "effect": "EFFECT_ALLOW", "consensus": "approvers.any(user, user.tags.contains(''))", "condition": "activity.resource == 'USER' && activity.action == 'CREATE'" } ``` #### Require two users with a specific tag to add policies ```json theme={"system"} { "policyName": "Require two users with user_tag to create policies", "effect": "EFFECT_ALLOW", "consensus": "approvers.filter(user, user.tags.contains('')).count() >= 2", "condition": "activity.resource == 'POLICY' && activity.action == 'CREATE'" } ``` #### Deny all delete actions for users with a specific tag ```json theme={"system"} { "policyName": "Only user_tag can take actions", "effect": "EFFECT_DENY", "consensus": "approvers.any(user, user.tags.contains(''))", "condition": "activity.action == 'DELETE'" } ``` #### Allow a specific user (e.g. API-only user) to create a sub-org ```json theme={"system"} { "policyName": "Allow user to create a sub-org", "effect": "EFFECT_ALLOW", "consensus": "approvers.any(user, user.id == '')", "condition": "activity.resource == 'ORGANIZATION' && activity.action == 'CREATE'" } ``` #### Allow a specific user to perform auth type activities (full list [here](/features/policies/language#activity-breakdown)) Note: The `activity.resource` portion determines which activities can be performed. The `activity.action` determines what types of actions can be taken upon those resources. ```json theme={"system"} { "policyName": "Allow user to initiate auth type activities", "effect": "EFFECT_ALLOW", "consensus": "approvers.any(user, user.id == '')", "condition": "activity.resource == 'AUTH' && activity.action == 'CREATE'" } ``` #### Allow a specific user to perform [generic OTP](/api-reference/activities/init-generic-otp) activities ```json theme={"system"} { "policyName": "Allow user to initiate and verify generic OTP activities", "effect": "EFFECT_ALLOW", "consensus": "approvers.any(user, user.id == '')", "condition": "activity.resource in ['AUTH', 'OTP'] && activity.action in ['CREATE','VERIFY']" } ``` #### Allow a specific user to perform a specific activity type (full list [here](/features/policies/language#activity-breakdown)) Note: Activities may be upgraded over time, and thus new versions may be introduced. These policies will NOT be valid if an activity type is upgraded and requests are made on the new activity type. For example, if Turnkey introduces `ACTIVITY_TYPE_CREATE_READ_WRITE_SESSION_V3` (upgraded from `ACTIVITY_TYPE_CREATE_READ_WRITE_SESSION_V2`) and a request is made with the newer `V3` version, this policy with not allow that user to perform `ACTIVITY_TYPE_CREATE_READ_WRITE_SESSION_V3` activities. ```json JSON theme={"system"} { "policyName": "Allow user to perform create read write session v2", "effect": "EFFECT_ALLOW", "consensus": "approvers.any(user, user.id == '')", "condition": "activity.type == 'ACTIVITY_TYPE_CREATE_READ_WRITE_SESSION_V2'" } ``` #### Allow a specific user to perform a specific activity kind (full list [here](/features/policies/language#activity-kinds)) Unlike `activity.type`, which targets one exact version, `activity.kind` is version-agnostic: a single `kind` matches every version of an activity. Prefer `activity.kind` when you want a policy to keep working as activities are upgraded. For example, the policy below continues to allow the user to create read write sessions even if Turnkey introduces a newer version such as `ACTIVITY_TYPE_CREATE_READ_WRITE_SESSION_V3`, because `CREATE_READ_WRITE_SESSION` matches all versions. Not sure whether to use `type`, `kind`, or `resource` + `action`? See [Choosing between `type`, `kind`, and `resource` + `action`](/features/policies/language#choosing-between-type-kind-and-resource--action) for guidance. ```json JSON theme={"system"} { "policyName": "Allow user to create read write sessions (any version)", "effect": "EFFECT_ALLOW", "consensus": "approvers.any(user, user.id == '')", "condition": "activity.kind == 'CREATE_READ_WRITE_SESSION'" } ``` #### Allow a specific user to sign transactions across all versions ```json JSON theme={"system"} { "policyName": "Allow user to sign transactions (any version)", "effect": "EFFECT_ALLOW", "consensus": "approvers.any(user, user.id == '')", "condition": "activity.kind == 'SIGN_TRANSACTION'" } ``` #### Allow a specific credential type to perform a specific action (full list of credential types [here](/features/users/credentials#credential-types)) This policy can be used to say, only passkeys are allowed to sign transactions and not authentication through SMS (or any other authentication method). ```json JSON theme={"system"} { "policyName": "Allow signing with only passkeys", "effect": "EFFECT_ALLOW", "consensus": "credentials.any(credential, credential.type == 'CREDENTIAL_TYPE_WEBAUTHN_AUTHENTICATOR')", "condition": "activity.type == 'ACTIVITY_TYPE_SIGN_TRANSACTION_V2'" } ``` #### Allow a specific credential with a specific public key type to perform a specific action ```json JSON theme={"system"} { "policyName": "Allow signing with only passkeys", "effect": "EFFECT_ALLOW", "consensus": "credentials.any(credential, credential.public_key == '')", "condition": "activity.type == 'ACTIVITY_TYPE_SIGN_TRANSACTION_V2'" } ``` #### Allow exporting only a specific wallet account address ```json JSON theme={"system"} { "policyName": "Allow exporting only wallet account ", "effect": "EFFECT_ALLOW", "consensus": "approvers.any(user, user.id == '')", "condition": "activity.action == 'EXPORT' && wallet_account.address == ''" } ``` # Bitcoin Source: https://docs.turnkey.com/features/policies/examples/bitcoin This page provides examples of policies governing Bitcoin signing. Note: see the [language section](/features/policies/language#bitcoin) for more details. For context on Bitcoin transaction reinsertion, see the [Bitcoin network support](/features/networks/bitcoin) page #### Allow signing Bitcoin transactions ONLY if all outputs are being sent to a certain address ```json theme={"system"} { "policyName": "Enable bitcoin transactions to be sent to ", "effect": "EFFECT_ALLOW", "condition": "bitcoin.tx.outputs.all(o, o.address == )" } ``` #### Allow signing Bitcoin transactions restricting output values ```json theme={"system"} { "policyName": "Allow signing bitcoin transactions only if all outputs have value < 200000 satoshis", "effect": "EFFECT_ALLOW", "condition": "bitcoin.tx.outputs.all(o, o.value < 200000)" } ``` #### Allow signing Bitcoin transactions only if ALL inputs are spending a particular UTXO (this key is only allowed to spend one input) ```json theme={"system"} { "policyName": "Only allow spending of a single bitcoin transaction input", "effect": "EFFECT_ALLOW", "condition": "bitcoin.tx.inputs.all(i, i.tx_id == && i.vout == )" } ``` #### Cap the maximum fee ```json theme={"system"} { "policyName": "Allow signing Bitcoin transactions only if fee is under 10000 satoshis", "effect": "EFFECT_ALLOW", "condition": "bitcoin.tx.fee <= 10000" } ``` #### Deny if fee exceeds a threshold ```json theme={"system"} { "policyName": "Deny signing Bitcoin transactions if fee exceeds 50000 satoshis", "effect": "EFFECT_DENY", "condition": "bitcoin.tx.fee > 50000" } ``` # Co-signing transactions Source: https://docs.turnkey.com/features/policies/examples/co-signing-transactions Learn how to set up and use co-signing (multi-sig) wallets with Turnkey. ## Introduction to co-signing Co-signing, often referred to as multi-signature (multi-sig), provides an enhanced layer of security for blockchain transactions. It requires approvals from multiple parties before a transaction can be executed. This guide details how to implement a 2/2 co-signing setup using Turnkey, where both the end-user and your application backend (via API key) must approve transactions. See the [with-cosigning example](https://github.com/tkhq/sdk/tree/main/examples/access-control/with-cosigning) for a full working implementation using Next.js, OTP login, SSE webhooks, and a 2-of-2 root quorum. ## Co-signing architecture The following diagram illustrates the setup and transaction flow for a co-signing wallet managed by Turnkey and your backend application: ```mermaid theme={"system"} sequenceDiagram participant User participant Frontend participant Backend participant Turnkey %% Setup Phase Note over User,Turnkey: Setup Phase User->>Frontend: Sign up / Create wallet Frontend->>User: Request passkey creation User->>Frontend: Create passkey (attestation) Frontend->>Backend: Send user info & attestation Backend->>Turnkey: Create sub-org with 2 root users:
1. User (passkey)
2. Backend (API key) Backend->>Turnkey: Set root quorum threshold = 2 Turnkey->>Backend: Return sub-org ID & wallet info Backend->>Backend: Store sub-org ID in user record Backend->>Frontend: Return wallet info Frontend->>User: Display wallet address %% Transaction Phase Note over User,Turnkey: Transaction Phase User->>Frontend: Initiate transaction Frontend->>User: Request passkey authentication User->>Frontend: Authenticate with passkey Frontend->>Turnkey: Submit transaction signing request Turnkey->>Turnkey: Verify user passkey signature Turnkey->>Frontend: Return activity fingerprint Frontend->>Backend: Send activity fingerprint for approval Backend->>Turnkey: Verify & validate activity details Backend->>Turnkey: Approve activity (using backend API key) Turnkey->>Turnkey: Sign transaction (requires both approvals) Turnkey->>Backend: Return signed transaction Backend->>Frontend: Return signed transaction Frontend->>User: Show transaction success ``` ## Implementation steps To set up a multi-sig wallet in Turnkey, you first need to create a sub-organization with two root users. This sub-organization will function as a separate entity with its own wallet and security settings. The key configuration here is setting up: * A root user for the end-user, authenticated with their passkey * A root user for your application service, authenticated with an API key * A root quorum threshold of 2, requiring both users to approve critical operations This creates a true multi-sig arrangement where neither party can unilaterally control the wallet. The following code shows how to implement this setup on your backend: ```typescript app.ts [expandable] theme={"system"} import { Turnkey, DEFAULT_ETHEREUM_ACCOUNTS } from "@turnkey/sdk-server"; const turnkeyServer = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPrivateKey: process.env.TURNKEY_API_PRIVATE_KEY!, apiPublicKey: process.env.TURNKEY_API_PUBLIC_KEY!, defaultOrganizationId: process.env.TURNKEY_ORGANIZATION_ID!, }).apiClient(); async function createMultiSigWallet( userId: string, userEmail: string, userPasskeyChallenge: string, userPasskeyAttestation: object, ) { const subOrg = await turnkeyServer.createSubOrganization({ organizationId: process.env.TURNKEY_ORGANIZATION_ID!, subOrganizationName: `Multi-Sig Wallet for ${userEmail}`, rootUsers: [ // First root user - the end user with their passkey { userName: "End User", userEmail, apiKeys: [], authenticators: [ { authenticatorName: "User Passkey", challenge: userPasskeyChallenge, attestation: userPasskeyAttestation, }, ], }, // Second root user - your application's service account { userName: "Application Service", userEmail: "service@yourapp.com", apiKeys: [ { apiKeyName: "Service API Key", publicKey: process.env.SERVICE_API_PUBLIC_KEY!, curveType: "API_KEY_CURVE_P256", }, ], authenticators: [], }, ], // This is the key setting - requiring both users to approve rootQuorumThreshold: 2, wallet: { walletName: "Shared Wallet", accounts: DEFAULT_ETHEREUM_ACCOUNTS, }, }); // Store the sub-org ID against the user in your database await db.users.update({ where: { id: userId }, data: { turnkeySubOrgId: subOrg.organizationId }, }); return subOrg; } ``` When the user wants to sign a transaction using their multi-sig wallet, they need to initiate the process from your frontend application. This step involves: * Authenticating the user with their passkey (handled automatically by Turnkey) * Creating a transaction signing request to Turnkey * Receiving an activity fingerprint that needs further approval * Forwarding this fingerprint to your backend for the second signature The transaction won't be fully signed yet - it will be in a `CONSENSUS_NEEDED` status until your backend approves it. Here's how to implement this flow in your frontend: ```typescript theme={"system"} import { useTurnkey, StamperType } from "@turnkey/react-wallet-kit"; function SignButton({ walletAddress, subOrgId }: { walletAddress: string; subOrgId: string }) { const { httpClient } = useTurnkey(); const handleSign = async () => { const payload = "0x" + Buffer.from("Hello from Turnkey!").toString("hex"); // StamperType.Passkey ensures this request is stamped with the user's passkey. // With a 2-of-2 quorum the activity lands in CONSENSUS_NEEDED after this call — // it won't complete until the backend approves it. const res = await httpClient!.signRawPayload( { organizationId: subOrgId, signWith: walletAddress, payload, encoding: "PAYLOAD_ENCODING_HEXADECIMAL", hashFunction: "HASH_FUNCTION_SHA256", }, StamperType.Passkey, ); // Forward the activity fingerprint to your backend for the second approval const fingerprint = (res as any).activity?.fingerprint; await fetch("/api/approve-transaction", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ fingerprint, subOrgId }), }); }; return ; } ``` Your backend needs an endpoint to receive the activity fingerprint from the frontend and approve it using its own API key. ```typescript app.ts [expandable] theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; import { verifyJwt } from "./authMiddleware"; // Assume standard JWT middleware const turnkeyServer = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPrivateKey: process.env.TURNKEY_API_PRIVATE_KEY!, apiPublicKey: process.env.TURNKEY_API_PUBLIC_KEY!, defaultOrganizationId: process.env.TURNKEY_ORGANIZATION_ID!, }).apiClient(); // Endpoint to approve a transaction activity app.post( "/api/proxy/turnkey/approve-transaction", verifyJwt, async (req, res) => { const { activityFingerprint, subOrgId } = req.body; const { userId } = req.user; // --- Authorization Check --- // Verify the user is authorized for this subOrgId const user = await db.users.findUnique({ where: { id: userId }, select: { turnkeySubOrgId: true }, }); if (user?.turnkeySubOrgId !== subOrgId) { return res.status(403).json({ error: "Forbidden" }); } // --- End Authorization --- try { // Approve the activity using the backend service's API key await turnkeyServer.approveActivity({ organizationId: subOrgId, fingerprint: activityFingerprint, }); // Once both parties have approved, Turnkey completes the signing. // Use Webhooks to get notified when the activity reaches a terminal status. return res.status(200).json({ success: true }); } catch (error) { console.error("Error approving transaction:", error); return res.status(500).json({ error: "Failed to approve transaction" }); } } ); ``` The quorum is symmetric — the backend can also initiate signing (vote 1) and the user approves (vote 2). See the [with-cosigning example](https://github.com/tkhq/sdk/tree/main/examples/access-control/with-cosigning) for a full walkthrough of both flows. #### Security considerations and best practices * **Validation Before Approval**: Always validate transaction details (recipient, amount, etc.) before approving activities. * **API Key Security**: Protect your backend service's API key. * **Authorization**: Ensure the authenticated frontend user is authorized for the `subOrgId` they are interacting with. * **Webhooks**: Use Turnkey Webhooks to get notified about activity status changes (e.g., when a transaction is fully signed and confirmed). # Ethereum (EVM) Source: https://docs.turnkey.com/features/policies/examples/ethereum This page provides examples of policies governing Ethereum (EVM) signing. Note: see the [language section](/features/policies/language#ethereum) for more details. #### Allow ABI-specific contract call parameters For contract interactions, use [Smart Contract Interfaces](/features/policies/smart-contract-interfaces) (ABI upload) rather than raw calldata slicing. ABI-based policies use named arguments (`eth.tx.contract_call_args['arg_name']`) instead of byte offsets — they're more readable, less error-prone, and won't silently break if the contract encoding changes. Raw `eth.tx.data[...]` slicing is a fallback for contracts where no ABI is available. **Restrict a `transfer` call to a maximum amount and a specific recipient:** ```json theme={"system"} { "policyName": "Limit WETH transfers", "effect": "EFFECT_ALLOW", "condition": "eth.tx.contract_call_args['wad'] < 1000000000000000000 && eth.tx.contract_call_args['dst'] == '0x08d2b0a37F869FF76BACB5Bab3278E26ab7067B7'" } ``` **Restrict by function name or selector (also requires an ABI upload):** ```json theme={"system"} { "policyName": "Allow only transfer calls to a contract", "effect": "EFFECT_ALLOW", "condition": "eth.tx.to == '' && eth.tx.function_name == 'transfer'" } ``` #### Iterating over contract call arguments When a contract function takes an array parameter, use `.count()`, `.all()`, and `.any()` to enforce conditions across every element, rather than checking a single index. **Syntax:** * Array element count: `eth.tx.contract_call_args['arrayArg'].count()` * All elements match: `eth.tx.contract_call_args['arrayArg'].all(item, )` * Any element matches: `eth.tx.contract_call_args['arrayArg'].any(item, )` For functions that take a `tuple array` (e.g. `executeBatch((address,uint256,bytes)[] calls)`), tuple fields are currently accessed by `position` rather than name: `call[0]` (first field), `call[1]` (second field), and so on. The positions correspond to the order of fields as defined in your ABI — substitute the correct indices for your own struct. Named access such as `call['target']` is not yet supported and produces `OUTCOME_ERROR`. **Enforce exact batch size** Restrict signing to transactions containing exactly two calls: ```json theme={"system"} { "policyName": "Allow executeBatch with exactly 2 calls", "effect": "EFFECT_ALLOW", "condition": "eth.tx.function_name == 'executeBatch' && eth.tx.contract_call_args['calls'].count() == 2" } ``` **Whitelist all call targets in a batch** Allow signing only when every call targets a specific contract and sends zero ETH. call\[0] is the target address and call\[1] is the value, based on the field order in the executeBatch ABI: ```json theme={"system"} { "policyName": "Allow executeBatch to whitelisted contract only", "effect": "EFFECT_ALLOW", "condition": "eth.tx.function_name == 'executeBatch' && eth.tx.contract_call_args['calls'].all(call, call[0] == '' && call[1] == 0)" } ``` **Combine batch size and target restrictions** ```json theme={"system"} { "policyName": "Allow executeBatch — max 2 calls to whitelisted contract", "effect": "EFFECT_ALLOW", "condition": "eth.tx.function_name == 'executeBatch' && eth.tx.contract_call_args['calls'].count() <= 2 && eth.tx.contract_call_args['calls'].all(call, call[0] == '' && call[1] == 0)" } ``` **Whitelist recipients in a flat address array** For functions that take a plain `address[]` parameter — such as a disperse-style multi-send contract — use in to restrict signing to a known set of addresses: ```json theme={"system"} { "policyName": "Allow disperse to whitelisted recipients only", "effect": "EFFECT_ALLOW", "condition": "eth.tx.function_name == 'disperse' && eth.tx.contract_call_args['recipients'].all(addr, addr in ['', '', ''])" } ``` See [Smart Contract Interfaces](/features/policies/smart-contract-interfaces) for the full upload walkthrough and Solana IDL support. #### Allow ERC-20 transfers for a specific token smart contract (raw calldata fallback) Use this pattern only when an ABI is unavailable. The selector `0xa9059cbb` is the 4-byte keccak256 hash of `transfer(address,uint256)`. ```json theme={"system"} { "policyName": "Enable ERC-20 transfers for ", "effect": "EFFECT_ALLOW", "condition": "eth.tx.to == '' && eth.tx.data[0..10] == '0xa9059cbb'" } ``` #### Allow anyone to sign transactions for testnet (Sepolia) ```json theme={"system"} { "policyName": "Allow signing ethereum sepolia transactions", "effect": "EFFECT_ALLOW", "condition": "eth.tx.chain_id == 11155111" } ``` #### Allow ETH transactions with a specific nonce range ```json theme={"system"} { "policyName": "Allow signing Ethereum transactions with an early nonce", "effect": "EFFECT_ALLOW", "condition": "eth.tx.nonce <= 3" } ``` #### Allow signing of EIP-712 payloads for Hyperliquid `ApproveAgent` operations ```json theme={"system"} { "policyName": "Allow signing of EIP-712 Payloads for Hyperliquid `ApproveAgent` operations", "effect": "EFFECT_ALLOW", "condition": "eth.eip_712.domain.name == 'HyperliquidSignTransaction' && eth.eip_712.primary_type == 'HyperliquidTransaction:ApproveAgent' && activity.type == 'ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2'" } ``` #### Inspect nested fields in EIP-712 message payloads The `eth.eip_712.message` map supports nested field access using bracket notation and array iteration operators, allowing policies to inspect and enforce conditions across typed data contents, beyond just the domain and primary type. **Syntax:** * Nested struct fields: `eth.eip_712.message['outerField']['innerField']` * Array element fields: `eth.eip_712.message['arrayField'][0]['innerField']` * Array iteration: `eth.eip_712.message['arrayField'].all(item, )` * Array length: `eth.eip_712.message['arrayField'].count()` **Example: Restrict Hyperliquid orders to a specific asset** Hyperliquid's `HyperliquidTransaction:Order` message contains an `orders` array of `Order` structs. Each `Order` uses short field names: `a` (asset index), `b` (isBuy), `p` (price), `s` (size), `r` (reduceOnly). ```json theme={"system"} { "primaryType": "HyperliquidTransaction:Order", "domain": { "name": "HyperliquidSignTransaction", ... }, "message": { "orders": [ { "a": 3, "b": true, "p": "1800.0", "s": "0.1", "r": false, ... } ], "grouping": "normalTpsl" } } ``` To allow only orders for a specific asset (e.g. ETH = asset index `3`): ```json theme={"system"} { "policyName": "Allow Hyperliquid orders for ETH only", "effect": "EFFECT_ALLOW", "condition": "eth.eip_712.domain.name == 'HyperliquidSignTransaction' && eth.eip_712.primary_type == 'HyperliquidTransaction:Order' && eth.eip_712.message['orders'][0]['a'] == 3 && activity.type == 'ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2'" } ``` Array elements can be accessed by index (`[0]`, `[1]`, etc.). The condition `message['orders'][0]['a'] == '3'` only checks the first order — any additional orders in the array are not evaluated. Checking multiple positions explicitly (message\['orders']\[0]\['a'] == 3 && message\['orders']\[1]\['a'] == 3) works, but is fragile — adding a third order bypasses the check entirely. Use .all() to enforce a condition across every element regardless of array size. #### Iterating over array fields **Enforce batch size with .count():** ```json theme={"system"} { "policyName": "Limit Hyperliquid batch to 5 orders", "effect": "EFFECT_ALLOW", "condition": "eth.eip_712.domain.name == 'HyperliquidSignTransaction' && eth.eip_712.primary_type == 'HyperliquidTransaction:Order' && eth.eip_712.message['orders'].count() <= 5 && activity.type == 'ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2'" } ``` **Whitelist a specific asset across all orders with .all():** ```json theme={"system"} { "policyName": "Allow Hyperliquid orders for asset 3 only", "effect": "EFFECT_ALLOW", "condition": "eth.eip_712.domain.name == 'HyperliquidSignTransaction' && eth.eip_712.primary_type == 'HyperliquidTransaction:Order' && eth.eip_712.message['orders'].all(order, order['a'] == 3) && activity.type == 'ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2'" } ``` **Whitelist multiple assets with .all():** ```json theme={"system"} { "policyName": "Allow Hyperliquid orders for ETH or BTC only", "effect": "EFFECT_ALLOW", "condition": "eth.eip_712.domain.name == 'HyperliquidSignTransaction' && eth.eip_712.primary_type == 'HyperliquidTransaction:Order' && eth.eip_712.message['orders'].all(order, order['a'] in [3, 5]) && activity.type == 'ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2'" } ``` `in` works for integer fields (e.g. `order['a'] in [3, 5]`). For string fields, use `||` instead. **Combine size limit and asset whitelist:** ```json theme={"system"} { "policyName": "Allow Hyperliquid orders for ETH only, max 5 per batch", "effect": "EFFECT_ALLOW", "condition": "eth.eip_712.domain.name == 'HyperliquidSignTransaction' && eth.eip_712.primary_type == 'HyperliquidTransaction:Order' && eth.eip_712.message['orders'].count() <= 5 && eth.eip_712.message['orders'].all(order, order['a'] == 3) && activity.type == 'ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2'" } ``` **Require at least one reduce-only order with .any():** ```json theme={"system"} { "policyName": "Require at least one reduce-only order in the batch", "effect": "EFFECT_ALLOW", "condition": "eth.eip_712.domain.name == 'HyperliquidSignTransaction' && eth.eip_712.primary_type == 'HyperliquidTransaction:Order' && eth.eip_712.message['orders'].any(order, order['r'] == true) && activity.type == 'ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2'" } ``` ### Deny signing of `NO_OP` keccak256 payloads ```json theme={"system"} { "policyName": "Deny NO_OP hash signing", "effect": "EFFECT_DENY", "condition": "activity.type == 'ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2' && activity.params.hash_function == 'HASH_FUNCTION_NO_OP' && activity.params.encoding != 'PAYLOAD_ENCODING_EIP712'" } ``` #### Allow signing of EIP-712 payloads for EIP-3009 transfers ```json theme={"system"} { "policyName": "Allow signing of EIP-712 payloads for EIP-3009 Transfers for USD Coin", "effect": "EFFECT_ALLOW", "condition": "eth.eip_712.domain.name == 'USD Coin' && eth.eip_712.primary_type == 'TransferWithAuthorization' && activity.type == 'ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2'" } ``` #### Allow signing of EIP-712 payloads for EIP-2612 permits for USD Coin ```json theme={"system"} { "policyName": "Allow signing of EIP-712 payloads for EIP-2612 Permits for USD Coin", "effect": "EFFECT_ALLOW", "condition": "eth.eip_712.domain.name == 'USD Coin' && eth.eip_712.primary_type == 'Permit' && activity.type == 'ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2'" } ``` #### Allow signing of EIP-7702 authorizations ```json theme={"system"} { "policyName": "Allow signing of EIP-7702 Authorizations", "effect": "EFFECT_ALLOW", "condition": "eth.eip_7702_authorization.address == '
' && eth.eip_7702_authorization.chain_id == '' && eth.eip_7702_authorization.nonce == '' && activity.type == 'ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2'" } ``` # Signing control Source: https://docs.turnkey.com/features/policies/examples/signing-control This page provides examples of policies governing signing generally. See network-specific guides for more. #### Allow a specific user to sign transactions with any account address within a specific wallet ```JSON theme={"system"} { "policyName": "Allow to sign transactions with ", "effect": "EFFECT_ALLOW", "consensus": "approvers.any(user, user.id == '')", "condition": "activity.action == 'SIGN' && wallet.id == ''" } ``` #### Allow a specific user to sign transactions with a specific wallet account address ```json theme={"system"} { "policyName": "Allow to sign transactions with ", "effect": "EFFECT_ALLOW", "consensus": "approvers.any(user, user.id == '')", "condition": "activity.action == 'SIGN' && wallet_account.address == ''" } ``` #### Allow a specific user to sign transactions with a specific private key ```json theme={"system"} { "policyName": "Allow to sign transactions with ", "effect": "EFFECT_ALLOW", "consensus": "approvers.any(user, user.id == '')", "condition": "activity.action == 'SIGN' && private_key.id == ''" } ``` # Solana Source: https://docs.turnkey.com/features/policies/examples/solana This page provides examples of policies governing Solana signing. Note: see the [language section](/features/policies/language#solana) for various approaches on writing Solana policies. For sponsored Solana transactions, start with [Solana Rent Sponsorship](/features/networks/solana-rent-refunds) before applying the examples below. That guide covers account-creation risk, rent refunds, and mitigation strategy for sponsored flows. #### Allow IDL-specific program instructions See [here](../../../concepts/policies/smart-contract-interfaces) for more information and examples. #### Allow Solana transactions that include a transfer from one specific sender ```json theme={"system"} { "policyName": "Enable transactions with a transfer sent by ", "effect": "EFFECT_ALLOW", "condition": "solana.tx.transfers.all(transfer, transfer.from == '')" } ``` #### Allow Solana transactions that include a transfer to only one specific recipient ```json theme={"system"} { "policyName": "Enable transactions with a single transfer sent to ", "effect": "EFFECT_ALLOW", "condition": "solana.tx.transfers.count == 1 && solana.tx.transfers[0].to == ''" } ``` #### Allow Solana transactions that have exactly one transfer, to one specific recipient ```json theme={"system"} { "policyName": "Enable transactions with a transfer sent to ", "effect": "EFFECT_ALLOW", "condition": "solana.tx.transfers.all(transfer, transfer.to == '')" } ``` #### Allow Solana transactions that only use the Solana System Program ```json theme={"system"} { "policyName": "Enable transactions that only use the system program", "effect": "EFFECT_ALLOW", "condition": "solana.tx.program_keys.all(p, p == '11111111111111111111111111111111')" } ``` #### Deny all Solana transactions transferring to an undesired address ```json theme={"system"} { "policyName": "Reject transactions with a transfer sent to ", "effect": "EFFECT_DENY", "condition": "solana.tx.transfers.any(transfer, transfer.to == '')" } ``` #### Allow Solana transactions with specific expected instruction data ```json theme={"system"} { "policyName": "Enable transactions where the first instruction has precisely ", "effect": "EFFECT_ALLOW", "condition": "solana.tx.instructions[0].instruction_data_hex == ''" } ``` #### Allow Solana transactions whose first instruction involves a specific address ```json theme={"system"} { "policyName": "Enable transactions where the first instruction has a first account involving
", "effect": "EFFECT_ALLOW", "condition": "solana.tx.instructions[0].accounts[0].account_key == '
'" } ``` #### Deny all address table lookups ```json theme={"system"} { "policyName": "Deny Solana transactions that use address table lookups", "effect": "EFFECT_DENY", "condition": "solana.tx.address_table_lookups.count() > 0" } ``` #### Deny sending to an address from a table lookup ```json theme={"system"} { "policyName": "Deny Solana transactions sending directly to an address from a table lookup", "effect": "EFFECT_DENY", "condition": "solana.tx.transfers.any(t, t.to == 'ADDRESS_TABLE_LOOKUP') || solana.tx.spl_transfers.any(t, t.to == 'ADDRESS_TABLE_LOOKUP')" } ``` #### Solana SPL token transfers -- context and examples Turnkey’s policy engine supports policies for SPL token transfers. Specifically, we support creating policies for the `Transfer`, `TransferChecked` and `TransferCheckedWithFee` instructions across both the Solana Token Program and the Solana Token 2022 Program. Some important context for using SPL token policies with Turnkey: **Token Account Addresses** For context, Solana implements SPL token balances for a particular wallet address by creating a whole new account called a "token account" which has a pointer in its data field labeled "owner" that points back to the wallet address in question. So to hold a particular token in your Solana wallet, you have to create a new token account meant to hold that token, owned by your Solana wallet. For policies related to the receiving token address of an SPL transfer, the token address receiving the tokens will have to be used, NOT the wallet address that is the owner for the receiving token address. This is because, while both the owning wallet address and the receiving token address are specified in the transfer instruction, the owning wallet address of the recipient token address is not specified. For this we highly recommend using the convention of “associated token addresses” to set policies that, for example, allow SPL token transfers to a particular wallet address. For further context on associated token addresses check out Solana’s documentation on it: [https://spl.solana.com/associated-token-account](https://spl.solana.com/associated-token-account) An example implementation of using a policy to allow transfers to the associated token address of the intended recipient wallet address can be found in our SDK examples [here](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-solana#6-running-the-create-spl-token-transfer-with-policy-example). **Mint Address Accessibility** The mint account address of the token will only be accessible when the transaction is constructed using instructions that specify the mint address – `TransferChecked` and `TransferCheckedWithFee`. For transactions constructed using the simple `Transfer` method, the mint account will be considered empty. Here are some example policies for SPL transfers: #### Allow a user to sign Solana transactions that include a single instruction which is an SPL token transfer from a particular sending token address ```json theme={"system"} { "policyName": "Allow user to sign Solana transactions that include only a single SPL Transfer FROM ", "effect": "EFFECT_ALLOW", "consensus": "approvers.any(user, user.id == '')", "condition": "solana.tx.instructions.count() == 1 && solana.tx.spl_transfers.count() == 1 && solana.tx.spl_transfers.all(transfer, transfer.from == '')" } ``` #### Allow a user to sign Solana transactions only if ALL of the instructions are SPL transfers TO a particular token address ```json theme={"system"} { "policyName": "Allow user to sign Solana transactions only if ALL of the instructions are SPL transfers TO ", "effect": "EFFECT_ALLOW", "consensus": "approvers.any(user, user.id == '')", "condition": "solana.tx.instructions.count() == solana.tx.spl_transfers.count() && solana.tx.spl_transfers.all(transfer, transfer.to == '')" } ``` #### Allow users with a specific tag to sign Solana transactions only if ALL of the instructions are SPL token transfers with a specific address as the owner of the sending token address ```json theme={"system"} { "policyName": "Allow users with to sign Solana transactions only if ALL of the instructions are SPL token transfers with as the owner of the sending token address", "effect": "EFFECT_ALLOW", "consensus": "approvers.any(user, user.tags.contains('')" } ``` #### Allow a user to sign Solana transactions that include a single instruction which is an SPL token transfer where the atomic units of the transfer are less than a threshold amount ```json theme={"system"} { "policyName": "Allow user to sign Solana transactions that include a single instruction which is an SPL token transfer where the atomic units of the transfer are less than ", "effect": "EFFECT_ALLOW", "consensus": "approvers.any(user, user.id == '')", "condition": "solana.tx.instructions.count() == 1 && solana.tx.spl_transfers.count() == 1 && solana.tx.spl_transfers.all(transfer, transfer.amount < )" } ``` #### Allow a user to sign Solana transactions only if ALL of the instructions are SPL token transfers where the token mint address is a particular address ```json theme={"system"} { "policyName": "Allow to sign a Solana transaction only if ALL of the instructions are SPL token transfers where the token mint address is ", "effect": "EFFECT_ALLOW", "consensus": "approvers.any(user, user.id == '')", "condition": "solana.tx.instructions.count() == solana.tx.spl_transfers.count() && solana.tx.spl_transfers.all(transfer, transfer.token_mint == '')" } ``` #### Allow a user to sign Solana transactions that includes a single instruction which is an SPL token transfer where one of the multisig signers of the owner is a particular address ```json theme={"system"} { "policyName": "Allow to sign a Solana transaction only if ALL of it's instructions are SPL token transfers where one of the multisig signers of the owner is ", "effect": "EFFECT_ALLOW", "consensus": "approvers.any(user, user.id == '')", "condition": "solana.tx.instructions.count() == 1 && solana.tx.spl_transfers.count() == 1 && solana.tx.spl_transfers.all(transfer, transfer.signers.any(s, s == ''))" } ``` # Tempo Source: https://docs.turnkey.com/features/policies/examples/tempo This page provides examples of policies governing Tempo signing. Note: see the [language section](/features/policies/language#tempo) for more details. ## Overview Tempo transactions are fully parsed by the policy engine via the `tempo.tx` namespace. Tempo natively supports batched calls — a single transaction can contain multiple calls that execute atomically. The `tempo.tx.calls` list gives you granular access to each call's destination, input data, and function selector. ## Transaction-level policies #### Allow Tempo transactions ```json theme={"system"} { "policyName": "Allow Tempo transactions", "effect": "EFFECT_ALLOW", "condition": "activity.action == 'SIGN' && activity.params.type == 'TRANSACTION_TYPE_TEMPO'" } ``` #### Restrict to a specific chain ID ```json theme={"system"} { "policyName": "Only allow Tempo testnet", "effect": "EFFECT_ALLOW", "condition": "tempo.tx.chain_id == 42431" } ``` #### Allow specific fee token ```json theme={"system"} { "policyName": "Only allow specific fee token", "effect": "EFFECT_ALLOW", "condition": "tempo.tx.fee_token == '0xdAC17F958D2ee523a2206206994597C13D831ec7'" } ``` #### Deny Tempo transactions ```json theme={"system"} { "policyName": "Deny Tempo transactions", "effect": "EFFECT_DENY", "condition": "activity.action == 'SIGN' && activity.params.type == 'TRANSACTION_TYPE_TEMPO'" } ``` #### Cap gas limit ```json theme={"system"} { "policyName": "Deny high gas limit", "effect": "EFFECT_DENY", "condition": "tempo.tx.gas_limit > 100000" } ``` #### Cap max fee per gas ```json theme={"system"} { "policyName": "Deny high max fee per gas", "effect": "EFFECT_DENY", "condition": "tempo.tx.max_fee_per_gas > 15000000000" } ``` #### Restrict validity window ```json theme={"system"} { "policyName": "Deny transactions with specific valid_before", "effect": "EFFECT_DENY", "condition": "tempo.tx.valid_before == 9999999999" } ``` ## Call-level policies Tempo transactions contain one or more calls in `tempo.tx.calls`. You can target individual calls by index or use quantifiers (`all`, `any`) to apply rules across all calls. #### Allow calls to a specific contract ```json theme={"system"} { "policyName": "Allow calls to approved contract", "effect": "EFFECT_ALLOW", "condition": "tempo.tx.calls[0].to == '0x40f008f4c17075EFcA092aE650655f6693AECEd0'" } ``` #### Allow ERC-20 transfer function selector ```json theme={"system"} { "policyName": "Allow ERC-20 transfer calls", "effect": "EFFECT_ALLOW", "condition": "tempo.tx.calls[0].function_signature == '0xa9059cbb'" } ``` #### Deny a specific call destination ```json theme={"system"} { "policyName": "Deny calls to blocked address", "effect": "EFFECT_DENY", "condition": "tempo.tx.calls[0].to == '0x40f008f4c17075EFcA092aE650655f6693AECEd0'" } ``` #### Deny single-call transactions (require batching) ```json theme={"system"} { "policyName": "Deny single-call transactions", "effect": "EFFECT_DENY", "condition": "tempo.tx.calls.count() == 1" } ``` ## Batch call policies with quantifiers #### Allow only when all calls target an approved address ```json theme={"system"} { "policyName": "All calls must target approved address", "effect": "EFFECT_ALLOW", "condition": "private_key.id == '' && tempo.tx.calls.all(call, call.to == '0x40f008f4c17075EFcA092aE650655f6693AECEd0')" } ``` #### Allow only when all call destinations are known addresses ```json theme={"system"} { "policyName": "All calls must target known address", "effect": "EFFECT_ALLOW", "condition": "wallet_account.address == '' && tempo.tx.calls.all(call, call.to == '')" } ``` ## Raw calldata inspection Since Tempo does not support [Smart Contract Interfaces](/features/policies/smart-contract-interfaces) (ABI parsing), you can use slicing on `tempo.tx.calls[i].input` to inspect encoded arguments directly. The `input` field is case-insensitive, so hex comparisons work regardless of casing. In standard ABI encoding, each argument occupies a 32-byte (64 hex character) word. The function selector occupies the first 4 bytes (8 hex characters, plus the `0x` prefix), so the first argument word starts at position 10. For an `address` argument, the address value itself starts at position 34, because it is right-aligned within the 32-byte word and preceded by 12 bytes (24 hex characters) of left-padding. Each subsequent argument word starts 64 hex characters later. #### Restrict ERC-20 transfer recipient via calldata This example allows an ERC-20 `transfer(address,uint256)` only when the recipient (first ABI argument) matches a specific address: ```json theme={"system"} { "policyName": "Allow ERC-20 transfer to relay address only", "effect": "EFFECT_ALLOW", "condition": "wallet_account.address == '' && tempo.tx.calls[0].to == '' && tempo.tx.calls[0].input[34..74] == ''" } ``` #### Verify calldata recipient address Combine calldata slicing with an address comparison to ensure the encoded recipient matches an expected address: ```json theme={"system"} { "policyName": "Allow when encoded recipient matches expected address", "effect": "EFFECT_ALLOW", "condition": "wallet_account.address == '' && tempo.tx.calls[0].input[34..74] == ''" } ``` #### Verify both `from` and `to` in `transferFrom` calldata For `transferFrom(address,address,uint256)`, the `from` is the first argument (positions 34..74) and `to` is the second (positions 98..138): ```json theme={"system"} { "policyName": "Allow transferFrom only between known addresses", "effect": "EFFECT_ALLOW", "condition": "wallet_account.address == '' && tempo.tx.calls[0].input[34..74] == '' && tempo.tx.calls[0].input[98..138] == ''" } ``` ## Wallet and key scoping These policies work the same as other blockchain types — you can combine `tempo.tx` conditions with wallet, private key, and consensus rules. #### Allow Tempo transactions for a specific wallet ```json theme={"system"} { "policyName": "Allow Tempo transactions for specific wallet", "effect": "EFFECT_ALLOW", "condition": "activity.action == 'SIGN' && activity.params.type == 'TRANSACTION_TYPE_TEMPO' && wallet.id == ''" } ``` #### Allow Tempo transactions for a specific private key ```json theme={"system"} { "policyName": "Allow Tempo transactions for specific private key", "effect": "EFFECT_ALLOW", "condition": "activity.action == 'SIGN' && activity.params.type == 'TRANSACTION_TYPE_TEMPO' && private_key.id == ''" } ``` #### Require specific approver for Tempo transactions ```json theme={"system"} { "policyName": "Require specific approver for Tempo transactions", "effect": "EFFECT_ALLOW", "consensus": "approvers.any(user, user.id == '')", "condition": "activity.action == 'SIGN' && activity.params.type == 'TRANSACTION_TYPE_TEMPO'" } ``` #### Allow Tempo transactions for wallets with a specific label ```json theme={"system"} { "policyName": "Allow Tempo transactions for wallets with specific label", "effect": "EFFECT_ALLOW", "condition": "activity.action == 'SIGN' && activity.params.type == 'TRANSACTION_TYPE_TEMPO' && wallet.label == 'tempo-production'" } ``` #### Allow Tempo transactions for private keys with a specific tag ```json theme={"system"} { "policyName": "Allow Tempo transactions for private keys with tag", "effect": "EFFECT_ALLOW", "condition": "activity.action == 'SIGN' && activity.params.type == 'TRANSACTION_TYPE_TEMPO' && private_key.tags.contains('tempo-enabled')" } ``` ## Legacy Ethereum transactions on Tempo During Tempo's testnet period, [legacy Ethereum transactions](https://docs.tempo.xyz/quickstart/evm-compatibility#transaction-differences) are also supported on Tempo and can be governed using standard Ethereum policy syntax. See the [Ethereum policy examples](/features/policies/examples/ethereum) for more details on how to write policies for these transaction types. # Tron Source: https://docs.turnkey.com/features/policies/examples/tron This page provides examples of policies governing signing. Note: see the [language section](/features/policies/language#tron) for more details. #### Allow Tether TRC-20 transfers on the Nile Testnet This policy allows for all transfer calls on the Tether smart contract on the Nile testnet. The contract addresses on Nile testnet and Tron mainnet for Tether are different! ```json theme={"system"} { "policyName": "Enable Tether TRC-20 transfers on the Nile Testnet for the Tether contract address: 'TXYZopYRdj2D9XRtbG411XZZ3kM5VkAeBf'", "effect": "EFFECT_ALLOW", "condition": "tron.tx.contract[0].contract_address == 'TXYZopYRdj2D9XRtbG411XZZ3kM5VkAeBf' && tron.tx.contract[0].data[0..8] == 'a9059cbb'" } ``` #### Allow TRX transfers under 10,000,000 SUN (10 TRX) The amount field is denoted in SUN, the lowest denomination of TRX. ```json theme={"system"} { "policyName": "Allow TRX transfers under 10 TRX", "effect": "EFFECT_ALLOW", "condition": "tron.tx.contract[0].amount < 10000000" } ``` #### Allow all TransferContract transactions This policy allows for any TRX Transfer ```json theme={"system"} { "policyName": "Allow all TRX transfers", "effect": "EFFECT_ALLOW", "condition": "tron.tx.contract[0].type == 'TransferContract'" } ``` # Policy language Source: https://docs.turnkey.com/features/policies/language This page provides an overview of how to author policies using our policy language. To begin, we'll need to get familiar with the language's grammar, keywords, and types. ## Grammar The grammar has been designed for flexibility and expressiveness. We currently support the following operations: | Operation | Operators | Example | Types | | ---------- | ---------------------------- | ---------------------------- | ------------------------ | | logical | &&, \|\| | "true && false" | (bool, bool) -> bool | | comparison | ==, !=, \<, >, \<=, >= | "1 \< 2" | (int, int) -> bool | | comparison | ==, != | "'a' != 'b'" | (string, string) -> bool | | comparison | in | "1 in \[1, 2, 3]" | (T, list\) -> bool | | access | x\[\] | \[1,2,3]\[0] | (list\) -> T | | access | x\[\] | "'abc'\[0]" | (string) -> string | | access | x\[\..\] | \[1,2,3]\[0..2] | (list\) -> (list\) | | access | x\[\..\] | "'abc'\[0..2]" | (string) -> string | | access | x.\ | "user.tags" | (struct) -> T | | function | x.all(item, \) | "\[1,1,1].all(x, x == 1)" | (list\) -> bool | | function | x.any(item, \) | "\[1,2,3].any(x, x == 1)" | (list\) -> bool | | function | x.contains(\) | "\[1,2,3].contains(1)" | (list\) -> bool | | function | x.count() | "\[1,2,3].count()" | (list\) -> int | | function | x.filter(item, \) | "\[1,2,3].filter(x, x == 1)" | (list\) -> (list\) | ## Keywords Keywords are reserved words that are dynamically interchanged for real values at evaluation time. Each field supports a different set of keywords. ### Consensus | Keyword | Type | Description | | --------------- | ----------------- | ----------------------------------------------------- | | **approvers** | list\ | The users that have approved an activity | | **credentials** | list\ | The credentials that were used to approve an activity | ### Condition | Keyword | Type | Description | | -------------------------------- | -------------------- | --------------------------------------------------------------------------- | | **activity** | Activity | The activity metadata of the request | | **eth.tx** | EthereumTransaction | The parsed Ethereum transaction payload (see Appendix below) | | **eth.eip\_712** | Eip712TypedData | EIP-712 Typed Data (see Appendix below) | | **eth.eip\_7702\_authorization** | Eip7702Authorization | EIP-7702 Authorization (see Appendix below) | | **solana.tx** | SolanaTransaction | The parsed Solana transaction payload (see Appendix below) | | **tron.tx** | TronTransaction | The parsed Tron transaction payload (see Appendix below) | | **bitcoin.tx** | BitcoinTransaction | The parsed Bitcoin transaction payload (see Appendix below) | | **tempo.tx** | TempoTransaction | The parsed Tempo transaction payload (see Appendix below) | | **wallet** | Wallet | The target wallet used in sign + export requests | | **wallets** | list\ | The target wallets associated with requests involving with multiple wallets | | **private\_key** | PrivateKey | The target private key used in sign + export requests | | **wallet\_account** | WalletAccount | The target wallet account used in sign + export requests | ## Types The language is strongly typed which makes policies easy to author and maintain. ### Primitive | Type | Example | Notes | | ------------ | --------------------------------------- | ------------------------------------------------ | | **bool** | true | | | **int** | 256 | i128 | | **uint** | 170141183460469231731687303715884105728 | u256 | | **string** | 'a' | only single quotes are supported | | **list\** | \[1, 2, 3] | a list of type T | | **struct** | \{ id: 'abc' } | a key-value map of \{ field: T } (defined below) | ### Struct | Struct | Field | Type | Description | | ------------------------ | ---------------------------- | --------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **User** | id | string | The identifier of the user | | | tags | list\ | The collection of tags for the user | | | email | string | The email address of the user | | | alias | string | The alias of the user | | **Credential** | id | string | The identifier of the API key or authenticator that was used to approve the request | | | user\_id | string | The identifier of the user who owns this request and approved the request | | | type | string | The credential type, a full list can be found [here](/features/users/credentials#credential-types) | | | credential\_id | string | The credential ID of a passkey. Note: this is only populated for passkeys (also known as Authenticators within Turnkey resources), not API keys | | | public\_key | string | The public key of the credential that approved the request | | **Activity** | type | string | The type of the activity (e.g. ACTIVITY\_TYPE\_SIGN\_TRANSACTION\_V2) | | | kind | string | A version-agnostic grouping of the activity type. Unlike `type`, a single `kind` matches every version of an activity (e.g. `SIGN_TRANSACTION` matches both `ACTIVITY_TYPE_SIGN_TRANSACTION` and `ACTIVITY_TYPE_SIGN_TRANSACTION_V2`). Example values: `SIGN_TRANSACTION`, `CREATE_API_KEYS`, `CREATE_WALLET`, `CREATE_READ_WRITE_SESSION`. See [Activity kinds](#activity-kinds) for the full list of valid values and the kind → activity type mapping. | | | resource | string | The resource type the activity targets: `USER`, `PRIVATE_KEY`, `POLICY`, `WALLET`, `ORGANIZATION`, `INVITATION`, `CREDENTIAL`, `CONFIG`, `**RECOVERY`, `AUTH`, `OTP`, `PAYMENT_METHOD`, `SUBSCRIPTION` | | | action | string | The action of the activity: `CREATE`, `UPDATE`, `DELETE`, `SIGN`, `EXPORT`, `IMPORT` | | | params | struct | The parameters of the activity. See [here](#activity-parameters) for more details. | | **Wallet** | id | string | The identifier of the wallet | | | imported | bool | Boolean indicating whether or not this wallet has been imported | | | exported | bool | Boolean indicating whether or not this wallet has been exported | | | label | string | The label of this wallet | | **Wallet Account** | address | string | The wallet account address | | **PrivateKey** | id | string | The identifier of the private key | | | tags | list\ | The collection of tags for the private key | | | imported | bool | Boolean indicating whether or not this private key has been imported | | | exported | bool | Boolean indicating whether or not this private key has been exported | | | label | string | The label of this private key | | **EthereumTransaction** | from | string | The sender address of the transaction | | | to | string | The receiver address of the transaction (can be an EOA or smart contract) | | | data | string | The arbitrary calldata of the transaction (hex-encoded). Prefer `function_name` / `contract_call_args` when an ABI is available — see [Smart Contract Interfaces](/features/policies/smart-contract-interfaces). | | | value | int | The amount being sent (in wei) | | | gas | int | The maximum allowed gas for the transaction | | | gas\_price | int | The price of gas for the transaction (Note: this field was used in legacy transactions and was replaced with max\_fee\_per\_gas in EIP 1559 transactions, however when evaluating policies on EIP 1559 transactions, this field will be populated with the same value as max\_fee\_per\_gas) | | | chain\_id | int | The chain identifier for the transaction | | | nonce | int | The nonce for the transaction | | | max\_fee\_per\_gas | int | EIP 1559 field specifying the max amount to pay per unit of gas for the transaction (Note: This is the sum of the gas for the transaction and the priority fee described below) | | | max\_priority\_fee\_per\_gas | int | EIP 1559 field specifying the max amount of the tip to be paid to miners for the transaction | | | max\_fee\_per\_blob\_gas | int | EIP 4844 field specifying the maximum fee users are willing to pay per unit of blob gas, akin to the tip in EIP 1559 | | | type | string | The EVM transaction type. This should be one of the following: "LEGACY", "TYPE\_1" (EIP 2930), "TYPE\_2" (EIP 1559), "TYPE\_3" (EIP 4844), "TYPE\_4" (EIP 7702) | | | function\_name | string | ABI field specifying the function name that the transaction call data is calling. Populated only when a matching [Smart Contract Interface](/features/policies/smart-contract-interfaces) has been uploaded for `eth.tx.to`. | | | function\_signature | string | ABI field specifying the leading bytes which denote the function being called in the call data. Populated only when a matching [Smart Contract Interface](/features/policies/smart-contract-interfaces) has been uploaded for `eth.tx.to`. | | | contract\_call\_args | Option\> | ABI field specifying all contract arguments parsed from the contract call data. It is a mapping of the string representations of the arg name to the argument itself. Populated only when a matching [Smart Contract Interface](/features/policies/smart-contract-interfaces) has been uploaded for `eth.tx.to`. Access via `eth.tx.contract_call_args['arg_name']`. | | **Eip712TypedData** | primary\_type | string | The type of the primary (i.e. outermost) structure in the `message` JSON | | | domain | Eip712Domain | The `Domain` of the payload | | | message | Map\ | JSON serializaiton of the message payload | | **Eip7702Authorization** | address | string | The address you would like to authorize | | | chain\_id | number | The EVM chain ID | | | nonce | number | The nonce of the authority | | **SolanaTransaction** | account\_keys | list\ | The accounts (public keys) involved in the transaction | | | program\_keys | list\ | The programs (public keys) involved in the transaction | | | instructions | list\ | A list of Instructions (see below). Each instruction exposes a `parsed_instruction_data` field (with `instruction_name`, `named_accounts`, `program_call_args`) when a matching [Smart Contract Interface (IDL)](/features/policies/smart-contract-interfaces) has been uploaded for that program. | | | transfers | list\ | A list of Transfers (see below) | | | recent\_blockhash | string | The recent blockhash specified in a transaction | | | spl\_transfers | list\ | A list of SPLTransfers (see below) | | | address\_table\_lookups | list\ | A list of AddressTableLookups (see below) | | **TronTransaction** | ref\_block\_bytes | string | The height of the transaction reference block | | | ref\_block\_hash | string | The hash of the transaction reference block | | | expiration | int | Transaction expiration time in milliseconds | | | timestamp | int | Transaction timestamp in milliseconds | | | data | string | Transaction memo (not the call data!) | | | fee\_limit | int | The maximum energy cost allowed for the execution of smart contract transactions | | | contract | list\ | A list of TronContract. This is the main content of a Tron transaction. This determines the type of transaction being executed and its parameters (see below) | | **BitcoinTransaction** | version | string | The version of the Bitcoin transaction | | | inputs | list\ | All inputs to this Bitcoin transaction | | | outputs | list\ | All outputs created by this Bitcoin transaction | | | locktime | BitcoinTxLocktime | The locktime of this bitcoin transaction | | | fee | int | The total fee for this Bitcoin transaction in satoshis (computed as sum of input values minus sum of output values) | | **TempoTransaction** | chain\_id | int | The chain identifier for the transaction | | | from | string | The signer address of the transaction | | | nonce | int | The nonce for the transaction | | | gas\_limit | int | The maximum allowed gas for the transaction | | | max\_fee\_per\_gas | int | The maximum fee per unit of gas for the transaction | | | max\_priority\_fee\_per\_gas | int | The maximum priority fee (tip) per unit of gas | | | fee\_token | string | The token address used to pay transaction fees | | | valid\_before | int | Upper validity bound (timestamp). Defaults to 0 when not set | | | valid\_after | int | Lower validity bound (timestamp). Defaults to 0 when not set | | | calls | list\ | The list of calls in the transaction. Tempo transactions natively support batched calls — a single transaction can contain multiple calls that execute atomically | The `ContractArgument` type, used in documentation for ABI and IDL arguments represents an enum indicating this type could be any one of the string, number, array or struct types listed in our Primitives section. #### Nested structs | Struct | Field | Type | Description | | ------------------------------- | ------------------------- | ------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Eip712Domain** | name | string | The name | | | version | string | The version | | | chain\_id | uint | The chain ID | | | verifying\_contract | string | The address of the verifying contract | | **Instruction** | program\_key | string | The program (public key) involved in the instruction | | | accounts | list\ | A list of Accounts involved in the instruction | | | instruction\_data\_hex | string | Raw hex bytes corresponding to instruction data | | | address\_table\_lookups | list\ | A list of AddressTableLookups used in the instruction. | | | parsed\_instruction\_data | Option\ | IDL related field specifying all additional information for an instruction calling a program for which an IDL has been uploaded | | **Transfer** | from | string | A Solana account (public key) representing the sender of the transfer | | | to | string | A Solana account (public key) representing the recipient of the transfer | | | amount | int | The native SOL amount for the transfer (lamports). Only transfers executed by direct calls to system programs are recognized, transfers performed indirectly inside other programs or via unsupported System Program instructions are not included. | | **SPLTransfer** | from | string | A Solana account (public key) representing the token account that is sending tokens in this SPL transfer | | | to | string | A Solana account (public key) representing the token account that is receiving tokens in this SPL transfer | | | amount | int | The amount (noted in raw atomic units) of this SPL transfer. Only parsed for top-level SPL transfers using `Transfer`, `TransferChecked`, or `TransferCheckedWithFee`. Transfers performed through other Token / Token-2022 instructions are not included. | | | owner | string | A Solana account (public key) representing the owner of the sending token account for this SPL transfer | | | signers | list\ | A list of Solana accounts (public keys) representing the multisig signers (if they exist) for this SPL transfer | | | token\_mint | string | A Solana account (public key) representing the token mint of the token being transferred in this SPL transfer | | **Account** | account\_key | string | A Solana account (public key) | | | signer | boolean | An indicator of whether or not the account is a signer | | | writable | boolean | An indicator of whether or not the account can perform a write operation | | **AddressTableLookup** | address\_table\_key | string | A Solana address (public key) corresponding to the address table | | | writable\_indexes | list\ | Indexes corresponding to accounts that can perform writes | | | readonly\_indexes | list\ | Indexes corresponding to accounts that can only perform reads | | **SolanaParsedInstructionData** | instruction\_name | string | IDL related field specifying the name of the instruction being called | | | discriminator | string | IDL related field specifying the byte discriminator denoting which instruction is being called by the instruction call data | | | named\_account | map\ | IDL related field specifying a mapping of account names to the account string, with the names as defined by the program IDL | | | program\_call\_args | map\ | IDL related field specifying a mapping of account names to the account string, with the names as defined by the program IDL | | **TronContract** | type | string | The contract type, a complete list can be found in the Tron Protocol Documentation | | | permission\_id | int | The transaction permission type | | | owner\_address | string | The address of the caller of the transaction | | | to\_address | string | The address of the recipient (Only available for TransferContract's) | | | amount | int | The amount of TRX to send (Only available for TransferContract's) | | | contract\_address | string | The address of the contract being called (Only available for TriggerSmartContract's) | | | call\_value | int | The amount of TRX passed to the contract (Only available for TriggerSmartContract's) | | | data | string | The function selector, and the functions parameters of the contract (Only available for TriggerSmartContract's) | | | call\_token\_value | int | The amount of a TRC-10 token passed to the contract (Only available for TriggerSmartContract's) | | | token\_id | int | The TRC-10 token id (Only available for TriggerSmartContract's) | | | resource | string | The resource to delegate/undelegate will be "ENERGY" or "BANDWIDTH" (Only available for Delegate, UnDelegate, FreezeBalanceV2, UnfreezeBalanceV2 contract's) | | | balance | int | The amount of sun (1,000,000 sun = 1 TRX) staked for resources to be delegated (Only available for DelegateContract and UnDelegateContract) | | | receiver\_address | string | The resource receiver address (Only available for DelegateContract and UnDelegateContract) | | | lock | bool | Indicates if the delegated resources are locked or not. If true resources cannot be undelegated within the lock\_period (Only available for DelegateContract's) | | | lock\_period | int | The time, in blocks, of how long the delegation is locked, only valid when lock is true (Only available for DelegateContract's) | | | frozen\_balance | int | The amount of sun (1,000,000 sun = 1 TRX) to be frozen (Only available for FreezeBalanceV2Contract's) | | | unfreeze\_balance | int | The amount of sun (1,000,000 sun = 1 TRX) to unfreeze (Only available for UnfreezeBalanceV2Contract's) | | | owner | TronPermission | The owner permission of the account (Only available for AccountPermissionUpdateContract's) | | | witness | TronPermission | The witness permission of the account (Only available for AccountPermissionUpdateContract's) | | | actives | list\ | A list of active permissions for the account (Only available for AccountPermissionUpdateContract's) | | **TronPermission** | type | string | The permission type either "Owner", "Witness", or "Active" | | | id | int | The permission id Owner = 0, Witness = 1, Active = 2+n where n is the 0 indexed active permission number | | | permission\_name | string | The name of the permission | | | threshold | int | The operation is allowed only when the sum of the weights of the participating signatures exceeds the domain value. Requires a maximum value less than the Long type (int64). | | | parent\_id | int | The parent id, currently always 0 | | | operations | String | Hex encoded 32 bytes (256 bits), each bit represents the authority of a contract, a 1 means the authority to own the contract | | | keys | TronKey | A list of address's and weight's that jointly own the permission can be up to 5 keys. | | **TronKey** | address | string | The address authorized for a specific TronPermission | | | weight | int | The weight of this address's signature for this permission, used to reach "threshold" in a TronPermission | | **BitcoinTxInput** | tx\_id | string | The transaction id of the Bitcoin transaction that created the output that is being spent by this input | | | vout | int | The index in the output array on the Bitcoin transaction that created the output being spent by this input | | | sequence | int | The sequence field on this input which is set whether the transaction can be replaced or when it can be mined | | **BitcoinTxOutput** | value | int | The value of this output in Satoshis | | | script\_pubkey | string | The locking code for this transaction output | | | address | string | The onchain address representation for this transaction output | | | address\_type | string | The address derivation type of the address for this transaction output | | **BitcoinTxLocktime** | amount | int | The amount represented in this transaction's locktime | | | type | string | The type of locktime represented (either 'Seconds' or 'Blocks') | | **TempoCall** | to | string | The destination address of the call (empty string for contract creation) | | | input | string | The raw call data as a hex string (supports slicing, e.g. `tempo.tx.calls[0].input[34..74]`) | | | function\_signature | string | The 4-byte function selector derived from the call input (e.g. `0xa9059cbb` for ERC-20 `transfer`). Empty string when input is absent or too short | ## Activity breakdown | Resource Type | Action | Activity Type | | ------------------------------ | ------ | -------------------------------------------------: | | **ORGANIZATION** | CREATE | ACTIVITY\_TYPE\_CREATE\_SUB\_ORGANIZATION\_V8 | | | DELETE | ACTIVITY\_TYPE\_DELETE\_ORGANIZATION | | | DELETE | ACTIVITY\_TYPE\_DELETE\_SUB\_ORGANIZATION | | **INVITATION** | CREATE | ACTIVITY\_TYPE\_CREATE\_INVITATIONS | | | DELETE | ACTIVITY\_TYPE\_DELETE\_INVITATION | | **POLICY** | CREATE | ACTIVITY\_TYPE\_CREATE\_POLICY\_V3 | | | CREATE | ACTIVITY\_TYPE\_CREATE\_POLICIES | | | UPDATE | ACTIVITY\_TYPE\_UPDATE\_POLICY\_V2 | | | DELETE | ACTIVITY\_TYPE\_DELETE\_POLICY | | | DELETE | ACTIVITY\_TYPE\_DELETE\_POLICIES | | **SMART\_CONTRACT\_INTERFACE** | CREATE | ACTIVITY\_TYPE\_CREATE\_SMART\_CONTRACT\_INTERFACE | | | DELETE | ACTIVITY\_TYPE\_DELETE\_SMART\_CONTRACT\_INTERFACE | | **WALLET** | CREATE | ACTIVITY\_TYPE\_CREATE\_WALLET | | | CREATE | ACTIVITY\_TYPE\_CREATE\_WALLET\_ACCOUNTS | | | EXPORT | ACTIVITY\_TYPE\_EXPORT\_WALLET | | | EXPORT | ACTIVITY\_TYPE\_EXPORT\_WALLET\_ACCOUNT | | | IMPORT | ACTIVITY\_TYPE\_INIT\_IMPORT\_WALLET | | | IMPORT | ACTIVITY\_TYPE\_IMPORT\_WALLET | | | DELETE | ACTIVITY\_TYPE\_DELETE\_WALLETS | | | UPDATE | ACTIVITY\_TYPE\_UPDATE\_WALLET | | | DELETE | ACTIVITY\_TYPE\_DELETE\_WALLET\_ACCOUNTS | | **PRIVATE\_KEY** | CREATE | ACTIVITY\_TYPE\_CREATE\_PRIVATE\_KEYS\_V2 | | | CREATE | ACTIVITY\_TYPE\_CREATE\_PRIVATE\_KEY\_TAG | | | UPDATE | ACTIVITY\_TYPE\_UPDATE\_PRIVATE\_KEY\_TAG | | | DELETE | ACTIVITY\_TYPE\_DISABLE\_PRIVATE\_KEY | | | DELETE | ACTIVITY\_TYPE\_DELETE\_PRIVATE\_KEY\_TAGS | | | DELETE | ACTIVITY\_TYPE\_DELETE\_PRIVATE\_KEYS | | | EXPORT | ACTIVITY\_TYPE\_EXPORT\_PRIVATE\_KEY | | | IMPORT | ACTIVITY\_TYPE\_INIT\_IMPORT\_PRIVATE\_KEY | | | IMPORT | ACTIVITY\_TYPE\_IMPORT\_PRIVATE\_KEY | | | SIGN | ACTIVITY\_TYPE\_SIGN\_RAW\_PAYLOAD\_V2 | | | SIGN | ACTIVITY\_TYPE\_SIGN\_RAW\_PAYLOADS | | | SIGN | ACTIVITY\_TYPE\_SIGN\_TRANSACTION\_V2 | | | SIGN | ACTIVITY\_TYPE\_ETH\_SEND\_TRANSACTION | | | SIGN | ACTIVITY\_TYPE\_SOL\_SEND\_TRANSACTION | | **USER** | CREATE | ACTIVITY\_TYPE\_CREATE\_USERS\_V4 | | | CREATE | ACTIVITY\_TYPE\_CREATE\_USER\_TAG | | | CREATE | ACTIVITY\_TYPE\_CREATE\_API\_ONLY\_USERS | | | UPDATE | ACTIVITY\_TYPE\_UPDATE\_USER | | | UPDATE | ACTIVITY\_TYPE\_UPDATE\_USER\_NAME | | | UPDATE | ACTIVITY\_TYPE\_UPDATE\_USER\_EMAIL | | | UPDATE | ACTIVITY\_TYPE\_UPDATE\_USER\_PHONE\_NUMBER | | | UPDATE | ACTIVITY\_TYPE\_UPDATE\_USER\_TAG | | | DELETE | ACTIVITY\_TYPE\_DELETE\_USERS | | | DELETE | ACTIVITY\_TYPE\_DELETE\_USER\_TAGS | | **CREDENTIAL** | CREATE | ACTIVITY\_TYPE\_CREATE\_API\_KEYS\_V2 | | | CREATE | ACTIVITY\_TYPE\_CREATE\_AUTHENTICATORS\_V2 | | | DELETE | ACTIVITY\_TYPE\_DELETE\_API\_KEYS | | | DELETE | ACTIVITY\_TYPE\_DELETE\_AUTHENTICATORS | | | CREATE | ACTIVITY\_TYPE\_CREATE\_OAUTH\_PROVIDERS\_V2 | | | DELETE | ACTIVITY\_TYPE\_DELETE\_OAUTH\_PROVIDERS | | **PAYMENT\_METHOD** | UPDATE | ACTIVITY\_TYPE\_SET\_PAYMENT\_METHOD\_V2 | | | DELETE | ACTIVITY\_TYPE\_DELETE\_PAYMENT\_METHOD | | **SUBSCRIPTION** | CREATE | ACTIVITY\_TYPE\_ACTIVATE\_BILLING\_TIER | | **CONFIG** | UPDATE | ACTIVITY\_TYPE\_UPDATE\_ALLOWED\_ORIGINS | | \***\*RECOVERY** | CREATE | ACTIVITY\_TYPE\_INIT\_USER\_EMAIL\_RECOVERY\_V2 | | **AUTH** | CREATE | ACTIVITY\_TYPE\_EMAIL\_AUTH\_V3 | | | CREATE | ACTIVITY\_TYPE\_INIT\_OTP\_AUTH\_V3 | | | CREATE | ACTIVITY\_TYPE\_OTP\_AUTH | | | CREATE | ACTIVITY\_TYPE\_OAUTH | | | CREATE | ACTIVITY\_TYPE\_OAUTH\_LOGIN | | | CREATE | ACTIVITY\_TYPE\_OTP\_LOGIN\_V2 | | | CREATE | ACTIVITY\_TYPE\_STAMP\_LOGIN | | | CREATE | ACTIVITY\_TYPE\_CREATE\_READ\_WRITE\_SESSION\_V2 | | | CREATE | ACTIVITY\_TYPE\_CREATE\_OAUTH2\_CREDENTIAL | | | DELETE | ACTIVITY\_TYPE\_DELETE\_OAUTH2\_CREDENTIAL | | | UPDATE | ACTIVITY\_TYPE\_UPDATE\_OAUTH2\_CREDENTIAL | | | CREATE | ACTIVITY\_TYPE\_OAUTH2\_AUTHENTICATE | | **OTP** | CREATE | ACTIVITY\_TYPE\_INIT\_OTP\_V3 | | | VERIFY | ACTIVITY\_TYPE\_VERIFY\_OTP\_V2 | | **AUTH\_PROXY** | CREATE | ACTIVITY\_TYPE\_ENABLE\_AUTH\_PROXY | | | DELETE | ACTIVITY\_TYPE\_DISABLE\_AUTH\_PROXY | | | UPDATE | ACTIVITY\_TYPE\_UPDATE\_AUTH\_PROXY\_CONFIG | | **WEBHOOK\_ENDPOINT** | CREATE | ACTIVITY\_TYPE\_CREATE\_WEBHOOK\_ENDPOINT | | | UPDATE | ACTIVITY\_TYPE\_UPDATE\_WEBHOOK\_ENDPOINT | | | DELETE | ACTIVITY\_TYPE\_DELETE\_WEBHOOK\_ENDPOINT | \*\* In the Activity breakdown table above, `**` marks legacy features deprecated in the latest SDKs. This note applies only to that table. ### Activity kinds `activity.kind` groups all versions of an activity under one version-agnostic value. The table below lists each kind and the activity types it matches. This table covers policy-governed activities only. Activities governed by the root quorum (see [Root quorum activities](#root-quorum-activities)) are not policy-governed and have no `activity.kind`. | Kind | Matches Activity Types | | ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DELETE\_ORGANIZATION | ACTIVITY\_TYPE\_DELETE\_ORGANIZATION | | CREATE\_SUB\_ORGANIZATION | ACTIVITY\_TYPE\_CREATE\_SUB\_ORGANIZATION, ACTIVITY\_TYPE\_CREATE\_SUB\_ORGANIZATION\_V2, ACTIVITY\_TYPE\_CREATE\_SUB\_ORGANIZATION\_V3, ACTIVITY\_TYPE\_CREATE\_SUB\_ORGANIZATION\_V4, ACTIVITY\_TYPE\_CREATE\_SUB\_ORGANIZATION\_V5, ACTIVITY\_TYPE\_CREATE\_SUB\_ORGANIZATION\_V6, ACTIVITY\_TYPE\_CREATE\_SUB\_ORGANIZATION\_V7, ACTIVITY\_TYPE\_CREATE\_SUB\_ORGANIZATION\_V8 | | DELETE\_SUB\_ORGANIZATION | ACTIVITY\_TYPE\_DELETE\_SUB\_ORGANIZATION | | CREATE\_INVITATIONS | ACTIVITY\_TYPE\_CREATE\_INVITATIONS | | DELETE\_INVITATION | ACTIVITY\_TYPE\_DELETE\_INVITATION | | CREATE\_USERS | ACTIVITY\_TYPE\_CREATE\_USERS, ACTIVITY\_TYPE\_CREATE\_USERS\_V2, ACTIVITY\_TYPE\_CREATE\_USERS\_V3, ACTIVITY\_TYPE\_CREATE\_USERS\_V4 | | CREATE\_API\_ONLY\_USERS | ACTIVITY\_TYPE\_CREATE\_API\_ONLY\_USERS | | CREATE\_USER\_TAG | ACTIVITY\_TYPE\_CREATE\_USER\_TAG | | UPDATE\_USER | ACTIVITY\_TYPE\_UPDATE\_USER | | UPDATE\_USER\_NAME | ACTIVITY\_TYPE\_UPDATE\_USER\_NAME | | UPDATE\_USER\_EMAIL | ACTIVITY\_TYPE\_UPDATE\_USER\_EMAIL | | UPDATE\_USER\_PHONE\_NUMBER | ACTIVITY\_TYPE\_UPDATE\_USER\_PHONE\_NUMBER | | UPDATE\_USER\_TAG | ACTIVITY\_TYPE\_UPDATE\_USER\_TAG | | DELETE\_USERS | ACTIVITY\_TYPE\_DELETE\_USERS | | DELETE\_USER\_TAGS | ACTIVITY\_TYPE\_DELETE\_USER\_TAGS | | ENABLE\_AUTH\_PROXY | ACTIVITY\_TYPE\_ENABLE\_AUTH\_PROXY | | DISABLE\_AUTH\_PROXY | ACTIVITY\_TYPE\_DISABLE\_AUTH\_PROXY | | CREATE\_AUTHENTICATORS | ACTIVITY\_TYPE\_CREATE\_AUTHENTICATORS, ACTIVITY\_TYPE\_CREATE\_AUTHENTICATORS\_V2 | | CREATE\_API\_KEYS | ACTIVITY\_TYPE\_CREATE\_API\_KEYS, ACTIVITY\_TYPE\_CREATE\_API\_KEYS\_V2 | | DELETE\_AUTHENTICATORS | ACTIVITY\_TYPE\_DELETE\_AUTHENTICATORS | | DELETE\_API\_KEYS | ACTIVITY\_TYPE\_DELETE\_API\_KEYS | | CREATE\_OAUTH\_PROVIDERS | ACTIVITY\_TYPE\_CREATE\_OAUTH\_PROVIDERS, ACTIVITY\_TYPE\_CREATE\_OAUTH\_PROVIDERS\_V2 | | DELETE\_OAUTH\_PROVIDERS | ACTIVITY\_TYPE\_DELETE\_OAUTH\_PROVIDERS | | CREATE\_PRIVATE\_KEYS | ACTIVITY\_TYPE\_CREATE\_PRIVATE\_KEYS, ACTIVITY\_TYPE\_CREATE\_PRIVATE\_KEYS\_V2 | | CREATE\_PRIVATE\_KEY\_TAG | ACTIVITY\_TYPE\_CREATE\_PRIVATE\_KEY\_TAG | | UPDATE\_PRIVATE\_KEY\_TAG | ACTIVITY\_TYPE\_UPDATE\_PRIVATE\_KEY\_TAG | | DISABLE\_PRIVATE\_KEY | ACTIVITY\_TYPE\_DISABLE\_PRIVATE\_KEY | | DELETE\_PRIVATE\_KEY\_TAGS | ACTIVITY\_TYPE\_DELETE\_PRIVATE\_KEY\_TAGS | | INIT\_IMPORT\_PRIVATE\_KEY | ACTIVITY\_TYPE\_INIT\_IMPORT\_PRIVATE\_KEY | | IMPORT\_PRIVATE\_KEY | ACTIVITY\_TYPE\_IMPORT\_PRIVATE\_KEY | | DELETE\_PRIVATE\_KEYS | ACTIVITY\_TYPE\_DELETE\_PRIVATE\_KEYS | | SIGN\_TRANSACTION | ACTIVITY\_TYPE\_SIGN\_TRANSACTION, ACTIVITY\_TYPE\_SIGN\_TRANSACTION\_V2 | | SIGN\_RAW\_PAYLOAD | ACTIVITY\_TYPE\_SIGN\_RAW\_PAYLOAD, ACTIVITY\_TYPE\_SIGN\_RAW\_PAYLOAD\_V2 | | SIGN\_RAW\_PAYLOADS | ACTIVITY\_TYPE\_SIGN\_RAW\_PAYLOADS | | SPARK\_SIGN\_FROST | ACTIVITY\_TYPE\_SPARK\_SIGN\_FROST | | SPARK\_PREPARE\_TRANSFER | ACTIVITY\_TYPE\_SPARK\_PREPARE\_TRANSFER | | SPARK\_CLAIM\_TRANSFER | ACTIVITY\_TYPE\_SPARK\_CLAIM\_TRANSFER | | SPARK\_PREPARE\_LIGHTNING\_RECEIVE | ACTIVITY\_TYPE\_SPARK\_PREPARE\_LIGHTNING\_RECEIVE | | ETH\_SEND\_TRANSACTION | ACTIVITY\_TYPE\_ETH\_SEND\_TRANSACTION, ACTIVITY\_TYPE\_ETH\_SEND\_TRANSACTION\_V2 | | SOL\_SEND\_TRANSACTION | ACTIVITY\_TYPE\_SOL\_SEND\_TRANSACTION | | EXPORT\_PRIVATE\_KEY | ACTIVITY\_TYPE\_EXPORT\_PRIVATE\_KEY | | CREATE\_WALLET | ACTIVITY\_TYPE\_CREATE\_WALLET | | CREATE\_WALLET\_ACCOUNTS | ACTIVITY\_TYPE\_CREATE\_WALLET\_ACCOUNTS | | EXPORT\_WALLET | ACTIVITY\_TYPE\_EXPORT\_WALLET | | EXPORT\_WALLET\_ACCOUNT | ACTIVITY\_TYPE\_EXPORT\_WALLET\_ACCOUNT | | INIT\_IMPORT\_WALLET | ACTIVITY\_TYPE\_INIT\_IMPORT\_WALLET | | IMPORT\_WALLET | ACTIVITY\_TYPE\_IMPORT\_WALLET | | DELETE\_WALLETS | ACTIVITY\_TYPE\_DELETE\_WALLETS | | UPDATE\_WALLET | ACTIVITY\_TYPE\_UPDATE\_WALLET | | DELETE\_WALLET\_ACCOUNTS | ACTIVITY\_TYPE\_DELETE\_WALLET\_ACCOUNTS | | INIT\_FIAT\_ON\_RAMP | ACTIVITY\_TYPE\_INIT\_FIAT\_ON\_RAMP | | CREATE\_FIAT\_ON\_RAMP\_CREDENTIAL | ACTIVITY\_TYPE\_CREATE\_FIAT\_ON\_RAMP\_CREDENTIAL | | DELETE\_FIAT\_ON\_RAMP\_CREDENTIAL | ACTIVITY\_TYPE\_DELETE\_FIAT\_ON\_RAMP\_CREDENTIAL | | UPDATE\_FIAT\_ON\_RAMP\_CREDENTIAL | ACTIVITY\_TYPE\_UPDATE\_FIAT\_ON\_RAMP\_CREDENTIAL | | CREATE\_POLICY | ACTIVITY\_TYPE\_CREATE\_POLICY, ACTIVITY\_TYPE\_CREATE\_POLICY\_V2, ACTIVITY\_TYPE\_CREATE\_POLICY\_V3 | | CREATE\_POLICIES | ACTIVITY\_TYPE\_CREATE\_POLICIES | | UPDATE\_POLICY | ACTIVITY\_TYPE\_UPDATE\_POLICY, ACTIVITY\_TYPE\_UPDATE\_POLICY\_V2 | | DELETE\_POLICY | ACTIVITY\_TYPE\_DELETE\_POLICY | | DELETE\_POLICIES | ACTIVITY\_TYPE\_DELETE\_POLICIES | | ACTIVATE\_BILLING\_TIER | ACTIVITY\_TYPE\_ACTIVATE\_BILLING\_TIER | | SET\_PAYMENT\_METHOD | ACTIVITY\_TYPE\_SET\_PAYMENT\_METHOD, ACTIVITY\_TYPE\_SET\_PAYMENT\_METHOD\_V2 | | DELETE\_PAYMENT\_METHOD | ACTIVITY\_TYPE\_DELETE\_PAYMENT\_METHOD | | UPDATE\_ALLOWED\_ORIGINS | ACTIVITY\_TYPE\_UPDATE\_ALLOWED\_ORIGINS | | CREATE\_WEBHOOK\_ENDPOINT | ACTIVITY\_TYPE\_CREATE\_WEBHOOK\_ENDPOINT | | UPDATE\_WEBHOOK\_ENDPOINT | ACTIVITY\_TYPE\_UPDATE\_WEBHOOK\_ENDPOINT | | DELETE\_WEBHOOK\_ENDPOINT | ACTIVITY\_TYPE\_DELETE\_WEBHOOK\_ENDPOINT | | INIT\_USER\_EMAIL\_RECOVERY | ACTIVITY\_TYPE\_INIT\_USER\_EMAIL\_RECOVERY, ACTIVITY\_TYPE\_INIT\_USER\_EMAIL\_RECOVERY\_V2 | | EMAIL\_AUTH | ACTIVITY\_TYPE\_EMAIL\_AUTH, ACTIVITY\_TYPE\_EMAIL\_AUTH\_V2, ACTIVITY\_TYPE\_EMAIL\_AUTH\_V3 | | INIT\_OTP\_AUTH | ACTIVITY\_TYPE\_INIT\_OTP\_AUTH, ACTIVITY\_TYPE\_INIT\_OTP\_AUTH\_V2, ACTIVITY\_TYPE\_INIT\_OTP\_AUTH\_V3 | | OTP\_AUTH | ACTIVITY\_TYPE\_OTP\_AUTH | | OAUTH | ACTIVITY\_TYPE\_OAUTH | | CREATE\_READ\_WRITE\_SESSION | ACTIVITY\_TYPE\_CREATE\_READ\_WRITE\_SESSION, ACTIVITY\_TYPE\_CREATE\_READ\_WRITE\_SESSION\_V2 | | OAUTH\_LOGIN | ACTIVITY\_TYPE\_OAUTH\_LOGIN | | OTP\_LOGIN | ACTIVITY\_TYPE\_OTP\_LOGIN, ACTIVITY\_TYPE\_OTP\_LOGIN\_V2 | | STAMP\_LOGIN | ACTIVITY\_TYPE\_STAMP\_LOGIN | | UPDATE\_AUTH\_PROXY\_CONFIG | ACTIVITY\_TYPE\_UPDATE\_AUTH\_PROXY\_CONFIG | | CREATE\_OAUTH2\_CREDENTIAL | ACTIVITY\_TYPE\_CREATE\_OAUTH2\_CREDENTIAL | | UPDATE\_OAUTH2\_CREDENTIAL | ACTIVITY\_TYPE\_UPDATE\_OAUTH2\_CREDENTIAL | | DELETE\_OAUTH2\_CREDENTIAL | ACTIVITY\_TYPE\_DELETE\_OAUTH2\_CREDENTIAL | | OAUTH2\_AUTHENTICATE | ACTIVITY\_TYPE\_OAUTH2\_AUTHENTICATE | | INIT\_OTP | ACTIVITY\_TYPE\_INIT\_OTP, ACTIVITY\_TYPE\_INIT\_OTP\_V2, ACTIVITY\_TYPE\_INIT\_OTP\_V3 | | VERIFY\_OTP | ACTIVITY\_TYPE\_VERIFY\_OTP, ACTIVITY\_TYPE\_VERIFY\_OTP\_V2 | | CREATE\_SMART\_CONTRACT\_INTERFACE | ACTIVITY\_TYPE\_CREATE\_SMART\_CONTRACT\_INTERFACE | | DELETE\_SMART\_CONTRACT\_INTERFACE | ACTIVITY\_TYPE\_DELETE\_SMART\_CONTRACT\_INTERFACE | | UPSERT\_GAS\_USAGE\_CONFIG | ACTIVITY\_TYPE\_UPSERT\_GAS\_USAGE\_CONFIG | | CREATE\_TVC\_APP | ACTIVITY\_TYPE\_CREATE\_TVC\_APP | | CREATE\_TVC\_DEPLOYMENT | ACTIVITY\_TYPE\_CREATE\_TVC\_DEPLOYMENT | | CREATE\_TVC\_MANIFEST\_APPROVALS | ACTIVITY\_TYPE\_CREATE\_TVC\_MANIFEST\_APPROVALS | | UPDATE\_TVC\_APP\_LIVE\_DEPLOYMENT | ACTIVITY\_TYPE\_UPDATE\_TVC\_APP\_LIVE\_DEPLOYMENT | | DELETE\_TVC\_DEPLOYMENT | ACTIVITY\_TYPE\_DELETE\_TVC\_DEPLOYMENT | | DELETE\_TVC\_APP\_AND\_DEPLOYMENTS | ACTIVITY\_TYPE\_DELETE\_TVC\_APP\_AND\_DEPLOYMENTS | | RESTORE\_TVC\_DEPLOYMENT | ACTIVITY\_TYPE\_RESTORE\_TVC\_DEPLOYMENT | | POST\_TVC\_QUORUM\_KEY\_SHARE | ACTIVITY\_TYPE\_POST\_TVC\_QUORUM\_KEY\_SHARE | Prefer `activity.kind` over `activity.type` when you want a policy to apply across all versions of an activity. `activity.type` targets one exact version and will not match newer versions introduced later. ### Choosing between `type`, `kind`, and `resource` + `action` There are three ways to target activities in a policy condition. Pick based on how broad you want the match to be: | Field(s) | Scope | Use when | | --------------------------------------- | ------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `activity.type` | One exact activity **version** (e.g. `ACTIVITY_TYPE_SIGN_TRANSACTION_V2`) | You need to pin a specific version. Most precise, but **brittle**: it will not match when the activity is upgraded to a new version. | | `activity.kind` | One logical activity, **all versions** (e.g. `SIGN_TRANSACTION`) | You want to allow/deny a specific activity and keep the policy working across future version upgrades. **Recommended default** for activity-specific policies. | | `activity.resource` + `activity.action` | A **group** of activities sharing a resource and action (e.g. all `CREATE` on `CREDENTIAL`) | You want a coarse, category-level rule spanning many activities at once. | Rule of thumb: use `activity.kind` to target a single activity (version-agnostic), and `activity.resource` + `activity.action` to target a broad category. Reach for `activity.type` only when you deliberately need one exact version. ## Appendix ### Policy evaluation Note that our policy engine does not short circuit during evaluation. In practice, this means that if any clause within the `condition` field of a policy results in an error, the evaluated `outcome` for that policy will be an error. In such cases, consider breaking up complex policies into separate policies. For example, suppose you're looking to construct a policy with the condition \`wallet.id == '\' || private*key.id == '\'. This condition will \_always* error out during evaluation, because only one of the two clauses can ever be valid: an activity cannot target both a wallet and private key. That means if you're trying to, say, sign with a private key, then the wallet clause will fail (because a wallet isn't being passed into the policy evaluation). Conversely, if you're trying to sign with a wallet, the private key clause will fail for the same reason. ### Activity parameters The `activity.params` field exposes specific parameters based on the activity type. Most activities do not expose any parameters, but certain activities expose fields that can be used in policy conditions. | Category | Activity Type | Field | Type | Description | | ----------------- | --------------------------------------- | ---------------------------- | ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Signing | `ACTIVITY_TYPE_SIGN_RAW_PAYLOAD` | `hash_function` | string | The hash function used (e.g., `HASH_FUNCTION_NO_OP`, `HASH_FUNCTION_KECCAK256`) | | | | `encoding` | string | The payload encoding (e.g., `PAYLOAD_ENCODING_HEXADECIMAL`, `PAYLOAD_ENCODING_EIP712`) | | | `ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2` | `hash_function` | string | The hash function used | | | | `encoding` | string | The payload encoding | | | `ACTIVITY_TYPE_SIGN_RAW_PAYLOADS` | `hash_function` | string | The hash function used | | | | `encoding` | string | The payload encoding | | | `ACTIVITY_TYPE_SIGN_TRANSACTION_V2` | `type` | string | The transaction type (one of `[TRANSACTION_TYPE_ETHEREUM, TRANSACTION_TYPE_SOLANA, TRANSACTION_TYPE_BITCOIN, TRANSACTION_TYPE_TRON, TRANSACTION_TYPE_TEMPO`]) | | User Management | `ACTIVITY_TYPE_DELETE_USERS` | `user_ids` | list\ | The list of user IDs being deleted | | Export | `ACTIVITY_TYPE_EXPORT_WALLET` | `target_public_key` | string | The public key the export bundle is encrypted to | | | `ACTIVITY_TYPE_EXPORT_WALLET_ACCOUNT` | `target_public_key` | string | The public key the export bundle is encrypted to | | | `ACTIVITY_TYPE_EXPORT_PRIVATE_KEY` | `target_public_key` | string | The public key the export bundle is encrypted to | | Wallet Management | `ACTIVITY_TYPE_UPDATE_WALLET` | `wallet_id` | string | The ID of the wallet being updated | | Authentication | `ACTIVITY_TYPE_INIT_OTP_AUTH_V2` | `otp_length` | int | The length of the OTP code | | | `ACTIVITY_TYPE_INIT_OTP_AUTH_V3` | `otp_length` | int | The length of the OTP code | | Policy Management | `ACTIVITY_TYPE_DELETE_POLICY` | `policy_id` | string | The ID of the policy being deleted | | | `ACTIVITY_TYPE_DELETE_POLICIES` | `policy_ids` | list\ | The list of policy IDs being deleted | | Webhook Endpoint | `ACTIVITY_TYPE_CREATE_WEBHOOK_ENDPOINT` | `url` | string | The URL of the webhook endpoint | | | | `name` | string | The display name of the webhook endpoint | | | | `subscriptions` | list\ | The list of event subscriptions for this endpoint | | | | `subscriptions.event_type` | string | The event type to subscribe to (e.g., `ACTIVITY_UPDATES`, `BALANCE_CONFIRMED_UPDATES`) | | | | `subscriptions.filters_json` | string | JSON-encoded filter criteria for the subscription | | | | `subscriptions.is_active` | bool | Whether this subscription is active | | | `ACTIVITY_TYPE_UPDATE_WEBHOOK_ENDPOINT` | `endpoint_id` | string | The ID of the webhook endpoint being updated | | | | `url` | string | The updated URL of the webhook endpoint | | | | `name` | string | The updated display name of the webhook endpoint | | | | `is_active` | bool | Whether the webhook endpoint is active | | | `ACTIVITY_TYPE_DELETE_WEBHOOK_ENDPOINT` | `endpoint_id` | string | The ID of the webhook endpoint being deleted | #### Examples To deny signing raw payloads with the NO\_OP hash function (except for EIP-712): ```json theme={"system"} { "policyName": "Deny NO_OP hash signing", "effect": "EFFECT_DENY", "condition": "activity.type == 'ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2' && activity.params.hash_function == 'HASH_FUNCTION_NO_OP' && activity.params.encoding != 'PAYLOAD_ENCODING_EIP712'" } ``` To allow a user to delete only themselves: ```json theme={"system"} { "policyName": "Allow self-deletion", "effect": "EFFECT_ALLOW", "consensus": "approvers.any(user, user.id == '')", "condition": "activity.type == 'ACTIVITY_TYPE_DELETE_USERS' && activity.params.user_ids.count() == 1 && '' in activity.params.user_ids" } ``` ### Root quorum activities There are a select few activities that are not governed by policies, but rather by an organization's [root quorum](/features/users/root-quorum). These activities are: `ACTIVITY_TYPE_UPDATE_ROOT_QUORUM`, `ACTIVITY_TYPE_SET_ORGANIZATION_FEATURE`, `ACTIVITY_TYPE_REMOVE_ORGANIZATION_FEATURE`, `ACTIVITY_TYPE_UPDATE_ORGANIZATION_NAME`. For example, if a policy is added that allows a specific non-root user to perform `ACTIVITY_TYPE_SET_ORGANIZATION_FEATURE` activities, these requests will still fail as they are subject specifically to root quorum. ### Ethereum Our Ethereum policy language (accessible via `eth.tx`) allows for the granular governance of signing Ethereum (EVM-compatible) transactions. Our policy engine exposes a [fairly standard set of properties](https://ethereum.org/en/developers/docs/transactions/#typed-transaction-envelope) belonging to a transaction. See the [Ethereum policy examples](/features/policies/examples/ethereum) for sample scenarios. The policy engine's `int` type is limited to 128 bits (i128). Ethereum smart contracts support signed integers up to 256 bits (`int256`), but values exceeding the 128-bit signed range cannot be used in policy conditions. #### EIP-712 Our policy engine supports EIP-712 typed data signing (accessible via `eth.eip_712`). When defining policies for EIP-712 messages, please ensure that all hex-encoded strings (e.g. addresses, function selectors, bytes) are **lowercase**. The policy engine expects lowercase hex strings to conform to Ethereum's standard convention. Using uppercase hex strings may result in errors or policy rejection. Note that EIP-712 messages passed in as transactions will be normalized to lowercase. ### Solana Similarly, our Solana policy language (accessible via `solana.tx`) allows for control over signing Solana transactions. Note that there are some fundamental differences between the architecture of the two types of transactions, hence the resulting differences in policy structure. Notably, within our policy engine, a Solana transaction contains a list of Transfers, currently corresponding to native SOL transfers. Each transfer within a transaction is considered a separate entity. Each entity represents only top-level transfers that directly invoke supported System Program transfer instructions and do not include transfers performed indirectly inside other programs, or via unsupported System Program instructions. Similarly, the policy engine exposes `solana.tx.spl_transfers`, which contains only top-level SPL transfers using the supported Token and Token-2022 instructions `Transfer`, `TransferChecked`, and `TransferCheckedWithFee`. SPL transfers performed indirectly inside other programs or via unsupported Token and Token-2022 instructions are not detected and do not appear in this list. Here are some approaches you might take to govern transfers: * *All* transfers need to match the policy condition. Useful for allowlists ([example](/features/policies/examples/solana#allow-solana-transactions-that-include-a-transfer-to-only-one-specific-recipient)) * *Just one* transfer needs to match the policy condition. Useful for blocklists ([example](/features/policies/examples/solana#deny-all-solana-transactions-transferring-to-an-undesired-address)) * Only match if there is a *single* transfer in the transaction, *and* that transfer meets the criteria ([example](/features/policies/examples/solana#allow-solana-transactions-that-have-exactly-one-transfer,-to-one-specific-recipient)). This is the most secure approach, and thus most restrictive. #### Account address lookups Solana transactions can reference onchain address lookup tables for account addresses. Turnkey surfaces any account address pulled from a lookup table as the literal string `ADDRESS_TABLE_LOOKUP` in Solana address fields (`account_keys`, instruction accounts, `transfers`, and `spl_transfers`). The `solana.tx.address_table_lookups` array indicates when lookups are present, but the specific addresses are not resolved. If you rely on allowlists or denylists of addresses, add a guard for this placeholder (for example, require `solana.tx.address_table_lookups.count == 0` before comparing addresses, or explicitly deny when `ADDRESS_TABLE_LOOKUP` appears with something like `solana.tx.transfers.any(t, t.to == 'ADDRESS_TABLE_LOOKUP')`) so that dynamic lookups cannot bypass or unexpectedly fail your policy. See the [address table lookup examples](/features/policies/examples/solana#deny-all-address-table-lookups) for examples on how to enforce this. #### Program address lookups Turnkey rejects Solana transactions where program addresses are resolved via address lookup tables. Program IDs must be statically defined in the transaction to enable static analysis of instructions without requiring onchain data lookups. If your transaction references a program via an address table lookup, the signing request will fail. Account addresses (non-program) can still be dynamically resolved via lookup tables as described above. See the [Solana policy examples](/features/policies/examples/solana) for sample scenarios. ### Tron Our Tron policy language (accessible via `tron.tx`) allows for policy control over signing Tron transactions. Our policy language supports the standard fields in a Tron transaction: [https://developers.tron.network/docs/tron-protocol-transaction](https://developers.tron.network/docs/tron-protocol-transaction). To reference a Contract within a Transaction you should use `tron.tx.contract[0].field_name` in your policy where field\_name is some field of the contract used in your transaction. While Tron only currently supports 1 contract per transaction this could change in the future, and we're ready for it if it does! The policy engine currently supports the following Tron contract types: * TransferContract (TRX transfers) * TriggerSmartContract (Smart contract, including, but not limited to TRC-20, invocations) * DelegateResourceContract * UnDelegateResourceContract * FreezeBalanceV2Contract * UnfreezeBalanceV2Contract * AccountPermissionUpdateContract See the [Tron policy examples](/features/policies/examples/tron) for sample scenarios. ### Bitcoin Our Bitcoin policy language (accessible via `bitcoin.tx`) allows for policy control over signing Bitcoin transactions. NOTE: While our `SIGN TRANSACTION` endpoint takes in a Partially Signed Bitcoin Transaction (PSBT) as required for signing context -- our policy language supports only the standard fields inside a Bitcoin transaction: [https://learnmeabitcoin.com/technical/transaction/#structure](https://learnmeabitcoin.com/technical/transaction/#structure) For further reference on how Turnkey handles Bitcoin transactions in our policy-enabled transaction signing flow, check out this section in our [Bitcoin Network Support](/features/networks/bitcoin#policy-enabled-bitcoin-transaction-signing) page. See the [Bitcoin policy examples](/features/policies/examples/bitcoin) for sample Bitcoin policies. ### Tempo Our Tempo policy language (accessible via `tempo.tx`) allows for policy control over signing Tempo transactions. Tempo transactions natively support batched calls — a single transaction can contain one or more calls that execute atomically. The `tempo.tx.calls` list gives you access to each individual call, including its destination and raw input data. The `tempo.tx` namespace exposes the following transaction-level fields: `chain_id`, `from`, `nonce`, `gas_limit`, `max_fee_per_gas`, `max_priority_fee_per_gas`, `fee_token`, `valid_before`, and `valid_after`. Each call in `tempo.tx.calls` exposes: `to`, `input`, and `function_signature`. You can also govern Tempo transactions at the activity level using `activity.params.type == 'TRANSACTION_TYPE_TEMPO'`, combined with other fields such as specific wallets, private keys, or consensus rules. See the [Tempo policy examples](/features/policies/examples/tempo) for sample scenarios. # Policies Source: https://docs.turnkey.com/features/policies/overview Our policy engine is the foundation for flexible controls and permissions within your organization. This page provides an overview of how to author policies. ## Policy structure Our policies are defined using **JSON**. The `effect` determines if an activity should be allowed or denied based on the evaluation of the `consensus` and `condition` fields. `consensus` and `condition` are composed of ergonomic expressions written in our [policy language](/features/policies/language) that must evaluate to a `bool`. `consensus` determines which user(s) may take an action (e.g. a given user ID). `condition` determines the conditions under which the policy applies (e.g. signing with a specific wallet). These fields can be used alone or together. #### See below for an example policy that allows a single user to send transactions to a single address ```json theme={"system"} { "effect": "EFFECT_ALLOW", "consensus": "approvers.any(user, user.id == '4b894565-fa11-42fc-b813-5bf4ea3d53f9')", "condition": "eth.tx.to == ''" } ``` ## Policy evaluation All policies defined within an Organization are evaluated on each request. The image below describes how an activity outcome is determined when resolving multiple policies. The rule follows the below steps: If a quorum of root users takes the action, the final outcome is `OUTCOME_ALLOW` Else if any applicable policy has `EFFECT_DENY`, the final outcome is `OUTCOME_DENY`. This is also referred to as "explicit deny." Else if at least one applicable policy has `EFFECT_ALLOW`, then the final outcome is `OUTCOME_ALLOW` Else the final outcome is `OUTCOME_DENY`. This is also referred to as "implicit deny." In cases of conflicts, `EFFECT_DENY` always wins. Stated differently: policy overview Almost all actions on Turnkey are implicitly denied by default. There are a few exceptions, however: * The Root Quorum bypasses any policies. * All users have implicit GET (read) permissions in their own Organization and any associated Sub-Organizations. * All users have implicit permission to change their own credentials, unless a policy explicitly allows or denies those actions. * All users have implicit permission to approve an activity if they were included in consensus (i.e., a user specified as part of the consensus required to approve a SIGN\_TRANSACTION activity does not need separate, explicit permission to sign transactions). To learn more about our Policies, check out our Policy Language [here](/features/policies/language). # Policy quickstart Source: https://docs.turnkey.com/features/policies/quickstart This guide will help you add an additional user to your Turnkey organization and set permissions for that user through Policies. Specifically, we will create an API-only user with permissions to sign transactions to an allowlisted address. This assumes that you previously completed the [Sign a transaction](/get-started/quickstart) guide, and thus have already set up: * Your Turnkey organization * An API key for the Root User * A Wallet with an Ethereum account ## Create your new users New users in your Turnkey organization can be created by navigating to the "Users" tab and clicking "Add User". Screen Shot 2023-02-17 at 9.42.29 AM.png In the create user flow, you have the option to grant API key or web access to your new user. For this example, we're going to create an API-only user. Screen Shot 2023-02-21 at 6.17.11 PM.png Under access types, select "API key". Enter the user name "Policy Test". This will be an API-only user, and therefore an email is not required. Click continue and create a new API key to associate with the user using the following command: ```bash theme={"system"} turnkey generate api-key --organization $ORGANIZATION_ID --key-name policy_test ``` This will create 2 files, "policy\_test.public" and "policy\_test.private". Copy the contents of the ".public" file and paste it into "API public key". Finish the create user flow and authenticate. Your new user will appear in the Users table. Note down the user ID as you will use it in the next step. ## Create policies for your new users. Next we will create a policy to grant permissions to the new user. Navigate to the "Policies" tab and click on "Add new policy". Screen Shot 2023-05-10 at 1.29.00 PM.png Choose a name and note to describe your new policy. Next, enter the following policy, making sure to replace `` with an Ethereum address of your choosing and `` with the user ID of your recently created API user. ```json theme={"system"} { "effect": "EFFECT_ALLOW", "consensus": "approvers.any(user, user.id == '')", "condition": "eth.tx.to == ''" } ``` ## Test your policies Generate sample transactions using our [transaction tool](https://build.tx.xyz). **You'll want to create two transactions**: one transaction to the address you selected in your whitelist policy above, and one to any other address. Next, try signing these two different transactions by replacing `` in the code snippet below. As a reminder, this guide assumes you've completed the [Quickstart](/get-started/quickstart) guide, and have set `$ORGANIZATION_ID` as an environment variable. ```json theme={"system"} turnkey request --path /public/v1/submit/sign_transaction --body '{ "timestampMs": "'"$(date +%s)"'000", "type": "ACTIVITY_TYPE_SIGN_TRANSACTION_V2", "organizationId": "'"$ORGANIZATION_ID"'", "parameters": { "signWith": "", "type": "TRANSACTION_TYPE_ETHEREUM", "unsignedTransaction": "" } }' --key-name policy_test ``` You'll see that the activity to allowlisted address comes back as `COMPLETED`, while the activity to the non-allowlisted address comes back as `FAILED`. You've successfully set your first policy! ## Extra credit * Try out some of our [policy examples](/features/policies/examples/ethereum) * Check out the [policy overview](/features/policies/overview) * Learn how to author policies with our [policy language](/features/policies/overview) # Smart contract interfaces — ABIs & IDLs Source: https://docs.turnkey.com/features/policies/smart-contract-interfaces This page provides an overview of the Policy Engine's support for parsing calls to Smart Contracts on Ethereum and Programs on Solana by uploading the JSON respresentation of the respective ABI (Ethereum) or IDL (Solana) ## Using ABIs and IDLs to control transaction signing With the introduction of Turnkey's smart contract interface functionality, our policy engine includes enhanced support for uploading Ethereum ABIs and Solana IDLs, empowering your organization to build more sophisticated and context-aware policies. By parsing transaction call data through these standardized interfaces, the policy engine can accurately interpret and enforce rules based on the specific function calls, arguments, and data structures used in smart contract interactions. This enables granular control over wallet operations, such as restricting access to certain contract methods and validating transaction parameters—across both Ethereum and Solana ecosystems. The following guide will walk you through uploading a specific ABI or IDL, and then crafting a policy that targets specific contract call arguments. For an example usage flow, please navigate to the [Usage Walkthrough](#usage-walkthrough) section. ### Ethereum #### ABI format Ethereum ABIs are represented in JSON format as an array of objects, each describing a function, constructor, event, or error. Each object contains specific fields that fully describe the callable interface or event signature. See [ABI documentation reference](https://docs.ethers.org/v5/api/utils/abi/formats/) for more. **Example ABI** ```json theme={"system"} [ { "type": "function", "name": "transfer", "inputs": [ { "name": "_to", "type": "address" }, { "name": "_amount", "type": "uint256" } ], "outputs": [], "stateMutability": "nonpayable" }, { "type": "event", "name": "Transfer", "inputs": [ { "name": "from", "type": "address", "indexed": true }, { "name": "to", "type": "address", "indexed": true }, { "name": "value", "type": "uint256", "indexed": false } ], "anonymous": false } ] ``` #### Policy formats For Ethereum, if an ABI corresponding to a contract has been uploaded, then ABI related policies for transactions calling that contract will be available under the following namespaces: * **function\_name**: This field contains the string representation of the name of the function as defined in the ABI * **function\_signature**: This field contains the bytes making up the function signature * **contract\_call\_args**: This field contains all the arguments in a mapping of arg name to argument **NOTE:** The contract\_call\_args field, at the first level, uses a `MapKey` access pattern. All arguments are named and are accessed using the syntax as such: ```json theme={"system"} { "condition": "eth.tx.contract_call_args['arg_name'] == 1" } ``` ### Solana For Turnkey's Solana IDL support, we accept IDLs formatted according to [Anchor's IDL language](https://www.anchor-lang.com/docs) standardization. While other standards do exist, most commonly used IDLs that aren't Solana's own native IDLs, adhere to the Anchor IDL format, and there exist tools like [native-to-anchor](https://github.com/acheroncrypto/native-to-anchor) which can help create anchor formatted IDLs for native solana programs. #### Turnkey formatting requirements **NOTE**: this is just included for reference and troubleshooting, most Anchor IDLs should work straight out of the box. Also, some older formats of IDLs are supported (such as using the optional boolean `signer` instead of `isSigner`, or the optional boolean `writable` instead of `isMut`) – the format detailed below is the most widely used format, for reference. **Instructions Array** *The instructions array is a list of objects, each defining an instruction callable by the program.* * **instructions** (array of objects) * **name** (string): Name of the instruction. * **discriminator** (optional): Unique identifier for the instruction (optional). * **accounts** (array of objects): List of accounts required by the instruction. * **isMut** (boolean): Whether the account is mutable. * **isSigner** (boolean): Whether the account is a signer. * **isOptional** (boolean): Whether the account is optional. * **name** (string): Name of the account. * **args** (array of objects): Arguments required by the instruction. * **name** (string): Name of the argument. * **type** (IdlType enum): Data type of the argument. **Types Array** *The types array defines custom data structures used by the program.* * **types** (array of objects) * **name** (string): Name of the custom type. * **type** (object) * **kind** (string enum): The kind of type (e.g., "struct"). * **fields** (array of objects): Fields within the type. * **name** (string): Name of the field. * **type** (IdlType enum): Data type of the field. **NOTE:** discriminators are optional because anchor has a default method of generating the discriminators deterministically from the instruction names. If your uploaded IDL does not include instruction discriminators, we will internally generate them as per this standard. See [Anchor Discriminator Reference](https://www.anchor-lang.com/docs/basics/idl#discriminators) for more. **NOTE:** The `types` key must be present in all uploaded IDLs, even for programs that do not define custom types. If your program's IDL does not include a `types` array, add an empty array (`"types": []`) before uploading. **Example IDL** ```json theme={"system"} { "instructions": [ { "name": "initialize", "accounts": [ { "name": "authority", "isMut": false, "isSigner": true, "isOptional": false } ], "args": [ { "name": "amount", "type": "u64" } ] } ], "types": [ { "name": "MyStruct", "type": { "kind": "struct", "fields": [ { "name": "value", "type": "u64" } ] } } ] } ``` **Supported Arg Types** Solana IDLs support various different types of arguments to instructions. The following argument types are supported for Solana IDL parsing and call data parsing. **IdlType** * **Fixed arrays:** Array\ * **Booleans:** Bool * **Byte strings:** Bytes * **Float types:** F32, F64 * **Signed Integer Types:** I8, I16, I32, I64, I128 * **Unsigned Integer Types:** U8, U16, U32, U64, U128 * **Solana Addresses:** PublicKey * **Vectors:** Vec\ * **Strings:** String * **Optional Types:** Option\ * **Custom Defined Types:** DefinedType The most notable here are **Defined Types.** Defined types in IDLs refer to custom types—such as structs and enums—that are created by the Solana program developer and used as argument types in instructions or as fields in accounts. The following defined types are currently supported: * Enum * Struct * Alias **Where to get IDLs from** Solana IDL JSON objects, as formatted for use with Turnkey, can be obtained by the following methods: * **Explorer Links** * Solscan: * [Example Solscan Link to Program IDL (Jupiter)](https://solscan.io/account/JUP6LkbZbjS1jKKwapdHNy74zcZ3tLUZoi5QNyVTaV4#anchorProgramIdl) * [Example Solana.Explorer Link to Program IDL (Jupiter)](https://explorer.solana.com/address/JUP6LkbZbjS1jKKwapdHNy74zcZ3tLUZoi5QNyVTaV4/anchor-program) * [Anchor CLI:](https://www.anchor-lang.com/docs/references/cli) * Using the command: `anchor idl ` #### Policy formats On the Solana side, if an IDL corresponding to a program has been uploaded, then IDL related policies for instructions calling that program will be available in each instruction under the `parsed_instruction_data` namespace. The subfields will be as follows: * **instruction\_name:** Name of the instruction that is being called in call data * **discriminator:** the bytes at the beginning of the instruction call data that signifies which instruction is being called * **named\_accounts:** a mapping of account names (as defined in the IDL) to the actual accounts that were entered to this instruction * **program\_call\_args:** all program arguments required by this instruction call **Note:** The program\_call\_args field, at the first level, uses a `MapKey` access pattern. All arguments are named and are accessed using the syntax as such: ```json theme={"system"} { "condition": "solana.tx.instructions[0].parsed_instruction_data.program_call_args['arg_name'] == 1" } ``` **Example Usage** Let's say that the IDL for Jupiter has been uploaded, as found [here](https://explorer.solana.com/address/JUP6LkbZbjS1jKKwapdHNy74zcZ3tLUZoi5QNyVTaV4/anchor-program) Here's an example policy related to its `route` instruction: ```json theme={"system"} { "effect": "EFFECT_ALLOW", "condition": "solana.tx.instructions.any(i, i.program_key == 'JUP6LkbZbjS1jKKwapdHNy74zcZ3tLUZoi5QNyVTaV4' && i.parsed_instruction_data.instruction_name == 'route' && i.parsed_instruction_data.program_call_args['in_amount'] == 995500000)" } ``` ### Usage walkthrough Let's walk through an example flow of how to explicitly reference smart contract arguments in policies by uploading the ABI for the smart contract which you will be invoking in your transactions. Let's take the Wrapped ETH (WETH) smart contract as an example. Its ABI can be found [here](https://etherscan.io/address/0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2#code), and we've included the JSON down below: ```json theme={"system"} [{"constant":true,"inputs":[],"name":"name","outputs":[{"name":"","type":"string"}],"payable":false,"stateMutability":"view","type":"function"},{"constant":false,"inputs":[{"name":"guy","type":"address"},{"name":"wad","type":"uint256"}],"name":"approve","outputs":[{"name":"","type":"bool"}],"payable":false,"stateMutability":"nonpayable","type":"function"},{"constant":true,"inputs":[],"name":"totalSupply","outputs":[{"name":"","type":"uint256"}],"payable":false,"stateMutability":"view","type":"function"},{"constant":false,"inputs":[{"name":"src","type":"address"},{"name":"dst","type":"address"},{"name":"wad","type":"uint256"}],"name":"transferFrom","outputs":[{"name":"","type":"bool"}],"payable":false,"stateMutability":"nonpayable","type":"function"},{"constant":false,"inputs":[{"name":"wad","type":"uint256"}],"name":"withdraw","outputs":[],"payable":false,"stateMutability":"nonpayable","type":"function"},{"constant":true,"inputs":[],"name":"decimals","outputs":[{"name":"","type":"uint8"}],"payable":false,"stateMutability":"view","type":"function"},{"constant":true,"inputs":[{"name":"","type":"address"}],"name":"balanceOf","outputs":[{"name":"","type":"uint256"}],"payable":false,"stateMutability":"view","type":"function"},{"constant":true,"inputs":[],"name":"symbol","outputs":[{"name":"","type":"string"}],"payable":false,"stateMutability":"view","type":"function"},{"constant":false,"inputs":[{"name":"dst","type":"address"},{"name":"wad","type":"uint256"}],"name":"transfer","outputs":[{"name":"","type":"bool"}],"payable":false,"stateMutability":"nonpayable","type":"function"},{"constant":false,"inputs":[],"name":"deposit","outputs":[],"payable":true,"stateMutability":"payable","type":"function"},{"constant":true,"inputs":[{"name":"","type":"address"},{"name":"","type":"address"}],"name":"allowance","outputs":[{"name":"","type":"uint256"}],"payable":false,"stateMutability":"view","type":"function"},{"payable":true,"stateMutability":"payable","type":"fallback"},{"anonymous":false,"inputs":[{"indexed":true,"name":"src","type":"address"},{"indexed":true,"name":"guy","type":"address"},{"indexed":false,"name":"wad","type":"uint256"}],"name":"Approval","type":"event"},{"anonymous":false,"inputs":[{"indexed":true,"name":"src","type":"address"},{"indexed":true,"name":"dst","type":"address"},{"indexed":false,"name":"wad","type":"uint256"}],"name":"Transfer","type":"event"},{"anonymous":false,"inputs":[{"indexed":true,"name":"dst","type":"address"},{"indexed":false,"name":"wad","type":"uint256"}],"name":"Deposit","type":"event"},{"anonymous":false,"inputs":[{"indexed":true,"name":"src","type":"address"},{"indexed":false,"name":"wad","type":"uint256"}],"name":"Withdrawal","type":"event"}] ``` We'll first navigate to the Security tab of your [Turnkey dashboard](https://app.turnkey.com/dashboard/welcome): dashboard welcome You'll then see a section on Smart Contract Interfaces: smart contract interfaces Upon clicking the Create interface button, you can enter in your Smart Contract Interface details: create interface empty Finally, you can confirm the details: NOTE: It's important to make sure that the `Address` section of the smart contract interface creation is populated with the correct Address. It is case insensitive with Ethereum, but case sensitive with Solana. create interface review For the purposes of this guide, we'll be targeting the `transfer` function call. It has two arguments: `wad` (uint256) and `dst` (address), corresponding to the amount and destination, respectively. We can now next construct a policy like the following: ```json theme={"system"} { "effect": "EFFECT_ALLOW", "condition": "eth.tx.contract_call_args['wad'] < 1000000000000000000 && eth.tx.contract_call_args['dst'] == '0x08d2b0a37F869FF76BACB5Bab3278E26ab7067B7'" } ``` In plain English, this policy requires that the transaction has a wad of less than 1 ETH, and that the `dst` is a specific address (our testnet warchest). We can create this policy via the same Security tab: create policy After entering the policy details, we can review and approve the activity: create policy review In addition to contract call arguments, you can also explicitly specify the function name and function signature corresponding to a transaction. Given we're currently using a `transfer` call, we can enforce it within a policy via the following: ```json theme={"system"} { "effect": "EFFECT_ALLOW", "condition": "eth.tx.function_name == 'transfer' && eth.tx.function_signature == '0xa9059cbb'" } ``` Note that the `0x` prefix is necessary when writing a policy against function signatures. Generally, you can find function signatures on an explorer like Etherscan. In this case, the function signature for WETH's `transfer` can be found [here](https://etherscan.io/address/0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2#writeContract). Note that these two operations, creating a new Smart Contract Interface and a Policy, can be performed programmatically as well. Here's are two respective sample snippets that use our [`@turnkey/sdk-server`](https://www.npmjs.com/package/@turnkey/sdk-server) package: ```ts theme={"system"} // Create Smart Contract Interface import { Turnkey as TurnkeySDKServer } from "@turnkey/sdk-server"; ... const turnkeyClient = new TurnkeySDKServer({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const abi = []; // your ABI here const { smartContractInterfaceId } = await turnkeyClient.apiClient().createSmartContractInterface({ label: "WETH mainnet", notes: "For WETH mainnet transfers", type: "SMART_CONTRACT_INTERFACE_TYPE_ETHEREUM", smartContractAddress: "0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2", smartContractInterface: JSON.stringify(abi), }); ``` ```ts theme={"system"} // Create Policy import { Turnkey as TurnkeySDKServer } from "@turnkey/sdk-server"; ... const turnkeyClient = new TurnkeySDKServer({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: process.env.ORGANIZATION_ID!, }); const { policyId } = await turnkeyClient.apiClient().createPolicy({ policyName: "Limit WETH transfers", condition: "eth.tx.contract_call_args['wad'] < 1000000000000000000 && eth.tx.contract_call_args['dst'] == '0x08d2b0a37F869FF76BACB5Bab3278E26ab7067B7'", effect: "EFFECT_ALLOW", notes: "Specify WETH amount and destination", }); ``` **References** * [Native to Anchor](https://github.com/acheroncrypto/native-to-anchor): Tool that creates Anchor IDLs for native solana programs * [Anchor Framework Github (Solana Foundation)](https://github.com/solana-foundation/anchor/tree/master?tab=readme-ov-file): Github reference for Anchor **FAQ:** * Q: Is there a size limit on ABIs or IDLs? * A: Yes, we enforce a limit of 400kb. If your ABI/IDL exceeds that, we recommend minifying the JSON string (to get rid of whitespaces or extra characters). This can be done programmatically via a command similar to `JSON.stringify()`, or a webtool like [https://codebeautify.org/jsonminifier](https://codebeautify.org/jsonminifier) . # Sub-organizations Source: https://docs.turnkey.com/features/sub-organizations Using Turnkey's flexible infrastructure, you can programmatically create and manage sub-organizations for your end-users. Sub-organizations aren't subject to size limits: you can create as many sub-organizations as needed. The parent organization has **read-only** visibility into all of its sub-organizations, and activities performed in sub-organizations roll up to the parent for billing purposes. We envision sub-organizations being very useful to model your end-users if you're a business using Turnkey for key management. Let's explore how. ## Creating sub-organizations Creating a new sub-organization is an activity performed by the parent organization. The activity itself takes the following attributes as inputs: * organization name * a list of root users * a root quorum threshold * \[optional] a wallet (note: in versions prior to V4, this was a private key) Root users can be programmatic or human, with one or many credentials attached. ## Using sub-organizations You can use this primitive to model end-user controlled wallets or custodial wallets. If you have another use-case in mind, or questions/feedback on this page, reach out to [welcome@turnkey.com](mailto:welcome@turnkey.com)! ## Deleting sub-organizations To delete a sub-organization, you can use the [delete sub-organization activity](/api-reference/activities/delete-sub-organization). Before proceeding, ensure that all private keys and wallets within the sub-organization have been exported to prevent any loss of funds. Alternatively, you can set the `deleteWithoutExport` parameter to `true` to bypass this requirement. By default, the `deleteWithoutExport` parameter is set to `false`. This activity must be initiated by a root user in the sub-organization that is to be deleted. A parent org cannot delete a sub-organization without its participation. # Transaction management Source: https://docs.turnkey.com/features/transaction-management Learn about Turnkey's gas sponsorship, transaction construction, broadcast, nonce management and monitoring capabilities. # Overview Traditionally, sending blockchain transactions onchain has been painful: * You need to fund wallets with native gas tokens, creating onboarding friction * Network congestion and fee spikes can cause transactions to stall or get dropped altogether Turnkey reduces this to a couple of API calls. We handle fees and our battle-tested broadcast logic ensures inclusion even under adverse network conditions. You and your users never touch gas tokens or deal with stuck transactions. ## Supported chains **EVM (sponsored and non-sponsored):** * **Base** - eip155:8453 * **Polygon** - eip155:137 * **Ethereum** - eip155:1 * **Arbitrum** - eip155:42161 * **Tempo** - eip155:4217 * **BNB Chain** - eip155:56 **EVM testnets (sponsored and non-sponsored):** * **Base (Sepolia)** - eip155:84532 * **Polygon (Amoy)** - eip155:80002 * **Ethereum (Sepolia)** - eip155:11155111 * **Arbitrum (Sepolia)** - eip155:421614 * **Tempo Moderato** - eip155:42431 * **BNB Chain Testnet** - eip155:97 **Solana (sponsored):** * **Solana mainnet** - solana:mainnet * **Solana devnet** - solana:devnet > Interested in another chain? Reach out to us! To access sponsored transactions, ensure that Gas Sponsorship is first enabled within your Turnkey dashboard. Then set `sponsor: true` and update the `caip2` parameter with the corresponding chain identifier. ## Construction and Broadcast ### EVM A successful EVM transaction requires: * **Transaction construction**: assembling the payload (recipient, value, calldata) * **Nonce**: set correctly to order transactions and prevent conflicts * **Gas and tip fee**: estimated to ensure inclusion even during network congestion * **Signature**: cryptographically signing the transaction with the sender's private key * **Broadcast**: submitting the signed transaction to the network and monitoring for inclusion Turnkey handles all of this for you via `ethSendTransaction`. Whether or not you use sponsorship, you pass through minimal payloads and we take care of the rest. We auto-fill any fields you omit. This endpoint supports arbitrary EVM transactions — not just simple sends. You can interact with smart contracts, deploy contracts, or execute any valid EVM operation. ### Solana A successful Solana transaction requires: * **Transaction construction**: assembling the list of instructions (program, accounts, data) * **Recent blockhash**: fetched and attached at broadcast time to ensure the transaction is valid * **Compute unit limit**: estimated and set to prevent failed transactions due to insufficient compute * **Priority fee**: set to ensure timely inclusion under current network conditions * **Signature**: cryptographically signing the transaction with the sender's private key * **Broadcast**: submitting the signed transaction to the network and monitoring for confirmation Turnkey handles all of this for you via `solSendTransaction`. Whether or not you use sponsorship, you pass through a minimal payload and we manage the rest. On Solana, fee sponsorship and rent sponsorship are separate. `Sponsor Solana Rent` is disabled by default and must be enabled in the dashboard before Turnkey will pre-fund rent for account creation. If created accounts are later closed, refunded rent can go back to the signer rather than the sponsor. See [Solana Rent Sponsorship](/features/networks/solana-rent-refunds). For payer behavior, static-key requirements, and account-creation caveats in sponsored flows, see [Solana transaction construction for sponsored flows](/features/networks/solana-transaction-construction). ## Concepts ### Gas sponsorship (aka gas abstraction, gasless transactions, fee abstraction) A single endpoint lets you toggle between standard and sponsored transactions. With sponsorship enabled, your users never need to hold native tokens to pay transaction fees — Turnkey covers them. Set `sponsor: true` to enable sponsorship, or `sponsor: false` to have fees paid by the sender's wallet. Either way, Turnkey handles construction, signing, broadcast, and status monitoring. The `sponsor` flag only controls who pays the fee. Gas Sponsorship is available on **Enterprise** plans. * **Enterprise:** Unlimited spend, with configurable time windows Pay-as-you-go and Pro customers can still access transaction construction, signing, and broadcast. If you'd like to leverage gas sponsorship, please reach out! ### Spend limits Turnkey gives you USD-denominated controls over gas sponsorship spend at two levels: * **Organization-wide limit** — the cap on total sponsored spend across your parent organization and all of its sub-organizations. * **Sub-organization limit** — the cap that applies to each of your sub-organizations You can set limit values and time intervals through the dashboard. You can also query current usage against the active limit via the [`get_gas_usage`](https://docs.turnkey.com/api-reference/queries/get-gas-usage) endpoint. Turnkey provides fee sponsorship and transaction broadcasting services only. In high-fee or congested network conditions, delays or non-inclusion may occur. It is the developer's responsibility to ensure appropriate spend limits are in place. ### Policy engine You can write policies against both sponsored and non-sponsored transactions using Turnkey's policy DSL: * **EVM**: use the `eth.tx` namespace * **Solana**: use the `solana.tx` namespace This means you can seamlessly switch between sponsored and non-sponsored transactions and still use the same policies. *Note:* Turnkey sets all fee-related fields to 0 for sponsored transactions. ### Billing Turnkey passes transaction fee costs through to you as a line item at the end of the month. You pay based on the USD value of fees at time of broadcast; Turnkey internalizes the inventory risk of token price changes. Our battle-tested fee estimation aims to be cost-efficient while ensuring quick transaction inclusion. ### Advanced #### Gas sponsorship smart contracts (EVM) We could not find a satisfactory setup for gas sponsorship contracts that were both fast and safe, so we made our own. The contracts are open source and you can check them out on [GitHub](https://github.com/tkhq/gas-station). Based on our benchmarks, these are the most efficient gas sponsorship contracts on the market. They achieve this through optimized logic, calldata encoding, and extensive use of assembly, which reduces gas overhead per sponsored transaction. The result: lower costs for you and faster execution for your users. #### Security Some gas sponsorship setups by other providers are subject to replay attacks. If a malicious actor compromises the provider infrastructure, they can replay the gas sponsorship request multiple times with different nonces to create multiple transactions from a single request. At Turnkey, we never cut corners on security: we perform transaction construction in enclaves, and as long as the request includes the relevant nonce or blockhash, only one transaction can be created from it. Since the user's authenticator signs requests and the enclave verifies signatures, a malicious actor cannot modify or replay the request. This is in line with Turnkey's core system design principle: everything can be compromised outside of the enclaves and funds will still be safe. By default, our SDKs include a special gas station nonce for sponsored transaction requests. ### RPCs Turnkey's send transaction and transaction status endpoints eliminate the need for third-party RPC providers. You save costs and reduce latency because we holistically incorporate internal data and minimize external calls. ## Next steps For implementation guides, see: * [Sending Sponsored EVM Transactions (React)](/features/transaction-management/sending-sponsored-transactions) - Using `@turnkey/react-wallet-kit` * [Sending Sponsored Solana Transactions (React)](/features/transaction-management/sending-sponsored-solana-transactions) - Using `@turnkey/react-wallet-kit` * [Sending Sponsored Transactions](/features/transaction-management/broadcasting) - Using `@turnkey/core` directly # Balances Source: https://docs.turnkey.com/features/transaction-management/balances Learn about Turnkey's balance querying and balance change webhooks. # Overview Turnkey provides two complementary tools for tracking onchain balances: * **Balances API**: query the current balances for a given address on a specific chain, across all supported assets for that chain. * **Balance webhooks**: receive notifications when a transaction that includes a balance change is first seen in a block onchain (`"balances:confirmed"`), or when the containing block has reached the finalization threshold (`"balances:finalized"`). ## Concepts ### Balances API The [Get Balances](/api-reference/queries/get-balances) endpoint returns all non-zero balances for a given address on a specified chain. You can also call [List Supported Assets](/api-reference/queries/list-supported-assets) to retrieve the full catalog of assets available for querying on a given chain, including a logo URL for each asset. Each balance entry includes the asset metadata (symbol, name, decimals, and CAIP-19 identifier) and the current amount held at the address. See the [with-balances](https://github.com/tkhq/sdk/tree/main/examples/transaction-management/with-balances) SDK example for a working integration. The address must belong to a wallet account in your organization. Private key addresses are not supported. #### Supported chains **EVM:** * **Base** - eip155:8453 * **Polygon** - eip155:137 * **Ethereum** - eip155:1 * **Arbitrum** - eip155:42161 * **Tempo** - eip155:4217 * **BNB Chain** - eip155:56 **EVM testnets:** * **Base (Sepolia)** - eip155:84532 * **Polygon (Amoy)** - eip155:80002 * **Ethereum (Sepolia)** - eip155:11155111 * **Arbitrum (Sepolia)** - eip155:421614 * **Tempo Moderato** - eip155:42431 * **BNB Chain Testnet** - eip155:97 **Solana:** * **Solana mainnet** - solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp (alias: `solana:mainnet`) * **Solana devnet** - solana:EtWTRABZaYq6iMfeYKouRu166VU2xqa1 (alias: `solana:devnet`) > Interested in a chain or asset that isn't listed? Reach out to us! ### Webhooks Turnkey Webhooks let you react to balance changes in real time, without polling. Instead of repeatedly calling the Get Balances API to check for updates, you register an endpoint and Turnkey pushes the data to you. Each payload carries the balance diff for that event (asset, address, and amount transferred), so your application can update state immediately without an additional API call. Combined with the Balance APIs, you have everything you need to keep your application's balances up to date without building your own indexing/polling infrastructure or relying on another third party. You subscribe to webhooks at the parent organization level. Subscriptions cover wallet-account addresses across the parent organization and all of its sub-organizations. In other words, once you subscribe you'll receive webhook notifications for all the addresses within your entire Turnkey instance. #### Webhooks - Confirmed vs. Finalized Turnkey emits two event types for every balance change: * `"balances:confirmed"` fires when a supported asset transfer is first included in a block onchain. The transfer has happened, but a chain reorganization could still remove it from the canonical chain. * `"balances:finalized"` fires once the containing block has reached the finalization threshold for that chain. At this point the chance of the transfer being removed by a reorg is negligible. You can subscribe to one or both. For example, a consumer app that wants its UI to react immediately can listen on `"balances:confirmed"`, render the deposit as pending, and clear that state when the matching `"balances:finalized"` arrives. An application moving high-value transfers that needs certainty before crediting funds can ignore `"balances:confirmed"` entirely and act only on `"balances:finalized"`. #### Subscribing Use the [Create Webhook Endpoint](/api-reference/activities/create-webhook-endpoint) API with the `BALANCE_CONFIRMED_UPDATES` or `BALANCE_FINALIZED_UPDATES` event type. You can subscribe to one or both by registering a subscription per event type. The endpoint itself is associated with the parent organization. Once active, the events will be delivered for wallet-account addresses across the parent organization and all of its sub-organizations. This covers both Turnkey-generated addresses and imported addresses. #### Reorg handling The two-webhook model handles chain reorganizations transparently. If a confirmed transaction is involved in a reorg, the following sequence of webhooks will be seen: 1. The original `"balances:confirmed"` fires when the transaction is first included. 2. The reorg occurs and the transaction is removed from the canonical chain. 3. A new `"balances:confirmed"` fires when the transaction is included again in the new canonical chain. 4. A `"balances:finalized"` fires for the canonical inclusion once it reaches finality. If the transaction never re-enters the canonical chain, no `"balances:finalized"` event fires for it. Either way, `"balances:finalized"` is the source of truth for what actually landed onchain. You don't need to track and roll back state from earlier confirmed events. #### Delivery Balance webhooks use at-least-once processing. If your endpoint is unreachable or a delivery fails on our side, Turnkey will retry. Each webhook payload includes a `idempotencyKey` which is guaranteed to be unique, and which can be safely used to deduplicate deliveries on your end. #### Supported chains Balance webhooks are currently supported on: **EVM:** * **Base** - eip155:8453 * **Polygon** - eip155:137 * **Ethereum** - eip155:1 * **Arbitrum** - eip155:42161 * **Tempo** - eip155:4217 * **BNB Chain** - eip155:56 **EVM testnets:** * **Base (Sepolia)** - eip155:84532 * **Polygon (Amoy)** - eip155:80002 * **Ethereum (Sepolia)** - eip155:11155111 * **Arbitrum (Sepolia)** - eip155:421614 * **Tempo Moderato** - eip155:42431 * **BNB Chain Testnet** - eip155:97 **Solana:** * **Solana mainnet** - solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp (alias: `solana:mainnet`) * **Solana devnet** - solana:EtWTRABZaYq6iMfeYKouRu166VU2xqa1 (alias: `solana:devnet`) > Interested in another chain? Reach out to us! #### Confirmation thresholds The `balances:finalized` webhook fires once the block containing a transaction has reached a chain-specific number of confirmations. The table below lists the confirmation threshold Turnkey uses for each supported network: | Network | CAIP-2 Identifier | Confirmations | | :---------------- | :---------------------------------------- | ------------: | | Ethereum Mainnet | `eip155:1` | 32 | | Ethereum Sepolia | `eip155:11155111` | 12 | | Base Mainnet | `eip155:8453` | 10 | | Base Sepolia | `eip155:84532` | 5 | | Polygon Mainnet | `eip155:137` | 30 | | Polygon Amoy | `eip155:80002` | 12 | | Arbitrum Mainnet | `eip155:42161` | 10 | | Arbitrum Sepolia | `eip155:421614` | 5 | | Tempo Mainnet | `eip155:4217` | 10 | | Tempo Moderato | `eip155:42431` | 5 | | BNB Chain | `eip155:56` | 15 | | BNB Chain Testnet | `eip155:97` | 15 | | Solana mainnet | `solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp` | 32 | | Solana devnet | `solana:EtWTRABZaYq6iMfeYKouRu166VU2xqa1` | 32 | #### Delivery payload Each delivery corresponds to a single balance-change event: one address, one operation (`deposit` or `withdraw`), and one asset. Because a single transaction can affect multiple addresses or assets, it may produce multiple webhook deliveries — each with its own `idempotencyKey`. ##### Example payload (`balances:confirmed`) ```json theme={"system"} { "type": "balances:confirmed", "organizationId": "95dfcd47-99bb-4433-9126-1524110d68e6", "parentOrganizationId": "95dfcd47-99bb-4433-9126-1524110d68e6", "msg": { "operation": "deposit", "caip2": "eip155:8453", "txHash": "0x5b6901be92e69781a7ce401dd9a2910e1f49aa77a5bdedcd2a23c8d563d88b24", "address": "0x3400e577153101863f39ba41f7fd49bbea011628", "idempotencyKey": "d3b8cef0ad7479433783c5707da9ded4fee9b254b4638f44758a2141c49416b7:balances:confirmed", "asset": { "symbol": "ETH", "name": "Ethereum", "decimals": 18, "caip19": "eip155:8453/slip44:60", "amount": "4793760441409" }, "block": { "number": 46343814, "hash": "0x41a4e8d444e5410f83c1ac35c838c7d8be1e3d6f32a35a04c72096adae74d095", "timestamp": "2026-05-22T19:09:35Z" } } } ``` ##### Example payload (`balances:finalized`) ```json theme={"system"} { "type": "balances:finalized", "organizationId": "95dfcd47-99bb-4433-9126-1524110d68e6", "parentOrganizationId": "95dfcd47-99bb-4433-9126-1524110d68e6", "msg": { "operation": "deposit", "caip2": "eip155:8453", "txHash": "0x5b6901be92e69781a7ce401dd9a2910e1f49aa77a5bdedcd2a23c8d563d88b24", "address": "0x3400e577153101863f39ba41f7fd49bbea011628", "idempotencyKey": "d3b8cef0ad7479433783c5707da9ded4fee9b254b4638f44758a2141c49416b7:balances:finalized", "asset": { "symbol": "ETH", "name": "Ethereum", "decimals": 18, "caip19": "eip155:8453/slip44:60", "amount": "4793760441409" }, "block": { "number": 46343814, "hash": "0x41a4e8d444e5410f83c1ac35c838c7d8be1e3d6f32a35a04c72096adae74d095", "timestamp": "2026-05-22T19:09:35Z" } } } ``` | **Field** | **Description** | | :--------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `type` | `"balances:confirmed"` for when a balance change is first seen onchain, or `"balances:finalized"` when the associated block has reached the finalization threshold. | | `organizationId` | Organization that owns the address. | | `parentOrganizationId` | Billing/parent organization that owns webhook configuration and delivery. | | `msg` | Object containing the balance change details. | | `msg.operation` | Either `"deposit"` (incoming) or `"withdraw"` (outgoing). | | `msg.caip2` | The chain identifier where the event occurred. | | `msg.txHash` | The transaction hash that triggered the balance change. | | `msg.address` | The address whose balance changed. | | `msg.idempotencyKey` | A stable, unique key for this event. Use this to safely deduplicate webhook deliveries. | | `msg.asset` | Asset metadata: symbol, name, decimals, CAIP-19 identifier, and the amount transferred (in the asset's decimals). Webhooks are emitted only for supported assets. | | `msg.block` | Block number, hash, and timestamp of the block in which the transaction was first seen. | See the [with-tx-webhooks](https://github.com/tkhq/sdk/tree/main/examples/transaction-management/with-tx-webhooks) SDK example for a working integration. #### Limitations Balance webhooks fire only for assets in the [supported asset list](/api-reference/queries/list-supported-assets). Balance webhooks are not supported for private keys. # Broadcasting (construction, signing, broadcast, gas abstraction) Source: https://docs.turnkey.com/features/transaction-management/broadcasting Guide for sending sponsored EVM transactions using @turnkey/core for custom frameworks, Node.js servers, or full manual control. # Overview Traditionally, sending blockchain transactions onchain has been painful: * You need to fund wallets with native gas tokens, creating onboarding friction * Network congestion and fee spikes can cause transactions to stall or get dropped altogether Turnkey reduces this to a couple of API calls. We handle fees and our battle-tested broadcast logic ensures inclusion even under adverse network conditions. You and your users never touch gas tokens or deal with stuck transactions. ## Supported chains **EVM (sponsored and non-sponsored):** * **Base** - eip155:8453 * **Polygon** - eip155:137 * **Ethereum** - eip155:1 * **Arbitrum** - eip155:42161 * **Tempo** - eip155:4217 * **BNB Chain** - eip155:56 **EVM testnets (sponsored and non-sponsored):** * **Base (Sepolia)** - eip155:84532 * **Polygon (Amoy)** - eip155:80002 * **Ethereum (Sepolia)** - eip155:11155111 * **Arbitrum (Sepolia)** - eip155:421614 * **Tempo Moderato** - eip155:42431 * **BNB Chain Testnet** - eip155:97 **Solana (sponsored):** * **Solana mainnet** - solana:mainnet * **Solana devnet** - solana:devnet > Interested in another chain? Reach out to us! To access sponsored transactions, ensure that Gas Sponsorship is first enabled within your Turnkey dashboard. Then set `sponsor: true` and update the `caip2` parameter with the corresponding chain identifier. ## Construction and Broadcast ### EVM A successful EVM transaction requires: * **Transaction construction**: assembling the payload (recipient, value, calldata) * **Nonce**: set correctly to order transactions and prevent conflicts * **Gas and tip fee**: estimated to ensure inclusion even during network congestion * **Signature**: cryptographically signing the transaction with the sender's private key * **Broadcast**: submitting the signed transaction to the network and monitoring for inclusion Turnkey handles all of this for you via `ethSendTransaction`. Whether or not you use sponsorship, you pass through minimal payloads and we take care of the rest. We auto-fill any fields you omit. This endpoint supports arbitrary EVM transactions — not just simple sends. You can interact with smart contracts, deploy contracts, or execute any valid EVM operation. ### Solana A successful Solana transaction requires: * **Transaction construction**: assembling the list of instructions (program, accounts, data) * **Recent blockhash**: fetched and attached at broadcast time to ensure the transaction is valid * **Compute unit limit**: estimated and set to prevent failed transactions due to insufficient compute * **Priority fee**: set to ensure timely inclusion under current network conditions * **Signature**: cryptographically signing the transaction with the sender's private key * **Broadcast**: submitting the signed transaction to the network and monitoring for confirmation Turnkey handles all of this for you via `solSendTransaction`. Whether or not you use sponsorship, you pass through a minimal payload and we manage the rest. On Solana, fee sponsorship and rent sponsorship are separate. `Sponsor Solana Rent` is disabled by default and must be enabled in the dashboard before Turnkey will pre-fund rent for account creation. If created accounts are later closed, refunded rent can go back to the signer rather than the sponsor. See [Solana Rent Sponsorship](/features/networks/solana-rent-refunds). For payer behavior, static-key requirements, and account-creation caveats in sponsored flows, see [Solana transaction construction for sponsored flows](/features/networks/solana-transaction-construction). ## Concepts ### Gas sponsorship (aka gas abstraction, gasless transactions, fee abstraction) A single endpoint lets you toggle between standard and sponsored transactions. With sponsorship enabled, your users never need to hold native tokens to pay transaction fees — Turnkey covers them. Set `sponsor: true` to enable sponsorship, or `sponsor: false` to have fees paid by the sender's wallet. Either way, Turnkey handles construction, signing, broadcast, and status monitoring. The `sponsor` flag only controls who pays the fee. Gas Sponsorship is available on **Enterprise** plans. * **Enterprise:** Unlimited spend, with configurable time windows Pay-as-you-go and Pro customers can still access transaction construction, signing, and broadcast. If you'd like to leverage gas sponsorship, please reach out! ### Spend limits Turnkey gives you USD-denominated controls over gas sponsorship spend at two levels: * **Organization-wide limit** — the cap on total sponsored spend across your parent organization and all of its sub-organizations. * **Sub-organization limit** — the cap that applies to each of your sub-organizations You can set limit values and time intervals through the dashboard. You can also query current usage against the active limit via the [`get_gas_usage`](https://docs.turnkey.com/api-reference/queries/get-gas-usage) endpoint. Turnkey provides fee sponsorship and transaction broadcasting services only. In high-fee or congested network conditions, delays or non-inclusion may occur. It is the developer's responsibility to ensure appropriate spend limits are in place. ### Policy engine You can write policies against both sponsored and non-sponsored transactions using Turnkey's policy DSL: * **EVM**: use the `eth.tx` namespace * **Solana**: use the `solana.tx` namespace This means you can seamlessly switch between sponsored and non-sponsored transactions and still use the same policies. *Note:* Turnkey sets all fee-related fields to 0 for sponsored transactions. ### Billing Turnkey passes transaction fee costs through to you as a line item at the end of the month. You pay based on the USD value of fees at time of broadcast; Turnkey internalizes the inventory risk of token price changes. Our battle-tested fee estimation aims to be cost-efficient while ensuring quick transaction inclusion. ### Advanced #### Gas sponsorship smart contracts (EVM) We could not find a satisfactory setup for gas sponsorship contracts that were both fast and safe, so we made our own. The contracts are open source and you can check them out on [GitHub](https://github.com/tkhq/gas-station). Based on our benchmarks, these are the most efficient gas sponsorship contracts on the market. They achieve this through optimized logic, calldata encoding, and extensive use of assembly, which reduces gas overhead per sponsored transaction. The result: lower costs for you and faster execution for your users. #### Security Some gas sponsorship setups by other providers are subject to replay attacks. If a malicious actor compromises the provider infrastructure, they can replay the gas sponsorship request multiple times with different nonces to create multiple transactions from a single request. At Turnkey, we never cut corners on security: we perform transaction construction in enclaves, and as long as the request includes the relevant nonce or blockhash, only one transaction can be created from it. Since the user's authenticator signs requests and the enclave verifies signatures, a malicious actor cannot modify or replay the request. This is in line with Turnkey's core system design principle: everything can be compromised outside of the enclaves and funds will still be safe. By default, our SDKs include a special gas station nonce for sponsored transaction requests. ### RPCs Turnkey's send transaction and transaction status endpoints eliminate the need for third-party RPC providers. You save costs and reduce latency because we holistically incorporate internal data and minimize external calls. ## SDK Overview > The SDK primarily abstracts three endpoints: `eth_send_transaction`, `get_send_transaction_status`, and `get_gas_usage`. You can sign and broadcast transactions in two primary ways: 1. **Using the React handler (`handleSendTransaction`) from `@turnkey/react-wallet-kit`** This gives you: * modals * spinner + chain logo * success screen * explorer link * built-in polling 2. **Using low-level functions in `@turnkey/core`** You manually call: * `ethSendTransaction` OR `solSendTransaction` → submit * `pollTransactionStatus` → wait for inclusion 3. **Using server-side `@turnkey/sdk-server`** This is the right choice for Node.js backends. It exposes the same methods via the server SDK client. This page walks you through the `@turnkey/core` flow with full code examples. For using the React handler, see [Sending Sponsored Transactions (React)](/features/transaction-management/sending-sponsored-transactions). *** ## Using `@turnkey/core` directly For custom frameworks or full manual control (client-side). You will call: ### `ethSendTransaction(params)` → returns `{ sendTransactionStatusId }` ### `solSendTransaction(params)` → returns `{ sendTransactionStatusId }` ### `pollTransactionStatus(params)` → returns chain-specific status (`eth.txHash` or `sol.signature`) ### Step 1 — Create a client If you're on a Node.js backend, use `@turnkey/sdk-server` and initialize the server client like this: ```ts theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const client = new Turnkey({ apiBaseUrl: "https://api.turnkey.com/", apiPrivateKey: process.env.TURNKEY_API_PRIVATE_KEY, apiPublicKey: process.env.TURNKEY_API_PUBLIC_KEY, defaultOrganizationId: process.env.TURNKEY_ORGANIZATION_ID, }).apiClient(); ``` For `@turnkey/core`, create the client like this: ```ts theme={"system"} import { Turnkey } from "@turnkey/core"; const client = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", defaultOrganizationId: process.env.TURNKEY_ORG_ID, }); ``` *** ### Step 2 — Submit the transaction (Ethereum) ```ts theme={"system"} const sendTransactionStatusId = await client.ethSendTransaction({ transaction: { from: walletAccount.address, to: "0xRecipient", caip2: "eip155:8453", sponsor: true, value: "0", data: "0x", nonce: "0", }, }); ``` OR (Solana): ```ts theme={"system"} const sendTransactionStatusId = await client.solSendTransaction({ transaction: { signWith: walletAccount.address, // Solana address unsignedTransaction: "", caip2: "solana:EtWTRABZaYq6iMfeYKouRu166VU2xqa1", // devnet sponsor: true, // recentBlockhash: "", // optional }, }); ``` *** ### Step 3 — Wait for inclusion ```ts theme={"system"} const pollResult = await client?.pollTransactionStatus({ sendTransactionStatusId, }); if (!pollResult) { throw new TurnkeyError( "Polling returned no result", TurnkeyErrorCodes.SIGN_AND_SEND_TRANSACTION_ERROR, ); } const txHash = pollResult.eth?.txHash; // Ethereum const signature = pollResult.sol?.signature; // Solana const transactionId = txHash ?? signature; if (!transactionId) { throw new TurnkeyError( "Missing transaction id in transaction result", TurnkeyErrorCodes.SIGN_AND_SEND_TRANSACTION_ERROR, ); } console.log(transactionId); ``` *** * `ethSendTransaction` Implementation [here](https://github.com/tkhq/sdk/blob/e1dfe3e2eeb0976069aad1799597bbed64ec52f5/packages/core/src/__clients__/core.ts#L2711) * `solSendTransaction` Implementation [here](https://github.com/tkhq/sdk/blob/e1dfe3e2eeb0976069aad1799597bbed64ec52f5/packages/core/src/__clients__/core.ts#L2848) * `pollTransactionStatus` Implementation [here](https://github.com/tkhq/sdk/blob/e1dfe3e2eeb0976069aad1799597bbed64ec52f5/packages/core/src/__clients__/core.ts#L2936) *** ## Transaction status and enriched errors After you send a transaction, Turnkey monitors its status until it fails or is confirmed onchain. You can [query the transaction status](#querying-via-api) or subscribe to status updates [via webhooks](#webhooks). ### Transaction statuses The following statuses apply to both EVM and Solana transactions: | **Status** | **Description** | | ------------ | -------------------------------------------------------------------------------------------------------- | | INITIALIZED | Turnkey has constructed and signed the transaction and prepared fees, but it has not yet been broadcast. | | BROADCASTING | Turnkey is actively broadcasting the transaction to the network and awaiting inclusion. | | INCLUDED | The transaction has been included in a block (EVM) or confirmed onchain (Solana). | | FAILED | The transaction could not be included onchain and will not be retried automatically. | ### EVM smart contract transaction errors For EVM transactions that revert, Turnkey runs a simulation to produce structured execution traces and decode common revert reasons — giving you actionable error messages instead of opaque hex data. | **Error type** | **Description** | | :------------- | :----------------------------------------------------------------------------------------------------------------------------------------------------- | | UNKNOWN | The transaction reverted during onchain execution or simulation, but the revert reason could not be decoded (e.g. missing ABI or unverified contract). | | NATIVE | The transaction reverted due to a built-in Solidity error, such as `require()`, `assert()`, or a plain `revert()`. | | CUSTOM | The transaction reverted due to a contract-defined custom error declared using Solidity's `error` keyword. | These error types describe how an EVM smart contract reverted during onchain execution or pre-flight simulation. Turnkey application-level errors (e.g. signing failures, policy rejections) are not classified here and are instead surfaced via `Error.Message`. ### Querying via API Use the [Get Send Transaction Status](/api-reference/queries/get-send-transaction-status) endpoint to poll for the current status of any transaction by its `sendTransactionStatusId` (returned when you call `ethSendTransaction` or `solSendTransaction`). The response includes a `txStatus` field with the current status and, when applicable, an `error` object containing a human-readable `message` and either `eth.revertChain` (for EVM reverts) or `solana` (for Solana failures) with full structured details. ### Webhooks Turnkey Webhooks let you react to transaction status updates in real time, without polling. Instead of repeatedly calling the [Get Send Transaction Status](/api-reference/queries/get-send-transaction-status) API, you register an endpoint and Turnkey pushes updates to you — an HTTP POST fires when a transaction status changes (e.g. from `BROADCASTING` to `INCLUDED` or `FAILED`). You subscribe to webhooks at the parent organization level. Subscriptions cover transactions across the parent organization and all of its sub-organizations. #### Subscribing Use the [Create Webhook Endpoint](/api-reference/activities/create-webhook-endpoint) API with the `SEND_TRANSACTION_STATUS_UPDATES` event type to register your endpoint on the parent organization. #### Delivery payload Each delivery is an HTTP POST with a JSON body containing a `type`, `organizationId`, `parentOrganizationId`, and a `msg` object. The `type` is always `"transaction:status"`. Fields present in `msg` depend on the status: * **BROADCASTING**: base fields only — no `txHash`, no `error` * **INCLUDED**: base fields + `txHash`. If the transaction reverted onchain, `error` is also present. * **FAILED**: base fields + `error`. No `txHash` (the transaction never landed onchain). | **Field** | **Description** | | :---------------------------- | :------------------------------------------------------------------------------------------------------------ | | `type` | Always `"transaction:status"`. | | `organizationId` | The organization ID that initiated the transaction. | | `parentOrganizationId` | The parent organization ID. | | `msg.sendTransactionStatusId` | The ID of the send transaction status record. | | `msg.activityId` | The ID of the originating Turnkey activity. | | `msg.status` | One of `BROADCASTING`, `INCLUDED`, or `FAILED`. | | `msg.caip2` | The chain identifier where the transaction was sent. | | `msg.idempotencyKey` | A stable, unique key for this status event. Use this to safely deduplicate webhook deliveries. | | `msg.timestamp` | Unix timestamp (seconds) when the notification was generated. | | `msg.txHash` | *(INCLUDED only)* The onchain transaction hash or Solana signature. | | `msg.error` | Structured error object. Contains `message`, and either `eth.revertChain` (EVM) or `solana` (Solana) details. | **BROADCASTING** ```json theme={"system"} { "type": "transaction:status", "organizationId": "9e8d7c6b-aaaa-bbbb-cccc-ddddeeee0000", "parentOrganizationId": "9e8d7c6b-aaaa-bbbb-cccc-ddddeeee0000", "msg": { "sendTransactionStatusId": "f3a2b1c0-1234-5678-abcd-ef0123456789", "activityId": "a1b2c3d4-0000-1111-2222-333344445555", "status": "BROADCASTING", "caip2": "eip155:1", "idempotencyKey": "3f4a2b1c0d9e8f7a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d1e0f9a8b7c6d5e4f3", "timestamp": 1746000000 } } ``` **INCLUDED** ```json theme={"system"} { "type": "transaction:status", "organizationId": "9e8d7c6b-aaaa-bbbb-cccc-ddddeeee0000", "parentOrganizationId": "9e8d7c6b-aaaa-bbbb-cccc-ddddeeee0000", "msg": { "sendTransactionStatusId": "f3a2b1c0-1234-5678-abcd-ef0123456789", "activityId": "a1b2c3d4-0000-1111-2222-333344445555", "status": "INCLUDED", "caip2": "eip155:1", "idempotencyKey": "7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8", "timestamp": 1746000042, "txHash": "0xabc123def456abc123def456abc123def456abc123def456abc123def456abc1" } } ``` **FAILED** ```json theme={"system"} { "type": "transaction:status", "organizationId": "9e8d7c6b-aaaa-bbbb-cccc-ddddeeee0000", "parentOrganizationId": "9e8d7c6b-aaaa-bbbb-cccc-ddddeeee0000", "msg": { "sendTransactionStatusId": "f3a2b1c0-1234-5678-abcd-ef0123456789", "activityId": "a1b2c3d4-0000-1111-2222-333344445555", "status": "FAILED", "caip2": "eip155:1", "idempotencyKey": "1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2", "timestamp": 1746000015, "error": { "message": "Execution reverted on chain: insufficient balance for transfer", "eth": { "revertChain": [ { "address": "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48", "errorType": "native", "nativeType": "error_string", "displayMessage": "insufficient balance for transfer" } ] } } } } ``` See the [with-tx-webhooks](https://github.com/tkhq/sdk/tree/main/examples/transaction-management/with-tx-webhooks) SDK example for a working integration. *** ## Checking Gas Usage You can configure gas limits for both sub-orgs and all orgs. We recommend checking sub-org gas usage against the limit on the client side so your application can handle edge cases when approaching or exceeding the gas limit. You may also want to monitor your all org gas usage regularly to see if you are approaching your gas limit. ```ts theme={"system"} const resp = await httpClient?.getGasUsage({}) if (resp?.usageUsd! > resp?.windowLimitUsd!) { // you can also configure this to be a threshold console.error("Gas usage limit exceeded for sponsored transactions"); return } ``` # Fiat onramp Source: https://docs.turnkey.com/features/transaction-management/fiat-on-ramp Turnkey’s Fiat Onramp lets your end users convert traditional currency (USD, EUR, etc.) into crypto assets (ETH, USDC, BTC, etc.) directly within your application. ## Overview By embedding Turnkey’s SDK and leveraging our Fiat Onramp you get: * Seamless user flows: No need to redirect off-site, users stay within your UI. * Multiple payment rails: Credit/debit cards, bank transfers (ACH, SEPA), and more. * Provider flexibility: You can choose between onramp providers, MoonPay and Coinbase, or run parallel flows. * Compliance & KYC: Identity verification flows are built in from providers. ## Prerequisites 1. Choose the Onramp provider(s) you want to integrate with. See our current list of supported [Onramp Providers](#onramp-providers) below for coverage and pricing to best fit your needs. 2. Create an account with your chosen Onramp provider(s) and complete the required KYB process. * The typical KYB approval timeline will vary by Onramp provider. You can expect review to take 1-4 business days (or longer) depending on document availability and follow-up questions from the Onramp provider’s compliance team. * The requirements of the KYB process and the speed of review will vary by Onramp provider. Specific questions should be addressed to the Onramp provider directly. * The following is not an exhaustive list (and Onramp providers may ask for additional documentation), however the following documents may be requested as part of KYB compliance, depending on the Onramp provider you choose: * Corporate formation and governance documents (e.g. certificate of incorporation / articles of association; bylaws / operating agreement) * Proof of registration and status (e.g. business registration extract; certificate of good standing) * Ownership and control structure (e.g. register of shareholders / members; register of directors and officers; ultimate beneficial owner declaration) * Identification of directors, beneficial owners (often >10%), and sometimes senior management, including government-issued photo identification, proof of address (e.g. utility bill, bank statement, government letter \< 3 months old). Beneficial owners that are entities may need to provide similar documents, as well. 3. Once your KYB application has been approved, you will be provisioned API Keys. You can then securely upload your provisioned API Keys through turnkey's dashboard [here](https://app.turnkey.com/dashboard/walletKit) 4. You're now ready to start using Turnkey's Fiat Onramp. ### Onramp Providers **Coinbase** * [Create Account](https://portal.cdp.coinbase.com/) * [Payment Methods](https://docs.cdp.coinbase.com/onramp-&-offramp/developer-guidance/payment-methods) * [Supported Currencies](https://onramp-asset-availability.vercel.app/) * [Country Support](https://onramp-asset-availability.vercel.app/) * [Fees](https://docs.cdp.coinbase.com/onramp-&-offramp/developer-guidance/faq#what-fees-do-you-charge%3F) **MoonPay** * [Create Account](https://dashboard.moonpay.com/signup?referral=turnkey-FAEuJg) * [Payment Methods](https://support.moonpay.com/customers/docs/all-supported-payment-methods?lng=en#on-ramp) * [Supported Currencies](https://support.moonpay.com/customers/docs/moonpays-supported-currencies?lng=en#buying) * [Country Support](https://support.moonpay.com/customers/docs/moonpays-unsupported-countries?lng=en) * [Fees](https://support.moonpay.com/customers/docs/all-supported-payment-methods?lng=en#what-are-the-fees-with-moonpay) ## Demos ### Coinbase The Coinbase demo is running in a sandbox environment which means: * KYC information is mocked * Purchases are completed with test credit cards * Onramp transactions are simulated #### Using the Coinbase demo 1. Complete KYC * Phone number: `(555) 555-5555` * Email: `onramp@yourdomain.com` * Credit Card Information 1. Name on card: `Jane Doe` 2. Card number: `4242 4242 4242 4242` 3. Expiry date: `01/29` * Any future `MM/YY` date is valid 4. CVC: `123` * Any three digit number is valid * Billing address: enter any valid address 2. Verify your mobile number * Enter any 6 digit code * Coinbase does not send an OTP code in sandbox mode ### MoonPay * KYC information is mocked * 3D-Secure verification is simulated * Purchases are completed with test credit cards * Onramp transactions are executed on testnets * You can view your transactions on the testnet block explorer #### Using the MoonPay demo 1. Enter a valid email address to receive an OTP code 2. Enter the OTP code sent to your email address 3. Re-enter the prefilled form values to confirm order * Credit Card CVC: `123` * 3D-Secure 2 Authentication Password: `Checkout1!` ## Implementation Guide See the [Fiat Onramp Code Example](/features/transaction-management/fiat-on-ramp) for more details on how to implement. # Sending sponsored Solana transactions Source: https://docs.turnkey.com/features/transaction-management/sending-sponsored-solana-transactions Send sponsored Solana transactions using Turnkey's solSendTransaction API The SDK primarily abstracts three endpoints: `sol_send_transaction`, `get_send_transaction_status`, and `get_gas_usage`. You can sign and broadcast Solana transactions in two primary ways: * **Using the React handler (`handleSendTransaction`) from `@turnkey/react-wallet-kit`** This gives you: * modals * spinner + chain logo * success screen * explorer link * built-in polling * **Using low-level functions in `@turnkey/core`** You manually call: * `solSendTransaction` → submit * `pollTransactionStatus` → wait for confirmation * **Using server-side `@turnkey/sdk-server`** This is the right choice for Node.js backends. It exposes the same methods via the server SDK client. This page walks you through the React flow with full code examples. For using `@turnkey/core` directly, see [Sending Sponsored Transactions](/features/transaction-management/broadcasting). Before sponsoring Solana transactions, review [Solana Rent Sponsorship](/features/networks/solana-rent-refunds). Rent sponsorship is opt-in, disabled by default, and must be enabled in the dashboard first. This is especially important if you sponsor transactions from swap providers or other third-party builders that may create and close accounts. This example shows how to submit a sponsored Solana transaction, but your application is still responsible for validating transaction contents. If the transaction may create accounts that require rent, ensure `Sponsor Solana Rent` has been enabled in the dashboard first. Review whether the unsigned transaction creates accounts, closes accounts, or routes rent refunds back to the signer. See [Solana Rent Sponsorship](/features/networks/solana-rent-refunds) for rent setup and refund-path guidance, and [Solana transaction construction for sponsored flows](/features/networks/solana-transaction-construction) for payer-model and account-creation caveats. ## Using `handleSendTransaction` (React) This handler wraps everything: intent creation, signing, Turnkey submission, polling, modal UX, and final success UI. ### Step 1 — configure the provider ```tsx theme={"system"} import { TurnkeyProvider } from "@turnkey/react-wallet-kit"; const turnkeyConfig = { apiBaseUrl: "https://api.turnkey.com", defaultOrganizationId: process.env.NEXT_PUBLIC_TURNKEY_ORG_ID, rpId: window.location.hostname, iframeUrl: "https://auth.turnkey.com", }; export default function App({ children }) { return ( {children} ); } ``` ### Step 2 — use `handleSendTransaction` for Solana ```tsx theme={"system"} const { handleSendTransaction, wallets } = useTurnkey(); const walletAccount = wallets .flatMap((w) => w.accounts) .find((a) => a.addressFormat === "ADDRESS_FORMAT_SOLANA"); if (!walletAccount) { throw new Error("No Solana wallet account found"); } await handleSendTransaction({ transaction: { signWith: walletAccount.address, unsignedTransaction: "", caip2: "solana:mainnet", sponsor: true, }, }); ``` This automatically: * Opens the Turnkey modal * Shows the chain logo * Polls until `INCLUDED` * Displays success page + explorer link ## Checking gas usage You can configure gas limits for both sub-orgs and all orgs. We recommend checking sub-org gas usage against the limit on the client side so your application can handle edge cases when approaching or exceeding the gas limit. ```tsx theme={"system"} const resp = await httpClient?.getGasUsage({}); if (resp?.usageUsd! > resp?.windowLimitUsd!) { console.error("Gas usage limit exceeded for sponsored transactions"); return; } ``` For additional references leveraging these endpoints, check out our [Swapping Example](/solutions/cookbooks/jupiter). # Sending sponsored EVM transactions Source: https://docs.turnkey.com/features/transaction-management/sending-sponsored-transactions In this guide, we’ll walk through the process of setting up sponsored transactions, with abstractions for transaction construction, broadcast, and gas management, using React. ## SDK Overview > The SDK primarily abstracts three endpoints: `eth_send_transaction`, `get_send_transaction_status`, and `get_gas_usage`. You can sign and broadcast transactions in two primary ways: 1. **Using the React handler (`handleSendTransaction`) from `@turnkey/react-wallet-kit`** This gives you: * modals * spinner + chain logo * success screen * explorer link * built-in polling 2. **Using low-level functions in `@turnkey/core`** You manually call: * `ethSendTransaction` OR `solSendTransaction` → submit * `pollTransactionStatus` → wait for inclusion 3. **Using server-side `@turnkey/sdk-server`** This is the right choice for Node.js backends. It exposes the same methods via the server SDK client. This page walks you through the React flow with full code examples. For using `@turnkey/core` directly, see [Sending Sponsored Transactions](/features/transaction-management/broadcasting). ## Using `handleSendTransaction` (React) This handler wraps everything: intent creation, signing, Turnkey submission, polling, modal UX, and final success UI. ### Step 1 — Configure the Provider ```ts theme={"system"} import { TurnkeyProvider } from "@turnkey/react-wallet-kit"; const turnkeyConfig = { apiBaseUrl: "https://api.turnkey.com", defaultOrganizationId: process.env.NEXT_PUBLIC_TURNKEY_ORG_ID, rpId: window.location.hostname, iframeUrl: "https://auth.turnkey.com", }; export default function App({ children }) { return ( {children} ); } ``` *** ### Step 2 — Use `handleSendTransaction` inside your UI ```ts theme={"system"} const { handleSendTransaction, wallets } = useTurnkey(); const walletAccount = wallets[0].accounts[0]; await handleSendTransaction({ transaction: { from: walletAccount.address, to: "0xRecipient", value: "1000000000000000", data: "0x", caip2: "eip155:8453", sponsor: true, }, }); ``` OR (Solana): ```ts theme={"system"} const { handleSendTransaction, wallets } = useTurnkey(); const walletAccount = wallets .flatMap((w) => w.accounts) .find((a) => a.addressFormat === "ADDRESS_FORMAT_SOLANA"); if (!walletAccount) { throw new Error("No Solana wallet account found"); } await handleSendTransaction({ transaction: { signWith: walletAccount.address, // Solana address unsignedTransaction: "", caip2: "solana:EtWTRABZaYq6iMfeYKouRu166VU2xqa1", // devnet sponsor: true, // recentBlockhash: "", // optional }, }); ``` * Full React handler implementation [here](https://github.com/tkhq/sdk/blob/e5a153efa90c325d4f5ecfe65d8d2bff8573c64f/packages/react-wallet-kit/src/providers/client/Provider.tsx#L5536) This automatically: * opens Turnkey modal * shows chain logo * polls until INCLUDED * displays success page + explorer link ## Checking Gas Usage You can configure gas limits for both sub-orgs and all orgs. We recommend checking sub-org gas usage against the limit on the client side so your application can handle edge cases when approaching or exceeding the gas limit. You may also want to monitor your all org gas usage regularly to see if you are approaching your gas limit. ```ts theme={"system"} const resp = await httpClient?.getGasUsage({}) if (resp?.usageUsd! > resp?.windowLimitUsd!) { // you can also configure this to be a threshold console.error("Gas usage limit exceeded for sponsored transactions"); return } ``` For additional references leveraging these endpoints, check out our [Swapping Example](https://github.com/tkhq/sdk/tree/main/examples/defi/eth-usdc-swap) and [Sweeping Example](https://github.com/tkhq/sdk/tree/main/examples/transaction-management/sweeper) ## EVM paymaster example You may also leverage our own example for setting up EVM paymaster leveraging the above endpoints. This example shows how to send an erc-20 token on EVM networks using Turnkey's paymaster (gas sponsorship). Please refer to [with-paymaster](https://github.com/tkhq/sdk/tree/main/examples/transaction-management/with-paymaster) to see how to setup and manage paymaster for your transaction operations. # Best practices Source: https://docs.turnkey.com/features/users/best-practices This page describes some best practices to consider as you set up users and policies while getting ready for production. ## Managing users **Enforce a security policy of least privilege for your users** Users on Turnkey should have the minimum required privilege to accomplish their job. When setting up users, consider this for their access type and policies that will grant the user permissions. **Use user tags to create groups of users with equal permissions** Referencing user tags in policies instead of individual users allows for clearer management of permissions. **When creating new users, consider verifying onboarding before adding tags** When inviting a web user to your Turnkey organization, you should consider real-life verification to confirm that they have onboarded correctly before granting that user permissions via tags. Granting tags prior to verification could provide an attacker permissions in your Turnkey organization if they are able to access the signup link. **Regularly review and remove unused users, user tags, and policies** If a user is unused or the user has left your company, you should remove them from your Turnkey organization to avoid compromise. **Attach multiple authenticators to web users** This ensures you don't lose access to the user. If an authenticator is lost or stolen, log in immediately to remove that authenticator from the user, or notify someone in your organization with permissions to delete the user. It's best to use multiple types of authenticators to ensure the security of your account if one fails. ## Protecting API keys API keys allow programmatic access to Turnkey, and thus anyone with access to your API key has the same level of access to your Turnkey organization as you do. Consider the following to better protect your API keys and Turnkey organization. **Don't embed API keys directly in your code** This reduces the ways that a hacker could acquire your API key. Our SDKs and CLI enable you to reference your API keys so you don't have to put them directly in your code. **Use different API-only users for different applications** This allows you to isolate permissions and differentiate activities between those applications. In the case that an API key is lost or stolen, it also allows you to revoke access solely for the affected application. **Use a secret management system to protect your API keys** Tools like Hashicorp Vault or AWS KMS can help you protect your API key from malicious access. **Regularly remove any unused API keys** This reduces the chance that an old key can be used to access your Turnkey organization. ## Setting up policies **Apply least-privilege permissions** Turnkey's policy engine allows you to enforce permissions at a fine-grained level. When setting up your account, we suggest you use the principle of least privilege, meaning that a user only has the minimum permissions that are necessary to perform their job. Create policies that ensure that users have least-privilege permissions. **Apply consensus to sensitive actions** Sensitive actions like changing policies or signing transactions should be carefully controlled as they can lead to funds being moved off of the platform. You can apply consensus to actions like this to ensure that multiple approvals are required. For example, the policy below specifies that 2 total approvals, including the initiating approval, are required to create a new policy. ```json theme={"system"} { "policyName": "Require 2 approvers for creating a policy", "effect": "EFFECT_ALLOW", "consensus": "approvers.count() >= 2", "condition": "activity.type == 'ACTIVITY_TYPE_CREATE_POLICY_V3'" } ``` **Be especially careful with the ability to add policies** Within this principle of least privilege, Some actions should be treated more sensitively: * Adding policies * Signing transactions **Use allowlisting if you only send to a set of addresses** If your use case for Turnkey only requires you to send funds to a certain set of crypto addresses, you should set a policy that allowlists those addresses. See below for an example policy. ```json theme={"system"} { "policyName": "ETH address whitelist", "effect": "EFFECT_ALLOW", "condition": "eth.tx.to == ''" } ``` # Credentials Source: https://docs.turnkey.com/features/users/credentials Credentials are how users authenticate to Turnkey. Turnkey only stores public keys; private keys never leave your device. ## Types **Authenticators** — WebAuthn devices registered on Turnkey: passkeys, biometrics, and hardware keys. Used to sign requests directly, using the [WebAuthn standard](https://www.w3.org/TR/webauthn-2/) (no passwords). **API keys** — Cryptographic key pairs used to sign API requests. Turnkey supports P-256, SECP256K1, and Ed25519 curves. Come in two forms: * *Long-lived* — created via the dashboard, CLI, or [API](/api-reference/activities/create-api-keys). You generate the key pair; Turnkey stores the public key. * *Expiring* — issued automatically when a user authenticates via email, SMS, OAuth, or wallet auth. Short-lived by default (15 minutes), with a configurable expiration window. ## Credential types Each issuance path produces a credential of a specific type, which Turnkey returns in API responses. You can retrieve the type and public key for any API key via [GetAPIKey](/api-reference/queries/get-api-key). | Credential type | Issued by | | --------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- | | `CREDENTIAL_TYPE_WEBAUTHN_AUTHENTICATOR` | [Passkeys](/features/authentication/passkeys/introduction) | | `CREDENTIAL_TYPE_API_KEY_P256` | [Manually created API keys](/api-reference/activities/create-api-keys) | | `CREDENTIAL_TYPE_OTP_AUTH_KEY_P256` | [Email OTP](/features/authentication/email) or [SMS](/features/authentication/sms) auth | | `CREDENTIAL_TYPE_EMAIL_AUTH_KEY_P256` | [Email auth — credential bundle method](/features/authentication/email) (legacy) | | `CREDENTIAL_TYPE_RECOVER_USER_KEY_P256` | [Email recovery](/features/authentication/email) (legacy) | | `CREDENTIAL_TYPE_OAUTH_KEY_P256` | [Social logins](/features/authentication/social-logins) | | `CREDENTIAL_TYPE_API_KEY_SECP256K1` | [Wallet auth — Ethereum/SECP256K1](/solutions/embedded-wallets/integration-guide/react/using-external-wallets/overview) | | `CREDENTIAL_TYPE_API_KEY_ED25519` | [Wallet auth — Solana/ED25519](/solutions/embedded-wallets/integration-guide/react/using-external-wallets/overview) | | `CREDENTIAL_TYPE_READ_WRITE_SESSION_KEY_P256` | [Read-write sessions](/api-reference/activities/create-read-write-session) | | `CREDENTIAL_TYPE_LOGIN` | [IndexedDB auth](/sdks/advanced/indexed-db-stamper) — OTP, passkey, or OAuth | # Users Source: https://docs.turnkey.com/features/users/introduction Turnkey users are resources within organizations or sub-organizations that can submit activities to Turnkey via a valid credential (e.g., API key, passkey). These requests can be made either by making direct API calls or through the Turnkey Dashboard. Users must have at least one valid credential (one of API key, passkey), with upper limits on credentials defined here in our [resource limits](/reference/resource-limits). Users can also have associated “tags” which are logical groupings that can be referenced in policies. Users can only submit activities within their given organization — they cannot take action across organizations. A User's attributes are: * UUID: a globally unique ID (e.g. `fc6372d1-723d-4f7e-8554-dc3a212e4aec`), used as a unique identifier for a User in the context of Policies or User Tags, or Quorums. * Name and email * Authenticators: a list of authenticators (see below for information) * API key: a list of API keys (see below for information) * User tags: a list of User Tag UUIDs A **user belongs to one organization**, and one organization can have many (**up to 100**) users. If you need to create more users, consider using Sub-Organizations. # Root quorum Source: https://docs.turnkey.com/features/users/root-quorum When you create a Turnkey organization, your user is created and will default to being the sole member of the root quorum. Because of the wide scope of permissions, it is important to take care when using any users in the root quorum. The following offers a technical overview and some best practices. ## Technical overview The root quorum is a group of users who can execute any action and bypass the policy engine. The root quorum is defined by * `userIds`: the Ids of users who compose the quorum set * `threshold`: the number of quorum members required to execute an action as root Actions approved by the root quorum do not go through the policy engine; thus it is impossible to limit root quorum actions with any policies. The reason the root must be able to bypass the policy engine is that it is the only way for an organization to unbrick itself if it sets overly restrictive policies that do not allow it to update itself. We can refer to a root quorum configuration as `threshold / userIds.length`. So a quorum with a threshold of 2 and set size of 5 can be referred to as `2 / 5`. ### Defaults When you create an organization, the root quorum will default to being your user and a threshold of 1. ### Updating the root quorum Only the current root quorum can approve updates to the quorum. It is not possible to add editing permissions to the root quorum through policies. Both the website and public APIs expose the ability to update the root quorum. ## Best practices ### Limit tasks you perform with the root quorum The root quorum should only be used in cases where it is absolutely necessary. In particular, the root quorum should primarily be used to unblock an organization in the event of incorrect policies or lockout. For example, if you accidentally set overly-restrictive policies that prevent users from taking any action, the root quorum can be used to delete the relevant policies. ### Create scoped users for day-to-day actions Ensure that you have scoped policies for day-to-day actions that you expect to complete. For example, you may have an API user with permissions to only create sub-organizations. You can read more about creating policies in our [Policy Overview](/features/policies/overview). ### Using root users with policies We generally recommend creating non-root users for day-to-day operations and granting them narrowly scoped permissions via policies. However, root users can also be granted the ability to act without quorum approval for specific actions. By defining an explicit policy, you can allow an individual root user to perform certain activities without requiring approvals from the other root users, even if the organization’s root quorum threshold would normally require it. In other words, even if your organization enforces a root quorum with a threshold greater than 1 (for example, 2 / 3), a policy can allow a specific root user to independently perform the activity covered by that policy, while all other activities continue to require quorum approval. ### Configuration considerations There are primarily two factors to consider when setting the root quorum * how hard is it to get locked out of root? I.E. how many authenticators need to be lost/destroyed so the threshold cannot be met. * how many authenticators need to be compromised for an attacker to take root actions? For example, if a quorum is configured as 2/5, then * if 4 users lost all their authenticators, no root actions could be taken (including updating the quorum itself). * if 2 different users authenticators are compromised, an attacker could steal all the organizations funds. **Example Setups** The below examples are provided as a convenience only. It is up to you to ensure that the root quorum setup you design is appropriate for your particular circumstances in order to secure your organization and minimize the risk of lockout of root functionality. Failure to properly configure your root quorum setup could result in complete loss of funds. *High Value Organization* Special users should be created that are only used for root actions. Those users' authenticators should be stored in geographically distributed locations that have personal access controls, are natural disaster resistant, and have redundancy in case of hardware failure. These would only be used in the case of a disaster. For day to day admin operations, admin policies that use consensus can be put in place. These can be a set of finely scoped policies. *Low Value, End-User Directed Organization* The end-user and the business both have one user in the organization. The root quorum would be configured as a 1/2, which includes the business and end-users' Users. This allows the business support channel to unbrick the user if they lose access to their account or otherwise add overly restrictive policies. ### Monitor for unintended use Monitor your account for any unexpected activities coming from the root users. If you see an unexpected activity, you should remove any compromised authenticators or API keys. # Managing TVC apps and deployments Source: https://docs.turnkey.com/features/verifiable-cloud/managing-apps-and-deployments Direct traffic, delete, and restore TVC apps and deployments. Turnkey Verifiable Cloud is currently in Private Beta. [Join the waitlist](https://www.turnkey.com/turnkey-verifiable-cloud#waitlist) to request access. This guide covers how to direct traffic to a specific deployment, delete a deployment or app, and restore a deleted deployment. For creating and approving your first deployment, see the [TVC quickstart](/features/verifiable-cloud/quickstart). ## Direct traffic to a deployment Each TVC app has one live deployment at a time. To switch traffic to a different deployment, use the dashboard or the CLI. **Dashboard**: Click into your deployment on the [TVC dashboard](https://app.turnkey.com/dashboard/v2/tvc) and click **Direct Traffic**, then confirm with **Make live**. Direct Traffic button on deployment page **CLI**: ``` tvc app set-live-deploy --deploy-id ``` On success: ``` Set-live-deploy accepted. Deployment ID: Activity ID: Activity Status: Active ``` ## Delete a deployment Deleting a deployment tears down its deployed resources so that the enclave instances are stopped and cleaned up. The deployment record remains visible in the dashboard. **Dashboard**: Click into your app, find the deployment, and click **Delete deployment**. Delete button on deployment page **CLI**: ``` tvc deploy delete --deploy-id ``` On success: ``` Deployment delete accepted; deployment is marked for deletion. Deployment ID: Activity ID: Activity Status: Active ``` ## Delete an app Deleting an app tears down all of its child deployments. As with deployment deletion, the resources are cleaned up but the records remain visible. **Dashboard**: Click into your app on the [TVC dashboard](https://app.turnkey.com/dashboard/v2/tvc) and click **Delete app**. **CLI**: ``` tvc app delete --app-id ``` On success: ``` App delete accepted. App and deployments marked for deletion. App ID: Activity ID: Activity Status: Active ``` ## Restore a deployment A deployment marked for deletion can be restored before its resources are fully cleaned up. **Dashboard**: Click into your app, find the deployment, and click **Restore deployment**. Restore button on deployment page **CLI**: ``` tvc deploy restore --deploy-id ``` On success: ``` Deployment restore accepted; deployment is no longer marked for deletion. Deployment ID: Activity ID: Activity Status: Completed ``` # Building your first app Source: https://docs.turnkey.com/features/verifiable-cloud/onboarding ## TVC template To help with bootstrapping we have put together a template repository, available at [`tkhq/tvc-template`](https://github.com/tkhq/tvc-template). This repository uses [StageX](https://stagex.tools/) as a build system, has CI workflow to build and test the application, and is a great base to build your own app. This template uses Rust but the concepts carry over to other languages: the application is a simple webserver listening on configurable port and host. ## Supported languages Turnkey writes all enclave applications in Rust, but TVC isn't opinionated about languages: as long as your toolchain can statically compile to a binary (ELF), QuorumOS can run it. If you are planning to use dynamic linking or interpreted languages, [get in touch](https://www.turnkey.com/turnkey-verifiable-cloud#waitlist) ahead of time and we can look at your toolchain's compatibility. ## Recommended first steps Start with our minimal template and deploy it within your TVC-enabled organization. To do this, follow our [TVC quickstart guide](/features/verifiable-cloud/quickstart). Verify it comes up healthy, and confirm one or more endpoints respond correctly. Once the baseline is confirmed, layer your application logic incrementally. ## Known platform limitations | Limitation | Workaround | | :---------------------------------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Deployment deletion not implemented | Ask our team on Slack, or simply kick-off another deploy. There can only be one live deployment at a time. Kicking off a new deployment automatically deletes any existing one | | No metrics or logs in dashboard | Ask our team on Slack | | No egress connectivity | Pass signed data as input to your API instead of fetching it from within the TEE | | Custom provisioning not self-serve | Ask our team on Slack, or use static provisioning | ## Getting help Slack is the primary channel for async questions, debugging, and quick turnaround on deployment issues. Don't hesitate to use it – especially early on. What to ask for: * Code snippet for reading the quorum key and signing within the TEE * Help interpreting deployment config fields * Assistance debugging a deployment that isn't coming up as expected * Observability you'd want surfaced in the dashboard **Feedback welcome**: You are among the first developers building a brand-new app on this platform, end-to-end. Your experience with gaps, sharp edges, and missing features is genuinely valuable – please share it! ## Getting access to TVC TVC is currently in private Beta. A select group of design partners are already building on it and getting exclusive access to the latest features and capabilities. If you're interested in being an early design partner, or if you want to be notified when TVC is generally available for all, please [join the waitlist](https://www.turnkey.com/turnkey-verifiable-cloud#waitlist). # Overview Source: https://docs.turnkey.com/features/verifiable-cloud/overview ## What is Turnkey Verifiable Cloud (“TVC”)? Turnkey Verifiable Cloud is a new offering to externalize the [Foundations](https://whitepaper.turnkey.com/foundations) of our TEE-based key management system. With TVC, you can run any code in isolated, verifiable secure enclaves powered by Turnkey’s trusted infrastructure. Turnkey started as a key management system with a drastic [threat model](https://whitepaper.turnkey.com/architecture#threat-model), and we placed a bet on TEEs early on. More specifically, Turnkey uses [AWS Nitro Enclaves](https://aws.amazon.com/ec2/nitro/nitro-enclaves/) to deploy all sensitive workloads, and we plan to support other major cloud providers in the future. To establish the foundations for our key management system, we went deep on build systems, deployment tooling, verification tooling, provisioning, performance, and scaling. This work, developed over 3+ years, is broadly applicable. Any team building at scale within Trusted Execution Environments will encounter the same challenges. TVC solves these problems transparently for the industry at large, within and outside of web3. A few of the hard problems solved by TVC: * **Reproducible builds**: These are crucial to leverage remote attestations (see [this blog post](https://quorum.tkhq.xyz/posts/remote-attestations-useless-without-reproducible-builds/)). To support this, we bootstrapped [StageX](https://stagex.tools), an open-source distro focused on reproducibility. TVC works with StageX so reproducibility is handled for you. Learn more about it [here](https://quorum.tkhq.xyz/posts/reproducible-builds-made-easy-introducing-stagex/). * **Packaging**: Packaging applications into EIF files is [easy on the surface](https://docs.aws.amazon.com/enclaves/latest/user/building-eif.html) but leaves application developers with load-bearing security decisions: which base OS do I use? How do I handle application upgrades? How do I persist state? Turnkey built [QuorumOS](https://github.com/tkhq/qos) to solve these problems in the context of our own key management platform. TVC is integrated with QOS to handle these problems for you. In TVC, you provide the binary application you'd like to run, and we take care of the rest. * **Running at production scale**: Turnkey has invested years of engineering time to get this right. We are running enclaves with autoscaling to ensure your application can transparently scale up and down with traffic. We have automated provisioning and invented [key forwarding](https://github.com/tkhq/qos/blob/main/docs/key_forward.md) to ensure enclaves going down are automatically replaced and provisioned from already-running enclaves, Operators do not have to wake up in the middle of the night. * **Verification tooling**: Turnkey is regularly audited by top security firms to guarantee verification procedures and the code implementing them remains secure and correct over time. TVC is the first TEE platform to offer autoscaling and strong security defaults. Your secure workloads run at scale, on the same infrastructure as Turnkey's own secure workloads. ## Use cases Many different types of workloads can benefit from verifiability. Below is a list of use cases supported by TVC. | Workload type | Advantages to verifiability | | :----------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Chain Abstraction | Trustworthy cosigners for cross-chain resource locks (e.g. [OneBalance](https://www.onebalance.io)) | | Transaction Construction | Users know that the unsigned transaction bytes are legitimate. | | Transaction Parsing | Provide accurate metadata about the effects of a transaction. This is critical for trusted wallet UX. See [VisualSign Parser](https://github.com/anchorageoss/visualsign-parser/). | | Oracles | Leverage external data without the overhead of full decentralization, onchain or offchain. Replace economic incentives with verifiability. | | Blockchain nodes | Allow for private balance lookups, verifiable mempool inclusion, and more. | | Web2 data bridging | Import and use data from web2 providers (centralized exchange balances, credit scores, X follower counts) in decentralized computation | | AI training & inference | Verifiable training to prove no hidden backdoors; guarantee user prompts remain private | | Sequencers | Prove correct behavior and eliminate the need for challenge periods and economic incentives around them (e.g. [Base sequencer](https://github.com/base/base/tree/main/crates/proof/tee)) | | Identity verification | Prove no identity is leaked as part of the verification process. | | VPN nodes | Guarantees privacy by proving that forwarded traffic isn't logged anywhere. | | Exchanges | Ensure no malicious behavior (frontrunning), and create verifiable order books. | | PII processing | Prove that processing does not leak or misuse PII (Personally Identifiable Information). | These are just a subset of possible use cases. Any computation where two parties need to agree on what was executed can benefit from or require verifiability. ## Architecture We’ve engineered TVC to fit within the existing Turnkey products and APIs. You will interact with TVC via our [dashboard](https://app.turnkey.com/), via the [TVC CLI](https://github.com/tkhq/rust-sdk/tree/main/tvc), or programmatically via [APIs](/api-reference/overview/intro). TVC provides a secure harness ([QuorumOS](https://github.com/tkhq/qos)) to verifiably run a **single program**. This program is also called "binary", "executable" or sometimes "pivot", and contains the secure workload to execute in TEEs. TVC relies on [OCI container images](https://github.com/opencontainers/image-spec) to transport this executable program from where it's built (typically, Github Action, or other CI platforms) to within TVC. This has several advantages: * OCI containers can be hosted on many container image registries. These registries ensure integrity of the images, and clients can "pin" an image to ensure that they download the image they expect. Typically a container image URL will look like `registry.com/org/repo:some-tag@sha256:digest`. * Registries also support authentication, which means TVC supports private image registries. Our infrastructure is Kubernetes-based: we support [Pull Secrets](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/) generically to allow for maximum flexibility: [Docker Hub](https://hub.docker.com/), [ECR](https://aws.amazon.com/ecr/), [GHCR](https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry), [ACR](https://azure.microsoft.com/en-us/products/container-registry), [GAR](https://docs.cloud.google.com/artifact-registry/docs) are all supported. Once the container image details and other configuration (ports, protocol, program path, arguments, etc) are received, a QOS manifest is generated. The QOS manifest has to be cryptographically approved by operator(s) before TVC infrastructure can proceed with the deployment. TVC Deployment Overview Read more about Applications, Deployments, Manifests, and Operators in the following sections. ## Applications TVC is programmable infrastructure, enabling you to create and manage verifiable apps. Each TVC App is deployed on Turnkey infrastructure in the exact same way as Turnkey's own [core enclave apps](https://github.com/tkhq/core-enclaves). * TVC Applications are deployed within Kubernetes clusters operated by Turnkey, using [QuorumOS](https://github.com/tkhq/qos) ("QOS") as a base OS. * Key provisioning, high-availability deployments (minimum of 3 replicas), and in-depth verification workflows are supported by default. * Because TVC relies on Turnkey for its own operations, it's possible to use Consensus in the context of TVC activities (with [Turnkey Policies](/features/policies/overview) or [Root Quorum](/features/users/root-quorum)) A TVC Application has a stable [Quorum Key](https://github.com/tkhq/qos#quorum-key) and set of approvers. ## Deployments Each TVC application can be deployed many times. For every TVC deployment, you will specify: * An OCI image URL (e.g. `ghcr.io/myorg/myrepo:tag@sha256:…`). This container is pulled by our Kubernetes infrastructure. If the container is private, TVC supports uploading encrypted [pull secrets](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/). * An executable path + args: within the container, you must indicate where the desired binary lives such that Turnkey’s infrastructure can extract this binary from its OCI container, and run it within a TEE on your behalf. * The port on which external requests should be forwarded. This is typically port 3000. For convenience TVC lets you specify different ports for user requests and health requests made by Turnkey infrastructure. * Your expected executable digest: this is a security measure, to ensure the binary pulled by Turnkey's infrastructure is the binary you expect. Once the deployment is submitted and approved, our infrastructure deploys and makes it available on a dedicated subdomain. | Resource | Default Allocation | | :--------- | :--------------------------------- | | vCPUs | 2 | | RAM | 1 GiB | | Filesystem | RAM-based (no persistence) | | Replicas | 3 | | Ingress | Load-balanced across all replicas | | Sub-domain | Automated (`.turnkey.cloud`) | ## Manifests Each TVC deployment is ultimately specified with a QOS manifest. The information you provide to TVC APIs (expected digest, executable arguments, and so on) is used to create a new QOS Manifest document. See [`Manifest`](https://github.com/tkhq/qos/blob/d69bcd348073ed7322c0d0423a35b7ab56831de8/src/qos_core/src/protocol/services/boot.rs#L414) for a full definition of the fields within it. This manifest document is the source of truth used by QOS to boot your application. It is also the document which must be cryptographically signed for each deployment. QOS Manifests are returned along with the AWS attestation document, within [Boot Proofs](https://whitepaper.turnkey.com/foundations#boot-proofs-and-app-proofs). More on this in the next section. ## Operators Operators are humans or systems. In TVC, an operator is represented by an alias and a public key. Operator keys can be created and managed externally via our TVC CLI, or managed via Turnkey's own key management APIs. QuorumOS uses operators to cryptographically control deployments: operators must approve QOS manifests and take part in deployments where Quorum Keys must be injected. ## Keys, signatures, and verification Your TVC app has access to two keys when it boots: * **Ephemeral Key**: a key which is created at boot. This key **never leaves the enclave** and is different for every enclave. A signature by this key is a signature bound to a particular enclave, hence bound to a particular **code version** of your TVC application. * **Quorum Key**: a key which is injected at boot and is the same across all enclaves. This key can be used to encrypt state which needs to survive application upgrades. Internally at Turnkey we use this key to sign or encrypt long-lived data. Both of these keys follow the [QOS Key Set](https://github.com/tkhq/qos/blob/main/src/qos_p256/SPEC.md) specification. Ephemeral Keys and Quorum Keys can be used to sign data, or to encrypt/decrypt data. App Proofs are signed statements by enclave Ephemeral Keys; Boot Proofs are bundles composed of an AWS attestation document and a QOS manifest. Together, App Proofs and Boot Proofs can be used to verify workloads end-to-end. See [our documentation](https://docs.turnkey.com/security/turnkey-verified#turnkey-verified) for more on this subject. We’ve already released tooling for proof verification in [Rust](https://crates.io/crates/turnkey_proofs), [JS](https://github.com/tkhq/sdk/blob/main/packages/crypto/src/proof.ts), and [Golang](https://github.com/tkhq/go-sdk/tree/main/pkg/proofs). ## Pricing TVC pricing has two components: * A fixed per-month platform fee. * Variable pricing based on wall-clock enclave uptime [Get in touch with us](https://www.turnkey.com/turnkey-verifiable-cloud#waitlist) for more details. ## Getting access to TVC TVC is currently in private Beta. A select group of design partners are already building on it and getting exclusive access to the latest features and capabilities. If you're interested in being an early design partner, or if you want to be notified when TVC is generally available for all, please [join the waitlist](https://www.turnkey.com/turnkey-verifiable-cloud#waitlist). # Proofs and Verification Source: https://docs.turnkey.com/features/verifiable-cloud/proofs-and-verification Turnkey Verifiable Cloud (TVC) uses two related proofs to let a verifier answer a concrete question: did this application-level result come from the expected code running in an attested enclave? * A **Boot Proof** is produced by the TVC platform. It answers: what enclave booted, and what code and configuration was it approved to run? * An **App Proof** is produced by application logic. It answers: what application-level output did that enclave sign? The trust chain starts with AWS. The AWS Nitro Secure Module (NSM) signs an attestation document with a certificate chain rooted in the [AWS root certificate](https://docs.aws.amazon.com/enclaves/latest/user/verify-root.html); that document binds an enclave's **Ephemeral Key** to PCR measurements and Turnkey's [QOS](https://github.com/tkhq/qos) manifest digest. The QOS manifest then identifies the application binary and deployment configuration. Finally, an App Proof signature links an application-level payload back to the same Ephemeral Key. This page is written for TVC builders who want to design and verify their own App Proofs. It also uses Turnkey's own App Proofs as examples throughout. For the customer-facing dashboard and Embedded Wallet Kit feature built on Turnkey's proofs, see [Turnkey Verified](https://docs.turnkey.com/security/turnkey-verified). ## Boot Proof A Boot Proof is a bundle of artifacts that a verifier can use to establish what code an enclave is running. It contains: * The **[AWS Nitro attestation document](https://docs.aws.amazon.com/enclaves/latest/user/verify-root.html#the-attestation-document)** (DER-encoded COSE Sign1), which contains PCR measurements, the AWS certificate chain, the enclave's Ephemeral public key (in the `public_key` field), and arbitrary `user_data`. * The **QOS manifest** and **manifest envelope**, which describe the application binary and arguments, the operator quorum, the quorum public key, and other deployment configuration. The AWS attestation document's `user_data` is set by QOS to the digest of this manifest, which is what binds the two together. * Operator **approvals** of the manifest. AWS PKI is the root of the cryptographic trust chain. A verifier checks that the attestation document and its certificate chain validate back to the AWS root certificate, then checks the Turnkey-specific fields and manifest binding. AWS documents the attestation document validation step in its [root of trust verification](https://docs.aws.amazon.com/enclaves/latest/user/verify-root.html) documentation. Boot Proofs are operating system level artifacts from enclave boot. Turnkey records the Boot Proof for every enclave that boots, both internally and for TVC, and makes the relevant proofs available through Turnkey's public API. See [Fetching proofs as a verifier](#fetching-proofs-as-a-verifier). ## App Proof App Proofs are generated by enclave application logic. What makes an App Proof an App Proof is that application-level output is signed with an enclave's Ephemeral Key, so that output can be linked back to the Boot Proof Turnkey stores. As a TVC builder, you decide what your App Proof payload needs to prove. For example, your application might sign a model inference result, a private computation outcome, or a protocol-specific state transition. The important design requirement is that the payload commits to the facts a verifier will care about, and that the signature uses the enclave Ephemeral Key so the verifier can connect the payload to a valid Boot Proof. Turnkey's own products use a standardized App Proof envelope. You can use this structure as a reference design, but custom TVC applications can structure their payloads differently. A Turnkey App Proof contains: * A **proof payload** (JSON), which has a typed schema per proof type. Examples today include `APP_PROOF_TYPE_ADDRESS_DERIVATION` (a wallet address was derived from a specific path on a specific wallet) and `APP_PROOF_TYPE_POLICY_OUTCOME` (a policy decision evaluated to a specific outcome against specific organization data). * A **signature** over the SHA-256 digest of the JSON payload bytes, produced by the enclave's Ephemeral Key (P-256). * The **Ephemeral public key** that produced the signature. * The **signature scheme** identifier (currently `SIGNATURE_SCHEME_EPHEMERAL_KEY_P256`). The Ephemeral private key never leaves the enclave by design; only the public half is exposed through the attestation document's `public_key` field and the App Proof's `publicKey` field. The App Proof embeds the Ephemeral public key it was signed with. The Boot Proof's attestation document also pins that same Ephemeral public key (in `public_key`). A verifier links the two by matching the App Proof's public key to a valid Boot Proof's attested key; see [Verification flow](#verification-flow) below. For example, Turnkey's address derivation App Proof signs a payload committing to a specific organization, wallet, derivation path, and derived address: ```json theme={"system"} { "scheme": "SIGNATURE_SCHEME_EPHEMERAL_KEY_P256", "publicKey": "ephemeral-public-key-from-the-enclave", "proofPayload": "{\"type\":\"APP_PROOF_TYPE_ADDRESS_DERIVATION\",\"timestampMs\":\"1758909116\",\"addressDerivationProof\":{\"organizationId\":\"your-organization-id\",\"walletId\":\"your-wallet-id\",\"derivationPath\":\"m/44'/60'/0'/0/0\",\"address\":\"0x61f4Ec0630DD50F1393cbDB60e5ccA1ed98f5100\"}}", "signature": "p256-sha256-signature-over-proofPayload" } ``` On its own, this payload does not prove that a particular enclave signed it; but when a verifier can match `publicKey` to a valid Boot Proof, the claim is tied back to an enclave instance and the code identified by its manifest. Your own TVC App Proofs follow the same chain even if the payload schema is specific to your application. ## Why the Ephemeral Key and not the Quorum Key QuorumOS enclaves already have a Quorum Key, which is the long-lived key associated with the application's identity. Why don't Turnkey App Proofs use that? The answer is a trust boundary distinction. The quorum key is designed to live across many different versions of an enclave app and can not be provably exclusive to a specific enclave instance, app binary, or configuration. The Quorum Key is provisioned via the [QuorumOS quorum provisioning protocol](https://github.com/tkhq/qos/blob/main/docs/boot_standard.md): share holders verify a node's attestation document, encrypt quorum key shares to the node's Ephemeral Key, and the node reconstructs the Quorum Key once the configured threshold is met. Because the Quorum Key can be provisioned into any enclave that satisfies the provisioning protocol, a Quorum Key signature cannot cryptographically prove the app proof payload came from the *inside* of a *specific* enclave. The Ephemeral Key can be cryptographically proven to be generated inside the enclave at boot and never exist outside of the enclave. The Nitro attestation document signs over the QOS measurement (`PCR0`/`PCR1`/`PCR2`), the AWS account/role measurement (`PCR3`), the QOS manifest digest (`user_data`), and the Ephemeral public key (`public_key`) all in a single signed document produced by the NSM. That binding is what gives the Ephemeral Key its property: it is unique to this specific enclave instance running this specific code. No quorum provisioning flow can recreate that Ephemeral private key elsewhere. Because that Ephemeral Key only exists inside that specific enclave running that specific code, anything signed by that Ephemeral Key must have been produced by that enclave and therefore by that exact code. An App Proof signature is, transitively, proof of what code generated the output. ## Verification flow To verify a response that comes with an App Proof, a verifier needs both the App Proof and the linked Boot Proof. For Turnkey's App Proof envelope, the open-source verifiers follow this order: 1. **Verify the App Proof signature.** Check the signature scheme, extract the P-256 signing key from the App Proof public key, hash the JSON `proofPayload` with SHA-256, and verify the ECDSA signature. 2. **Verify the Boot Proof.** Parse and verify the AWS Nitro attestation document, including the AWS Nitro certificate chain. Then hash the QOS manifest and confirm it matches the attestation document's `user_data` field. 3. **Verify that the Ephemeral public keys match.** The App Proof `publicKey`, the Boot Proof `ephemeralPublicKeyHex`, and the attestation document `public_key` must all be the same key. 4. **Interpret the verified payload.** Once the proof pair verifies, parse the typed payload and evaluate the claim it makes. For Turnkey's `addressDerivationProof`, for example, the payload commits to a specific organization, wallet, derivation path, and address. For your own TVC application, this is where your verifier applies your application-specific schema and semantics. 5. **Check code identity for full independent verification.** To independently establish the exact code that produced the result, inspect the QOS manifest and verify the application binary digest and PCR values against the known-good values you trust, such as values published in [`tkhq/core-enclaves`](https://github.com/tkhq/core-enclaves). If these checks pass, the App Proof's payload is tied to an AWS-attested Nitro Enclave, to the QOS manifest bound into that attestation, and to the Ephemeral Key that signed the application-level claim. For custom App Proofs, the Boot Proof verification and Ephemeral Key matching are the same. What changes is the application-level payload: you define the schema, what fields are signed, and what a verifier should conclude from those fields. ## Fetching proofs as a verifier An App Proof usually arrives as part of an enclave response. The Boot Proof is fetched separately, keyed by the Ephemeral public key embedded in the App Proof. Turnkey exposes public endpoints for this: * [`get_boot_proof`](https://docs.turnkey.com/api-reference/queries/get-a-specific-boot-proof) — fetch the Boot Proof for a specific Ephemeral public key. This is what a verifier will use after extracting the Ephemeral key from an App Proof. * [`get_latest_boot_proof`](https://docs.turnkey.com/api-reference/queries/get-the-latest-boot-proof-for-an-app) — fetch the most recent Boot Proof for a given enclave application name. Useful for sanity-checking what's currently deployed. * [`list_app_proofs_for_an_activity`](https://docs.turnkey.com/api-reference/queries/list-app-proofs-for-an-activity) — fetch Turnkey App Proofs associated with an activity. Open-source tooling is available in: * [Rust](https://github.com/tkhq/rust-sdk/tree/main/proofs) * [TypeScript](https://github.com/tkhq/sdk/tree/main/packages/crypto/src/proof.ts) * [Go](https://github.com/tkhq/go-sdk/tree/main/pkg/proofs) ## See also * [Turnkey Verified](https://docs.turnkey.com/security/turnkey-verified) — the user-facing feature built on these proofs, including supported App Proof types and example payloads. * [Deployment Lifecycle](https://docs.turnkey.com/features/verifiable-cloud/overview) — how an enclave gets from a container image to a running, attested instance. * [AWS Nitro Enclaves: Verifying the root of trust](https://docs.aws.amazon.com/enclaves/latest/user/verify-root.html). * [Whitepaper: Boot Proofs and App Proofs](https://whitepaper.turnkey.com/foundations#boot-proofs-and-app-proofs). # Turnkey Verifiable Cloud quickstart Source: https://docs.turnkey.com/features/verifiable-cloud/quickstart Run any code in isolated, verifiable secure enclaves powered by Turnkey’s trusted infrastructure. Turnkey Verifiable Cloud is currently in Private Beta. [Join the waitlist](https://www.turnkey.com/turnkey-verifiable-cloud#waitlist) to request access. Once our team reaches out, share your organization ID to get enabled. If you already have a dedicated Slack channel with us, reach out there directly. Once enabled, you will see a new "Verifiable Cloud" section appear in the top-level navigation. ## Prerequisites This guide assumes you've been enabled for **Turnkey Verifiable Cloud**, and you've completed the steps to create an account and an organization as described in the [account setup](/get-started/quickstart) section. ## Installation Install the TVC CLI from crates.io ([`tvc` crate](https://crates.io/crates/tvc)): ```bash theme={"system"} cargo install tvc ``` ## Create your first verifiable app ### Login With your new organization ID ready, login through the CLI. ```bash theme={"system"} tvc login ``` You will be asked to paste in your organization ID, and prompted to add a new generated API key to your organization. When adding it in the dashboard's **Create API Key** modal, click **Advanced Settings**, then **Generate API key via CLI**, and paste in the public key printed by `tvc login`. See [Create an API key](/get-started/quickstart#create-an-api-key) for the full walkthrough. This step generates an operator P256 keypair locally for you. It is stored in `~/.config/turnkey/orgs//operator.json`. The public key will be used in the following steps. Once you're logged in, choose how you'd like to create your app and deployment. The **Dashboard** and **CLI** paths perform the same actions — pick whichever you prefer and follow it end to end. Visit the [TVC dashboard](https://app.turnkey.com/dashboard/v2/tvc) and click on "Create app". Create app button on the TVC dashboard A modal should appear: Create app modal Name your app something identifiable; for this demo it can be `"TVC Hello World"`. Paste in your operator public key from the TVC CLI login step, then click "Create new TVC App" to create your app. Once your app is created, click into it on the [dashboard](https://app.turnkey.com/dashboard/v2/tvc). Click on "Create deployment" to start a new deployment for your app. Create deployment button This should open a modal with all your deployment settings: Deployment settings modal If you do not have your own app, try our helloworld template: * **Container Image URL**: `ghcr.io/tkhq/helloworld:latest@sha256:c9c18f78b05d29ebfc2c60ab7143df4b0a808765a34d6a88bbf99523f473cafd` * TVC requires a single-platform `linux/amd64` image digest, not a multi-platform index digest. If you are building your own image, use `docker buildx imagetools inspect ` to find the `linux/amd64`-specific digest. * If you are bringing private container images, TVC supports uploading pull secrets by encrypting them to a known public key. This will be used by TVC infrastructure to access your container images. Read more about pull secrets [here](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/). * **Executable Path**: `/tvc_app` * **Executable Args**: `--host 0.0.0.0 --port 3000`. These arguments are passed to the executable on startup. Here we are telling the `helloworld` binary to start on port 3000 * **Public ingress port**: `3000`. This is the port that will be exposed to the outside world * **Health check port**: `3000`. Our `tvc_app` binary answers healthchecks on `/health` on the same port (3000) * **Health check type**: `HTTP`. * **Executable digest**: the hash of the binary file inside the container. For our helloworld example this should be `cbe01169428f144086bfaef348bbf3db70f9217628996cafd2ecb85d5f2b47a1`. You can compute it locally with: ``` # Pull the container image, create a "tmp-extract" container, and extract our helloworld binary docker create --name tmp-extract ghcr.io/tkhq/helloworld@sha256:c9c18f78b05d29ebfc2c60ab7143df4b0a808765a34d6a88bbf99523f473cafd /bin/true \ && docker cp tmp-extract:/tvc_app ./tvc_app \ && docker rm tmp-extract # Locally compute the digest of the binary file sha256sum ./tvc_app cbe01169428f144086bfaef348bbf3db70f9217628996cafd2ecb85d5f2b47a1 ``` This digest will be to ensure TVC is running the code you expect. When ready, click "Deploy TVC App"! Create a local app template by running ``` tvc app init --output .json ``` This step is purely local, and generates an editable json template for your app to be used during creation. Your template will look something like this when first generated: ```json theme={"system"} { "name": "", "quorumPublicKey": KNOWN_QUORUM_KEY, "externalConnectivity": false, "manifestSetId": null, "manifestSetParams": { "name": "", "threshold": 1, "newOperators": [ { "name": "operator-1", "publicKey": PUBLIC_KEY_AUTOPOPULATED_FROM_LOGIN } ], "existingOperatorIds": [] } } ``` Name your app something identifiable; for this demo it can be `"TVC Hello World"`. Your manifest set is currently just the public key generated during login; give it an easy to remember name, such as `"TVC Manifest"`. The CLI has also automatically populated this template with a known quorum key, which is sufficient for running verifiable code but not advised for encrypting sensitive data. Create your app in TVC by running ```bash theme={"system"} tvc app create --config-file my-app-template.json ``` This creates your app, and saves its quorum key and manifest settings to the Turnkey Verifiable Cloud platform. Check out your new app on the [TVC dashboard](https://app.turnkey.com/dashboard/v2/tvc). Start with this local-only step, which generates a deployment template: ```bash theme={"system"} tvc deploy init ``` The generated JSON file is named by its time of creation, but you can name it anything by specifying a name after the `--output` flag. Open it and fill in each field: * `appId` is populated with the last app you created. You may edit it to be the id of any app you've created in the past. * `qosVersion`: the QOS release version to use. Currently the only supported version is `v2026.2.6`. * `pivotContainerImageUrl`: link to a public image. For this demo, feel free to use ```json theme={"system"} "ghcr.io/tkhq/helloworld@sha256:c9c18f78b05d29ebfc2c60ab7143df4b0a808765a34d6a88bbf99523f473cafd" ``` * `pivotPath`: location of your binary in the container. Use `"/tvc_app"` for the demo app. * `pivotArgs`: arguments passed to the binary on startup. For the helloworld demo, use `["--host", "0.0.0.0", "--port", "3000"]`. Leave empty for your own app unless it requires arguments. * `expectedPivotDigest`: for the demo, use ```json theme={"system"} "cbe01169428f144086bfaef348bbf3db70f9217628996cafd2ecb85d5f2b47a1" ``` * `pivotContainerEncryptedPullSecret`: your pull secret, if your container image isn't public. Delete this field otherwise. * `publicIngressPort`: 3000 * `healthCheckPort`: 3000 * `healthCheckType`: `TVC_HEALTH_CHECK_TYPE_HTTP` For an arbitrary app, compute the expected digest with ``` docker create --name tmp-extract /bin/true \ && docker cp tmp-extract:/path/to/binary ./binary \ && docker rm tmp-extract sha256sum ./binary ``` Deploy to TVC by running ``` tvc deploy create --config-file deploy-YYYY-MM-DD.json [--pull-secret .json] ``` On success you'll see your deployment ID logged to console. Save the deployment ID for the approval step (you can also find it by clicking into your app on the dashboard): ``` Deployment created successfully! Deployment ID: App ID: Config: deploy-YYYY-MM-DD.json ``` Find the newly created deployment by clicking into your app on the [TVC dashboard](https://app.turnkey.com/dashboard/v2/tvc). Once your deployment is created, the remaining steps are the same for both paths. ### Approve deployment By design, your deployment is not live yet. TVC requires approvals by the manifest set to fully deploy your application. Your app should be at the `Approval Required` stage on the dashboard: Approve stage on the dashboard For this demo app, your manifest set is the public key you created at login. To approve your deployment, use the TVC CLI: ``` tvc deploy approve \ --deploy-id \ --operator-id ``` You may find your operator ID by clicking into your app, then under **Manifest Operators**: Manifest Operators in app page This command walks you through approving each section of the QOS manifest. On success you'll see: ``` ======================================== MANIFEST APPROVAL ======================================== NAMESPACE ───────────────────────────────────── Name: prod/tvc/ Nonce: Quorum Key: ... ======================================== ALL SECTIONS APPROVED ======================================== Posting approval to Turnkey... Approval posted successfully! Approval IDs: [""] Manifest ID: Operator ID: ``` If you didn't change anything during the demo, that should be the only required approval from your manifest set. In the dashboard you will see "Action Required" transition to "none". This means everything is done on your side. You can look at the deployment details in the recap table on on the individual deployment page to know whether your deployment is coming up healthy and whether it's receiving traffic. Deployment details when LIVE Our infrastructure automatically provisions network ingress for your application. You can visit `https://app-.turnkey.cloud` to interact with it. If you used our `helloworld` template, try visiting `/time` in your browser! ### Verify your deployment Once the deployment is live, confirm it is healthy by hitting the `/health` endpoint. Before doing so, check the deployment details from the previous step and ensure **Healthy Replicas** reads `3/3`. If replicas aren't fully up yet, the endpoint may return a 404. ``` curl https://app-.turnkey.cloud/health ``` A healthy deployment returns: ```json theme={"system"} {"status":"ok"} ``` ## Next steps Once the deployment is approved, your app can serve traffic and produce App Proofs, which are cryptographic signatures that prove TVC is running the correct, expected software on a legitimate AWS Nitro Enclave. Learn more about app proofs in [our documentation](/security/turnkey-verified#app-proofs). If you are not yet signed up for Turnkey Verifiable Cloud, join the waitlist [here](https://www.turnkey.com/turnkey-verifiable-cloud#waitlist)! # Wallets Source: https://docs.turnkey.com/features/wallets A [hierarchical deterministic (HD) wallet](https://learnmeabitcoin.com/technical/hd-wallets) is a collection of cryptographic private/public key pairs that share a common seed. A wallet is used to generate accounts. ```json theme={"system"} { "walletId": "eb98ae4c-07eb-4117-9b2d-8a453c0e1e64", "walletName": "default" } ``` #### Configuration Wallet seeds are generated with a default mnemonic length of 12 words. The [BIP-39 specification](https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki) supports mnemonic lengths of 12, 15, 18, 21, and 24 words. To enhance your Wallet's security, you may consider opting for a longer mnemonic length. This optional `mnemonicLength` field can be set when creating a Wallet. It's important to note that once the Wallet seed is generated, the mnemonic is permanent and cannot be altered. ## Accounts An account contains the directions for deriving a cryptographic key pair and corresponding address from a Wallet. In practice, this looks like: * The Wallet seed and Account curve are used to create a root key pair * The Account path format and path are used to derive an extended key pair from the root key pair * The Account address format is used to derive the address from the extended public key ```json theme={"system"} { "address": "0x7aAE6F67798D1Ea0b8bFB5b64231B2f12049DB5e", "addressFormat": "ADDRESS_FORMAT_ETHEREUM", "curve": "CURVE_SECP256K1", "path": "m/44'/60'/0'/0/0", "pathFormat": "PATH_FORMAT_BIP32", "walletId": "eb98ae4c-07eb-4117-9b2d-8a453c0e1e64" } ``` **The account address is used to sign with the underlying extended private key.** #### HD wallet default paths HD wallets use standardized derivation paths to generate multiple accounts from a single seed. These paths follow a specific structure that allows for consistent address generation across different wallet implementations. Here are common default paths for some of the ecosystems supported by Turnkey: * Ethereum: `m/44'/60'/0'/0/0` * Cosmos: `m/44'/118'/0'/0/0` * Solana: `m/44'/501'/0'/0'` For a complete list of coin types and possible HD paths, refer to the [SLIP-0044 specification](https://github.com/satoshilabs/slips/blob/master/slip-0044.md). #### Address formats and curves See below for specific address formats that you can currently derive on Turnkey: | Type | Address Format | Curve | Default HD Path | | -------- | ----------------------------------------- | ---------------- | ------------------ | | n/a | ADDRESS\_FORMAT\_COMPRESSED | CURVE\_SECP256K1 | m/0'/0 | | n/a | ADDRESS\_FORMAT\_COMPRESSED | CURVE\_ED25519 | m/0'/0 | | n/a | ADDRESS\_FORMAT\_UNCOMPRESSED | CURVE\_SECP256K1 | m/0'/0 | | Ethereum | ADDRESS\_FORMAT\_ETHEREUM | CURVE\_SECP256K1 | m/44'/60'/0'/0/0 | | Cosmos | ADDRESS\_FORMAT\_COSMOS | CURVE\_SECP256K1 | m/44'/118'/0'/0/0 | | Solana | ADDRESS\_FORMAT\_SOLANA | CURVE\_ED25519 | m/44'/501'/0'/0 | | Tron | ADDRESS\_FORMAT\_TRON | CURVE\_SECP256K1 | m/44'/195'/0'/0/0 | | Sui | ADDRESS\_FORMAT\_SUI | CURVE\_ED25519 | m/44'/784'/0'/0/0 | | Aptos | ADDRESS\_FORMAT\_APTOS | CURVE\_ED25519 | m/44'/637'/0'/0'/0 | | Canton | ADDRESS\_FORMAT\_COMPRESSED | CURVE\_ED25519 | m/44'/0'/0'/0/0 | | Bitcoin | ADDRESS\_FORMAT\_BITCOIN\_MAINNET\_P2PKH | CURVE\_SECP256K1 | m/44'/0'/0'/0/0 | | Bitcoin | ADDRESS\_FORMAT\_BITCOIN\_MAINNET\_P2SH | CURVE\_SECP256K1 | m/49'/0'/0'/0/0 | | Bitcoin | ADDRESS\_FORMAT\_BITCOIN\_MAINNET\_P2WPKH | CURVE\_SECP256K1 | m/84'/0'/0'/0/0 | | Bitcoin | ADDRESS\_FORMAT\_BITCOIN\_MAINNET\_P2WSH | CURVE\_SECP256K1 | m/48'/0'/0'/2'/0/0 | | Bitcoin | ADDRESS\_FORMAT\_BITCOIN\_MAINNET\_P2TR | CURVE\_SECP256K1 | m/86'/0'/0'/0/0 | | Bitcoin | ADDRESS\_FORMAT\_BITCOIN\_TESTNET\_P2PKH | CURVE\_SECP256K1 | m/44'/1'/0'/0/0 | | Bitcoin | ADDRESS\_FORMAT\_BITCOIN\_TESTNET\_P2SH | CURVE\_SECP256K1 | m/49'/1'/0'/0/0 | | Bitcoin | ADDRESS\_FORMAT\_BITCOIN\_TESTNET\_P2WPKH | CURVE\_SECP256K1 | m/84'/1'/0'/0/0 | | Bitcoin | ADDRESS\_FORMAT\_BITCOIN\_TESTNET\_P2WSH | CURVE\_SECP256K1 | m/48'/1'/0'/2'/0/0 | | Bitcoin | ADDRESS\_FORMAT\_BITCOIN\_TESTNET\_P2TR | CURVE\_SECP256K1 | m/86'/1'/0'/0/0 | | Bitcoin | ADDRESS\_FORMAT\_BITCOIN\_SIGNET\_P2PKH | CURVE\_SECP256K1 | m/44'/1'/0'/0/0 | | Bitcoin | ADDRESS\_FORMAT\_BITCOIN\_SIGNET\_P2SH | CURVE\_SECP256K1 | m/49'/1'/0'/0/0 | | Bitcoin | ADDRESS\_FORMAT\_BITCOIN\_SIGNET\_P2WPKH | CURVE\_SECP256K1 | m/84'/1'/0'/0/0 | | Bitcoin | ADDRESS\_FORMAT\_BITCOIN\_SIGNET\_P2WSH | CURVE\_SECP256K1 | m/48'/1'/0'/2'/0/0 | | Bitcoin | ADDRESS\_FORMAT\_BITCOIN\_SIGNET\_P2TR | CURVE\_SECP256K1 | m/86'/1'/0'/0/0 | | Bitcoin | ADDRESS\_FORMAT\_BITCOIN\_REGTEST\_P2PKH | CURVE\_SECP256K1 | m/44'/1'/0'/0/0 | | Bitcoin | ADDRESS\_FORMAT\_BITCOIN\_REGTEST\_P2SH | CURVE\_SECP256K1 | m/49'/1'/0'/0/0 | | Bitcoin | ADDRESS\_FORMAT\_BITCOIN\_REGTEST\_P2WPKH | CURVE\_SECP256K1 | m/84'/1'/0'/0/0 | | Bitcoin | ADDRESS\_FORMAT\_BITCOIN\_REGTEST\_P2WSH | CURVE\_SECP256K1 | m/48'/1'/0'/2'/0/0 | | Bitcoin | ADDRESS\_FORMAT\_BITCOIN\_REGTEST\_P2TR | CURVE\_SECP256K1 | m/86'/1'/0'/0/0 | | Sei | ADDRESS\_FORMAT\_SEI | CURVE\_ED25519 | m/44'/118'/0'/0/0 | | Stellar | ADDRESS\_FORMAT\_XLM | CURVE\_ED25519 | m/44'/148'/0'/0'/0 | | Dogecoin | ADDRESS\_FORMAT\_DOGE\_MAINNET | CURVE\_SECP256K1 | m/44'/3'/0'/0/0 | | Dogecoin | ADDRESS\_FORMAT\_DOGE\_TESTNET | CURVE\_SECP256K1 | m/44'/1'/0'/0/0 | | TON | ADDRESS\_FORMAT\_TON\_V3R2 | CURVE\_ED25519 | m/44'/607'/0'/0/0 | | TON | ADDRESS\_FORMAT\_TON\_V4R2 | CURVE\_ED25519 | m/44'/607'/0'/0/0 | | XRP | ADDRESS\_FORMAT\_XRP | CURVE\_SECP256K1 | m/44'/144'/0'/0/0 | | FLARE | ADDRESS\_FORMAT\_ETHEREUM | CURVE\_SECP256K1 | m/44'/60'/0'/0/0 | | Spark | ADDRESS\_FORMAT\_SPARK\_MAINNET | CURVE\_SECP256K1 | m/8797555'/0'/0' | | Spark | ADDRESS\_FORMAT\_SPARK\_REGTEST | CURVE\_SECP256K1 | m/8797555'/0'/0' | #### Where can I learn more? In addition to the guide mentioned above on [HD Wallets](https://learnmeabitcoin.com/technical/hd-wallets), there is also a page specifically on [Derivation Paths](https://learnmeabitcoin.com/technical/derivation-paths). #### What if I don't see the address format for my network? You can use `ADDRESS_FORMAT_COMPRESSED` to generate a public key which can be used to sign with (only sign raw payloads supported). #### What is the difference between sign transaction and sign raw payload ? [SignRawPayload](https://docs.turnkey.com/api-reference/activities/sign-raw-payload): network-agnostic, curve-based signing of messages. [SignTransaction](https://docs.turnkey.com/api-reference/activities/sign-transaction): network-specific transaction signing, including [transaction parsing](https://docs.turnkey.com/networks/overview#:~:text=Tier%204%3A%20Transaction%20parsing%20and%20policy%20creation) and compatibility with our policy engine. #### What if I don't see the curve for my network? Contact us at [hello@turnkey.com](mailto:hello@turnkey.com). ## Delete wallets To delete wallets you can call the [delete wallets activity](/api-reference/activities/delete-wallets). Before deleting a wallet it must have been exported to prevent loss of funds, or you can pass in the `deleteWithoutExport` parameter with the value `true` to override this. The `deleteWithoutExport` parameter, if not passed in, is default `false`. Note that this activity must be initiated by the wallet owner. ## Private keys Turnkey also supports raw private keys, but we recommend using Wallets since they offer several advantages: * Wallets can be used across various cryptographic curves * Wallets can generate millions of addresses for various digital assets * Wallets can be represented by a checksummed, mnemonic phrase making them easier to backup and recover ## Export keys Exporting on Turnkey enables you or your end users to export a copy of a Wallet or Private Key from our system at any time. While most Turnkey users opt to keep Wallets within Turnkey's secure infrastructure, the export functionality means you are never locked into Turnkey, and gives you the freedom to design your own backup processes as you see fit. Check out our [Export Wallet guide](/features/wallets/export-wallets) to allow your users to securely export their wallets. ## Import keys Importing on Turnkey enables you or your end users to import a Wallet or Private Key to our system. Check out our [Import Wallet guide](/features/wallets/import-wallets) to allow your users to securely import their wallets. ## Delete keys To delete private keys you can call the [delete private keys activity](/api-reference/activities/delete-private-keys). Before deleting a private key it must have been exported to prevent loss of funds, or you can pass in the `deleteWithoutExport` parameter with the value `true` to override this. The `deleteWithoutExport` parameter, if not passed in, is default `false`. Note that this activity must be initiated by the private key owner. # Account abstraction wallets Source: https://docs.turnkey.com/features/wallets/aa-wallets Turnkey offers flexible infrastructure to create and manage keys. These keys can be used as a signer inside of an [Account Abstraction wallet](https://www.erc4337.io/), and we've partnered with [Alchemy](https://www.alchemy.com/) and [ZeroDev](https://zerodev.app/) to integrate in a few lines of code. For gas sponsorship without third-party AA providers, Turnkey's native Transaction Management supports sponsored transactions for EVM and Solana directly. See [Transaction Management](/features/transaction-management) to get started without an AA stack. ## Alchemy's account kit You can use Turnkey with Alchemy's Account Kit via the [aa-signers](https://accountkit.alchemy.com/signer/what-is-a-signer) package to generate embedded wallets, and leverage [aa-alchemy](https://accountkit.alchemy.com/signer/custom-signer#implementing-smartaccountsigner) to create smart accounts for your users. Visit [the Alchemy Account Kit documentation](https://www.alchemy.com/docs/wallets/signer/what-is-a-signer#alchemy-signer) for more information. ## ZeroDev wallets By combining Turnkey with ZeroDev you can create AA wallets with powerful functionalities such as sponsoring gas, batching transactions, and more. Visit [the ZeroDev documentation](https://docs.zerodev.app/smart-accounts/authentication/turnkey) for more information. ## Biconomy smart accounts Create a Biconomy Smart Account and add a Turnkey signer to manage your private key and authentication methods by using Turnkey's API. For detailed code snippets and an integration guide, refer to the [Biconomy documentation](https://docs.biconomy.io/new/getting-started/getting-started). Ethereum's latest EIP-7702 standard gives superpowers to Externally Owned Accounts (EOAs). Biconomy has a guide on how to leverage gas abstracted transactions with Turnkey and Biconomy, enabling Turnkey EOAs to become smart accounts through delegation to Nexus. The tutorial showcases gas abstracted batch execution - users can pay gas fees with ERC20 tokens from their EOA. Refer to [Biconomy documentation](https://docs.biconomy.io/new/integration-guides/wallets-and-signers/turnkey) to get started. ## permissionless.js accounts permissionless.js is a TypeScript library built on viem for building with ERC-4337 smart accounts, bundlers, paymasters, and user operations. permissionless.js defines the `SmartAccountSigner` interface which supports Turnkey as a signer. You can find a detailed example for integrating a Turnkey signer with permissionless.js in the [Pimlico documentation](https://docs.pimlico.io/permissionless/how-to/signers/turnkey). # Claim links Source: https://docs.turnkey.com/features/wallets/claim-links Enable your users to send crypto to people who haven’t signed up yet through secure, non-custodial magic claim links. This feature creates pre-funded wallets that new users can claim by simply clicking a URL. ### How it works You will create a temporary “escrow” wallet where funds are held securely until claimed, and embed an authenticator with access to this wallet in a URL. When the new user clicks on the claim link, they will land directly in your app and see a wallet that’s already been topped up with crypto from an existing user. You can view an example of the feature below: ### Implementation guide **Step 1: Set up your application:** Before you start building this feature, ensure: * Your organization is set up with embedded wallets in a [sub-organization model](/features/sub-organizations): Each of your users should map to a dedicated sub-org in Turnkey. * [Email authentication](https://docs.turnkey.com/embedded-wallets/sub-organization-auth) is enabled so that new users can sign up through a secure email flow. * Your backend can store mapping records between transactions and sub-organizations **Step 2: The Sender initiates the flow** When an existing user (the “Sender”) wants to send funds to someone new, here’s what needs to happen: This sub-org acts as the escrow environment. It will:  * Contain a new “escrow” wallet  * Contain a root user with two authenticators:  * The Sender’s email or phone number, included so that they can reclaim funds later on if necessary.  * A programmatically generated API key (“Claim Key”). This key will later be passed to the Receiver via a claim link.  Initiate the transfer of funds from the Sender’s primary wallet to this new escrow wallet.  For added security, store a transaction record in your backend that maps a transaction id to this temporary sub-org id.   You can take all of these actions via a session to ensure the user experience is as simple as setting an amount and copying a link to send. **Step 3: Generate and share the claim link** Construct a link containing, as query parameters:  * Base64-encoded private key from the Claim Key * Transaction id You can now show the Sender a “Copy link” or “Share via…” button. **Step 4: Receiver claims funds** When the Receiver opens the link in your app: Your app parses the transaction id and looks up the associated temporary sub-org ID Reconstruct the Claim Key using the private key from the URL and store it in local storage. Now, the Receiver has an API key in local storage that grants them the ability to send funds out of the escrow wallet.  Guide the Receiver through your typical signup flow to create a permanent sub-organization containing a new permanent wallet (“Receiver Wallet”) and permanent authenticators.  Use the Claim Key in local storage to authorize transferring the claimable funds from the escrow wallet to the Receiver Wallet.  After successful transfer, delete the temporary sub-org using the Claim Key.  The receiver now controls their own wallet under a permanent sub-org which contains the new funds. If the funds are never claimed or the Sender wishes to revoke the gift for any reason, your app can allow the sender to reclaim them by using their email or phone number to restart a new session for the escrow sub-organization. # Export wallets Source: https://docs.turnkey.com/features/wallets/export-wallets The process of exporting wallets or private keys from Turnkey is just two steps, which together ensure key material cannot be compromised on its way to you: Initialize the wallet or private key export activity. In this activity, specify the wallet or private key ID being exported, plus a target encryption key (TEK). A Turnkey enclave encrypts the exported key to the target public key, and returns the bundle. Decrypt the resulting bundle to reveal the wallet or private key. ## How it works Turnkey exports are powered by a **target encryption key** (TEK) — a standard P-256 key pair that you generate and control. It can be created completely offline, or online using the Web Crypto API. The public portion of the TEK is passed as a parameter inside a signed `EXPORT_WALLET`, `EXPORT_PRIVATE_KEY`, or `EXPORT_WALLET_ACCOUNT` activity. Turnkey's enclave encrypts the wallet mnemonic or private key to your TEK using [HPKE](https://datatracker.ietf.org/doc/html/rfc9180), then returns the encrypted bundle. Only the holder of the TEK private key can decrypt the result — not Turnkey, not your application server. Once the activity succeeds, the exported wallet remains stored within Turnkey's infrastructure and is flagged as "Exported" in your dashboard. Wallet export cryptography diagram For full protocol details, see [Enclave to end-user secure channel](/security/enclave-secure-channels). ## Implementation guides ### Client side SDKs Each client SDK integration guide covers wallet and private key export end-to-end, including generating the TEK, submitting the export activity, and decrypting the returned bundle: * [React](/solutions/embedded-wallets/integration-guide/react/using-embedded-wallets#importing-and-exporting-wallets) * [React Native](/solutions/embedded-wallets/integration-guide/react-native/using-embedded-wallets#export) * [Flutter](/solutions/embedded-wallets/integration-guide/flutter/using-embedded-wallets#exporting-wallets) * [Swift](/solutions/embedded-wallets/integration-guide/swift/using-embedded-wallets#exporting) * [Kotlin](/solutions/embedded-wallets/integration-guide/kotlin/using-embedded-wallets#export) ### Server side SDK Use [`@turnkey/sdk-server`](https://www.npmjs.com/package/@turnkey/sdk-server) together with [`@turnkey/crypto`](https://www.npmjs.com/package/@turnkey/crypto) to drive export flows from a Node.js backend. The server generates a P-256 TEK, submits the export activity with the TEK public key, and `@turnkey/crypto` decrypts the returned bundle. A full reference implementation is available at [export-in-node](https://github.com/tkhq/sdk/tree/main/examples/key-management/export-in-node). ### Embedded iframe Turnkey hosts a static export page at `export.turnkey.com` designed to be embedded as an iframe in your app. The encrypted bundle returned by Turnkey is injected into the iframe, which decrypts and displays the mnemonic or private key entirely within its own origin — neither your app nor Turnkey ever sees the plaintext. Use [`@turnkey/iframe-stamper`](https://www.npmjs.com/package/@turnkey/iframe-stamper) to insert the iframe and inject the export bundle. Source code for the hosted page is available at [tkhq/frames](https://github.com/tkhq/frames). For a full reference implementation, see the [import-export-with-iframe-stamper](https://github.com/tkhq/sdk/tree/main/examples/key-management/import-export-with-iframe-stamper) example. # Import wallets Source: https://docs.turnkey.com/features/wallets/import-wallets The process of importing wallets or private keys into Turnkey is broken up into three primary steps, which together ensure key material cannot be compromised on its way to Turnkey: Initialize the import process. Turnkey creates and returns a secure bundle, which includes a target encryption key (TEK). Encrypt the wallet or private key to the TEK from the previous step. Send the resulting bundle to Turnkey. Turnkey decrypts the bundle in secure enclave where the wallet or private key will reside long-term. ## How it works Turnkey imports are powered by a **target encryption key** (TEK) — a standard P-256 key pair generated inside the Turnkey secure enclave when you call the `INIT_IMPORT_WALLET` or `INIT_IMPORT_PRIVATE_KEY` activity. The TEK public key is returned in the activity response and signed by the enclave's quorum key, so the client can verify it is encrypting to a genuine Turnkey enclave and not a man-in-the-middle. The client encrypts the wallet mnemonic or private key to the TEK public key before it leaves the user's device. The encrypted bundle is then submitted in an `IMPORT_WALLET` or `IMPORT_PRIVATE_KEY` activity, where the enclave uses its TEK private key to decrypt and store the key material. Neither Turnkey nor your application ever sees the plaintext. Wallet import cryptography diagram For full protocol details, see [Enclave to end-user secure channel](/security/enclave-secure-channels). ## Implementation guides ### Client side SDKs Each client SDK integration guide covers wallet and private key import end-to-end, including initializing the import, encrypting key material, and completing the activity: * [React](/solutions/embedded-wallets/integration-guide/react/using-embedded-wallets#importing-and-exporting-wallets) * [React Native](/solutions/embedded-wallets/integration-guide/react-native/using-embedded-wallets#import) * [Flutter](/solutions/embedded-wallets/integration-guide/flutter/using-embedded-wallets#importing-wallets) * [Swift](/solutions/embedded-wallets/integration-guide/swift/using-embedded-wallets#importing) * [Kotlin](/solutions/embedded-wallets/integration-guide/kotlin/using-embedded-wallets#import) ### Server side SDK Use [`@turnkey/sdk-server`](https://www.npmjs.com/package/@turnkey/sdk-server) together with [`@turnkey/crypto`](https://www.npmjs.com/package/@turnkey/crypto) to drive import flows from a Node.js backend. The server initializes the import activity to receive the TEK, `@turnkey/crypto` encrypts the key material to the TEK, and the server completes the import. A full reference implementation is available at [import-in-node](https://github.com/tkhq/sdk/tree/main/examples/key-management/import-in-node). ### Embedded iframe Turnkey hosts a static import page at `import.turnkey.com` designed to be embedded as an iframe in your app. The iframe handles encryption of the mnemonic or private key entirely within its own origin — neither your app nor Turnkey ever sees the plaintext. Use [`@turnkey/iframe-stamper`](https://www.npmjs.com/package/@turnkey/iframe-stamper) to insert the iframe, inject the import bundle, and extract the encrypted result. Source code for the hosted page is available at [tkhq/frames](https://github.com/tkhq/frames). For a full reference implementation, see the [import-export-with-iframe-stamper](https://github.com/tkhq/sdk/tree/main/examples/key-management/import-export-with-iframe-stamper) example. # Pre-generated wallets Source: https://docs.turnkey.com/features/wallets/pregenerated-wallets Turnkey allows you to pre-generate wallets for your user before they authenticate. This is helpful if you already know the users email or phone number, and want to create a deposit address for them or airdrop a reward before they authenticate to Turnkey. To accomplish this, create a new sub-org for that user with a single root user. This root user should only have the end user’s email or phone number associated with it, and no other authenticators, which ensures that only the end user can claim the pre-generated wallet. When the end user wants to claim the wallet, they can complete [email auth](/features/authentication/email) flow to authenticate and sign a transaction or add a new authenticator. # Webhooks Source: https://docs.turnkey.com/features/webhooks/overview Receive signed, real-time notifications for events in your Turnkey organization. Webhooks deliver real-time notifications as signed HTTPS POST requests. Register an endpoint and subscribe to event types, and Turnkey will automatically deliver updates as they occur. * Signed deliveries with Ed25519 signatures -- see [Verify signatures](/features/webhooks/verify-signatures) * Organization-aware headers including org ID, event type, and timestamps on every delivery * Automatic retries for failed deliveries * Dashboard and API management for creating and configuring endpoints * Policy-based access control through dedicated activity types ## Event types | Event type | Description | Scope | | --------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------- | | `ACTIVITY_UPDATES` | Sends activity status updates. Parent-owned endpoints receive events for the parent and all sub-organizations; sub-organization-owned endpoints receive only their own events. | Organization-scoped | | `BALANCE_CONFIRMED_UPDATES` | Sends confirmed balance update events when a transaction containing a balance change is first seen in a block onchain. | Billing organization scoped | | `BALANCE_FINALIZED_UPDATES` | Sends finalized balance update events when the containing block has reached the finalization threshold. Add this alongside `BALANCE_CONFIRMED_UPDATES` if you need finalization signals. | Billing organization scoped | | `SEND_TRANSACTION_STATUS_UPDATES` | Sends transaction status updates when a transaction changes state (e.g. from `BROADCASTING` to `INCLUDED` or `FAILED`). | Billing organization scoped | Balance and transaction status webhook endpoints must be managed from the billing organization. Sub-organization attempts to create, update, or delete these endpoints return `PermissionDenied`. Only documented event types produce deliveries. Unknown event types should not be used and may be rejected in the future. For further information on balances, including supported chains and assets, see [Balances](/features/transaction-management/balances). ## Create an endpoint Create webhook endpoints from a server-side client using an API key. The endpoint URL must be HTTPS and must resolve to a public destination. SDK methods accept the intent parameters directly. The SDK adds the activity envelope fields (`type`, `timestampMs`, `organizationId`, and `parameters`) before signing and submitting the request. Use the raw envelope shape only when calling the HTTP API directly. For server-side/API-key automation, use `@turnkey/sdk-server@6.1.0+`; it includes `createWebhookEndpoint`. For client-side admin flows, `@turnkey/core` can also submit webhook endpoint activities through `client.httpClient.createWebhookEndpoint(...)`, provided the authenticated session is authorized to submit signed activities for the organization. Raw HTTP and CLI submission remain supported for direct activity submission. SDK methods accept intent parameters directly; raw HTTP uses the activity envelope shape. ### Activity updates ```ts theme={"system"} import { Turnkey } from "@turnkey/sdk-server"; const organizationId = process.env.ORGANIZATION_ID!; const webhookUrl = "https://example.com/webhooks/turnkey"; const turnkey = new Turnkey({ apiBaseUrl: "https://api.turnkey.com", apiPublicKey: process.env.API_PUBLIC_KEY!, apiPrivateKey: process.env.API_PRIVATE_KEY!, defaultOrganizationId: organizationId, }); const activityWebhook = await turnkey.apiClient().createWebhookEndpoint({ organizationId, // optional if defaultOrganizationId is configured name: "Activity updates", url: webhookUrl, subscriptions: [{ eventType: "ACTIVITY_UPDATES" }], }); ``` ### Balance updates For balance webhooks, subscribe to `BALANCE_CONFIRMED_UPDATES` when enabling balance notifications. Add `BALANCE_FINALIZED_UPDATES` alongside confirmed updates if you also need finalization signals. ```ts theme={"system"} const organizationId = process.env.ORGANIZATION_ID!; const webhookUrl = "https://example.com/webhooks/balances"; const balanceWebhook = await turnkey.apiClient().createWebhookEndpoint({ organizationId, name: "Balance confirmed updates", url: webhookUrl, subscriptions: [{ eventType: "BALANCE_CONFIRMED_UPDATES" }], }); ``` The `name` field is a human-readable endpoint name and should be non-empty. Event types must be passed in `subscriptions[]`; do not pass a top-level `eventTypes` field. ## Manage endpoints Use the webhook endpoint APIs or the Dashboard UI to manage existing endpoints: | Operation | Path | Notes | | -------------------------------------------------------------------- | ------------------------------------------- | ----------------------------------------------------------------- | | [Create endpoint](/api-reference/activities/create-webhook-endpoint) | `/public/v1/submit/create_webhook_endpoint` | Requires `url` and `subscriptions[]`; `name` should be non-empty. | | [Update endpoint](/api-reference/activities/update-webhook-endpoint) | `/public/v1/submit/update_webhook_endpoint` | Updates `url`, `name`, or `isActive`. | | [Delete endpoint](/api-reference/activities/delete-webhook-endpoint) | `/public/v1/submit/delete_webhook_endpoint` | Deletes an endpoint and its subscriptions. | | [List endpoints](/api-reference/queries/list-webhook-endpoints) | `/public/v1/query/list_webhook_endpoints` | Returns endpoints and their subscriptions for an organization. | Set `isActive` to `false` to pause delivery without deleting the endpoint. ## Endpoint validation and reachability Webhook endpoint URLs are validated when endpoints are created or updated, and delivery also uses dial-time protections. URLs must use `https`, include a valid host, and resolve to a public destination. Turnkey rejects URLs that point to localhost, private IP ranges, link-local addresses, metadata endpoints, or URLs that include user info. Redirects are not followed. If your endpoint hostname later resolves to a disallowed destination, delivery will fail even if the endpoint was valid when it was created. Keep your endpoint publicly reachable and return a `2xx` response after accepting the webhook. Avoid long-running request handling in the delivery path; enqueue work internally and respond quickly. `3xx`, `4xx`, and `429` responses are treated as terminal delivery failures, while network errors and `5xx` responses may be retried. ## Delivery contract Turnkey sends each webhook as an HTTPS `POST` request. The request body is JSON and the `Content-Type` header is `application/json`. Your endpoint should return a `2xx` status code after accepting the delivery. Only active endpoints and active subscriptions receive deliveries. ### Headers | Header | Description | | ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `X-Turnkey-Organization-Id` | Organization used for webhook routing and delivery. For billing-scoped events such as balance and transaction status updates, this is the billing/parent organization. The event owner is available in the payload `organizationId`. | | `X-Turnkey-Event-Type` | Event type, such as `ACTIVITY_UPDATES` or `BALANCE_CONFIRMED_UPDATES`. | | `X-Turnkey-Timestamp` | Unix timestamp in milliseconds for the delivery attempt. | | `X-Turnkey-Webhook-Version` | Webhook delivery contract version. The current value is `1`. | | `X-Turnkey-Event-Id` | Signed delivery metadata. This value is stable across retry attempts for the same webhook event. | | `X-Turnkey-Signature-Key-Id` | Identifier for the Turnkey signing key. | | `X-Turnkey-Signature-Algorithm` | Signature algorithm. The current value is `ed25519`. | | `X-Turnkey-Signature-Version` | Signature contract version. The current value is `v1`. | | `X-Turnkey-Signature` | Hex-encoded Ed25519 signature. | ### Retry behavior Turnkey treats `2xx` responses as successful. Turnkey automatically retries retryable delivery failures. Retry schedules and attempt counts are subject to change. Signed retries receive a fresh timestamp and signature. `X-Turnkey-Event-Id` is signed delivery metadata and is stable across retry attempts for the same webhook event. Payload fields such as `msg.idempotencyKey` are event-specific business identifiers. Either may be useful for deduplication depending on the use case, but they are not the same field. ## Payloads ### Activity updates `ACTIVITY_UPDATES` deliveries contain the full activity object for the triggering event. Use the activity `id` and/or the webhook `X-Turnkey-Event-Id` header to process deliveries idempotently. ### Balance updates Each delivery corresponds to a single balance-change event: one address, one operation (`deposit` or `withdraw`), and one asset. A single transaction can affect multiple addresses or assets, so it may produce multiple webhook deliveries, each with its own `idempotencyKey`. The `type` field is `"balances:confirmed"` when a balance change is first seen onchain, or `"balances:finalized"` when the associated block has reached the finalization threshold. ```json theme={"system"} { "type": "balances:confirmed", "organizationId": "", "parentOrganizationId": "", "msg": { "operation": "deposit", "caip2": "", "txHash": "", "address": "", "idempotencyKey": "", "asset": { "symbol": "", "name": "", "decimals": "", "caip19": "", "amount": "" }, "block": { "number": "", "hash": "", "timestamp": "" } } } ``` | Field | Description | | ---------------------- | -------------------------------------------------------------------------------------------------------------------------------- | | `type` | `"balances:confirmed"` when first seen onchain, or `"balances:finalized"` when the block has reached the finalization threshold. | | `organizationId` | Organization that owns the address. | | `parentOrganizationId` | Billing/parent organization that owns webhook configuration and delivery. | | `msg.operation` | Either `"deposit"` (incoming) or `"withdraw"` (outgoing). | | `msg.caip2` | The chain identifier where the event occurred. | | `msg.txHash` | The transaction hash that triggered the balance change. | | `msg.address` | The address whose balance changed. | | `msg.idempotencyKey` | A stable, unique key for this event. Use this to safely deduplicate webhook deliveries. | | `msg.asset` | Asset metadata: symbol, name, decimals, CAIP-19 identifier, and the amount transferred (in the asset's smallest unit). | | `msg.block` | Block number, hash, and timestamp of the block in which the transaction was first seen. | Balance webhooks fire only for assets in the [supported asset list](/api-reference/queries/list-supported-assets) and are not supported for private key addresses. ### Transaction status updates Each delivery fires when a transaction changes state. The `type` is always `"transaction:status"`. Fields present in `msg` depend on the status: * **BROADCASTING**: base fields only, no `txHash` or `error` * **INCLUDED**: base fields + `txHash`. If the transaction reverted onchain, `error` is also present. * **FAILED**: base fields + `error`. No `txHash` (the transaction never landed onchain). ```json theme={"system"} { "type": "transaction:status", "organizationId": "", "parentOrganizationId": "", "msg": { "sendTransactionStatusId": "", "activityId": "", "status": "INCLUDED", "caip2": "", "idempotencyKey": "", "timestamp": "", "txHash": "" } } ``` | Field | Description | | ----------------------------- | ------------------------------------------------------------------------------------------------------------- | | `type` | Always `"transaction:status"`. | | `organizationId` | Organization that initiated the transaction. | | `parentOrganizationId` | Billing/parent organization that owns webhook configuration and delivery. | | `msg.sendTransactionStatusId` | The ID of the send transaction status record. | | `msg.activityId` | The ID of the originating Turnkey activity. | | `msg.status` | One of `BROADCASTING`, `INCLUDED`, or `FAILED`. | | `msg.caip2` | The chain identifier where the transaction was sent. | | `msg.idempotencyKey` | A stable, unique key for this status event. Use this to safely deduplicate webhook deliveries. | | `msg.timestamp` | Unix timestamp (seconds) when the notification was generated. | | `msg.txHash` | *(INCLUDED only)* The onchain transaction hash or Solana signature. | | `msg.error` | Structured error object. Contains `message`, and either `eth.revertChain` (EVM) or `solana` (Solana) details. | For more details on transaction broadcasting, see [Broadcasting](/features/transaction-management/broadcasting). ## Permissions Creating, updating, and deleting webhook endpoints are standard Turnkey write activities. Root users can approve them by default. Use [Turnkey policies](/features/policies/overview) to delegate webhook management to non-root users. ```text theme={"system"} activity.type == 'ACTIVITY_TYPE_CREATE_WEBHOOK_ENDPOINT' activity.type == 'ACTIVITY_TYPE_UPDATE_WEBHOOK_ENDPOINT' activity.type == 'ACTIVITY_TYPE_DELETE_WEBHOOK_ENDPOINT' ``` Read operations, such as listing webhook endpoints, use standard authenticated query access. ## Troubleshooting | Symptom | What to check | | -------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `createWebhookEndpoint` is unavailable in your SDK | Use `@turnkey/sdk-server@6.1.0+` for server-side/API-key automation. Use `@turnkey/core` for browser/client-side admin flows. | | `PermissionDenied` on create/update/delete | Confirm the user has an allow policy for the webhook activity type. For balance or transaction-status webhooks, also confirm the endpoint is being managed from the billing organization. | | Subscription shape errors | Pass event types inside `subscriptions[]`, not as top-level `eventTypes`. For raw HTTP activity submission, put `subscriptions[]` inside `parameters`. | | Empty endpoint names | Set a non-empty, human-readable `name`. For raw HTTP activity submission, set `parameters.name`. | | Invalid webhook URL errors | Use an HTTPS URL that resolves to a public destination. Localhost, private IPs, link-local addresses, metadata endpoints, and URLs with user info are rejected. | | Signature verification fails | See [Verify webhook signatures](/features/webhooks/verify-signatures). Common causes: not using the exact raw request body, clock skew, or a missing/stale JWKS key. Cache JWKS according to `Cache-Control` and refetch when the signature `kid` is unknown. | # Verify webhook signatures Source: https://docs.turnkey.com/features/webhooks/verify-signatures Verify Turnkey webhook signatures using the JWKS key discovery endpoint and the @turnkey/crypto SDK helper. Turnkey signs webhook deliveries with Ed25519. Verify the signature before parsing or trusting the JSON payload. Verification must use the exact raw request body bytes that Turnkey sent. Re-serializing parsed JSON, changing whitespace, or changing key order will cause verification to fail. ## Signed message format The signature covers the signature contract fields and the raw body: ```text theme={"system"} v1.ed25519.... ``` The `event_id` segment is the value of the `X-Turnkey-Event-Id` header. Other delivery headers such as organization ID and event type are not part of the signed message. ## Key discovery Turnkey publishes webhook signing keys at a public JWKS endpoint. Use this endpoint to fetch the Ed25519 public key needed to verify webhook signatures. Match the `kid` field in the response to the `X-Turnkey-Signature-Key-Id` header on each delivery: ```text theme={"system"} GET https://api.turnkey.com/public/v1/discovery/webhooks/jwks ``` This endpoint requires no authentication. The response is a standard [JSON Web Key Set (RFC 7517)](https://datatracker.ietf.org/doc/html/rfc7517) containing Ed25519 public keys: ```json theme={"system"} { "keys": [ { "kid": "", "kty": "OKP", "crv": "Ed25519", "alg": "EdDSA", "use": "sig", "x": "", "turnkey_signature_algorithm": "ed25519", "turnkey_signature_version": "v1" } ] } ``` | Field | Description | | ----------------------------- | ------------------------------------------------------------------------------------ | | `kid` | Key identifier. Match this against the `X-Turnkey-Signature-Key-Id` delivery header. | | `kty` | Key type. `OKP` (Octet Key Pair) for Ed25519 keys. | | `crv` | Curve. `Ed25519`. | | `alg` | Algorithm. `EdDSA`. | | `use` | Key usage. `sig` (signature). | | `x` | Base64url-encoded 32-byte Ed25519 public key. | | `turnkey_signature_algorithm` | Turnkey-specific. Matches the `X-Turnkey-Signature-Algorithm` header value. | | `turnkey_signature_version` | Turnkey-specific. Matches the `X-Turnkey-Signature-Version` header value. | The JWKS endpoint returns standard `Cache-Control` headers. Cache the response according to those headers and refresh on expiry. If a delivery arrives with a `kid` that does not match any cached key, refetch the JWKS before rejecting the delivery. This avoids stale-cache failures during key rotation while still allowing efficient caching. ## SDK verification helper The `@turnkey/crypto` package (v2.10.0+) exports `verifyTurnkeyWebhookSignature`, which handles signed-input reconstruction, timestamp freshness, and Ed25519 verification. The helper accepts caller-provided verification keys and returns a typed result instead of throwing. Fetch the JWKS endpoint, convert each key's base64url-encoded `x` field to hex, and pass the result as `verificationKeys`: ```ts theme={"system"} import { verifyTurnkeyWebhookSignature } from "@turnkey/crypto"; const JWKS_URL = "https://api.turnkey.com/public/v1/discovery/webhooks/jwks"; // Fetch and cache the JWKS. Convert base64url public keys to hex. async function fetchVerificationKeys() { const res = await fetch(JWKS_URL); const jwks = await res.json(); return jwks.keys.map((key: any) => ({ keyId: key.kid, publicKey: Buffer.from(key.x, "base64url").toString("hex"), algorithm: "ed25519" as const, })); } const verificationKeys = await fetchVerificationKeys(); // In your webhook handler: const rawBody = await request.text(); const result = verifyTurnkeyWebhookSignature({ headers: request.headers, body: rawBody, verificationKeys, maxTimestampAgeMs: 5 * 60 * 1000, // 5-minute replay window }); if (!result.ok) { // result.reason describes the failure (e.g. "stale_timestamp", "missing_key") return new Response("Invalid signature", { status: 401 }); } // Signature verified. Safe to parse. const payload = JSON.parse(rawBody); ``` Always read the raw request body before any middleware parses it. Frameworks like Express require `express.raw({ type: "application/json" })` to preserve the original bytes. If your framework has already parsed the body, the re-serialized output may differ from what Turnkey signed. ## Manual verification If you are not using the TypeScript SDK, verify signatures manually: 1. Fetch the JWKS from `https://api.turnkey.com/public/v1/discovery/webhooks/jwks`. 2. Find the key whose `kid` matches the `X-Turnkey-Signature-Key-Id` header. Base64url-decode the `x` field to obtain the 32-byte Ed25519 public key. 3. Reconstruct the signed input by concatenating the header values and raw body in the format: `v1.ed25519....`. 4. Hex-decode the `X-Turnkey-Signature` header to obtain the 64-byte Ed25519 signature. 5. Verify the Ed25519 signature over the signed input bytes using the public key from step 2. 6. Check that `X-Turnkey-Timestamp` is within an acceptable freshness window (e.g. 5 minutes) to guard against replay attacks. # addOauthProvider() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-add-oauth-provider Adds an OAuth provider to the user.
  • This function adds an OAuth provider (e.g., Google, Apple) to the user account.
  • If a userId is provided, it adds the provider for that specific user; otherwise, it uses the current session's userId.
  • Automatically checks if an account already exists for the provided OIDC token and prevents duplicate associations.
  • If the user's email is not set or not verified, attempts to update and verify the email using the email from the OIDC token.
  • Handles session management and error reporting for the add provider flow.
  • Optionally allows stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).

Package: core

Defined in: **clients**/core.ts:3758

OIDC token for the OAuth provider. organization ID to specify the sub-organization (defaults to the current session's organizationId). name of the OAuth provider to add (e.g., "Google", "Apple"). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). user ID to add the provider for a specific user (defaults to current session's userId). A successful response returns the following fields: A promise that resolves to an array of provider IDs associated with the user. # addPasskey() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-add-passkey Adds a new passkey authenticator for the user.
  • This function prompts the user to create a new passkey (WebAuthn/FIDO2) and adds it as an authenticator for the user.
  • Handles both web and React Native environments, automatically selecting the appropriate passkey creation flow.
  • If a userId is provided, the passkey is added for that specific user; otherwise, it uses the current session's userId.
  • The passkey's name and display name can be customized; if not provided, defaults are generated.
  • The resulting passkey attestation and challenge are registered with Turnkey as a new authenticator.

Package: core

Defined in: **clients**/core.ts:3968

display name of the passkey (defaults to the value of `name`). name of the passkey (defaults to "Turnkey Passkey-`timestamp`"). organization ID to specify the sub-organization (defaults to the current session's organizationId). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). user ID to add the passkey for a specific user (defaults to the current session's userId). A successful response returns the following fields: A promise that resolves to an array of authenticator IDs for the newly added passkey(s). # buildWalletLoginRequest() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-build-wallet-login-request Builds and signs a wallet login request without submitting it to Turnkey.
  • This function prepares a signed request for wallet authentication, which can later be used
to log in or sign up a user with Turnkey.
  • It initializes the wallet stamper, ensures a valid session public key (generating one if needed),
and signs the login intent with the connected wallet.
  • For Ethereum wallets, derives the public key from the stamped request header.
  • For Solana wallets, retrieves the public key directly from the connected wallet.
  • The signed request is not sent to Turnkey immediately; it is meant to be used in a subsequent flow
(e.g., `loginOrSignupWithWallet`) where sub-organization existence is verified or created first.

Package: core

Defined in: **clients**/core.ts:840

optional session expiration time in seconds (defaults to the configured default). optional pre-generated session public key (auto-generated if not provided). the wallet provider used for authentication and signing. A successful response returns the following fields: A promise resolving to an object containing: * `signedRequest`: the signed wallet login request. * `publicKey`: the public key associated with the signed request. # clearAllSessions() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-clear-all-sessions Clears all sessions and resets the active session state.
  • This function removes all session data from the client and persistent storage, including all associated key pairs.
  • Iterates through all stored session keys, clearing each session and deleting its corresponding API key pair.
  • After clearing, there will be no active session, and all session-related data will be removed from local storage.
  • Throws an error if no sessions exist or if there is an error during the clearing process.

Package: core

Defined in: **clients**/core.ts:4743

No parameters.

A successful response returns the following fields: A promise that resolves when all sessions are successfully cleared. # clearSession() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-clear-session Clears the session associated with the specified session key, or the active session by default.
  • This function deletes the session and its associated key pair from storage.
  • If a sessionKey is provided, it will clear the session under that key; otherwise, it will clear the default (active) session.
  • Removes the session data from local storage and deletes the corresponding API key pair from the key store.
  • Throws an error if the session does not exist or if there is an error during the clearing process.

Package: core

Defined in: **clients**/core.ts:4708

session key to clear the session under (defaults to the default session key). A successful response returns the following fields: A promise that resolves when the session is successfully cleared. # clearUnusedKeyPairs() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-clear-unused-key-pairs Clears any unused API key pairs from persistent storage.
  • This function scans all API key pairs stored in indexedDB and removes any key pairs that are not associated with a session in persistent storage.
  • Ensures that only key pairs referenced by existing sessions are retained, preventing orphaned or stale key pairs from accumulating.
  • Iterates through all stored session keys and builds a map of in-use public keys, then deletes any key pairs not present in this map.
  • Intended to be called after session changes (e.g., login, logout, session replacement) to keep key storage clean and secure.

Package: core

Defined in: **clients**/core.ts:4969

No parameters.

A successful response returns the following fields: A promise that resolves when all unused key pairs are successfully cleared. # completeOauth() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-complete-oauth Completes the OAuth authentication flow by either signing up or logging in the user, depending on whether a sub-organization already exists for the provided OIDC token.
  • This function first checks if there is an existing sub-organization associated with the OIDC token.
  • If a sub-organization exists, it proceeds with the OAuth login flow.
  • If no sub-organization exists, it creates a new sub-organization and completes the sign-up flow.
  • Optionally accepts a custom OAuth provider name, session key, and additional sub-organization creation parameters.
  • Handles session storage and management, and supports invalidating existing sessions if specified.

Package: core

Defined in: **clients**/core.ts:1678

parameters for sub-organization creation (e.g., authenticators, user metadata). list of api keys list of authenticators custom wallets to create during sub-org creation time list of wallet accounts to create name of the wallet created list of oauth providers name of the sub-organization email of the user name of the user phone number of the user tag of the user verification token if email or phone number is provided flag to invalidate existing sessions for the user. OIDC token received after successful authentication with the OAuth provider. name of the OAuth provider (defaults to a generated name with a timestamp). public key to use for authentication. Must be generated prior to calling this function, this is because the OIDC nonce has to be set to `sha256(publicKey)`. session key to use for session creation (defaults to the default session key). A successful response returns the following fields: A promise that resolves to an object containing: * `sessionToken`: the signed JWT session token. * `action`: whether the flow resulted in a login or signup (AuthAction). # completeOtp() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-complete-otp Completes the OTP authentication flow by verifying the OTP code and then either signing up or logging in the user.
  • This function first verifies the OTP code for the provided contact and OTP type.
  • If the contact is not associated with an existing sub-organization, it will automatically create a new sub-organization and complete the sign-up flow.
  • If the contact is already associated with a sub-organization, it will complete the login flow.
  • Supports passing a custom public key for authentication, invalidating existing session, specifying a session key, and providing additional sub-organization creation parameters.
  • Handles both email and SMS OTP types.

Package: core

Defined in: **clients**/core.ts:1586

contact information for the user (e.g., email address or phone number). parameters for sub-organization creation (e.g., authenticators, user metadata). list of api keys list of authenticators custom wallets to create during sub-org creation time list of wallet accounts to create name of the wallet created list of oauth providers name of the sub-organization email of the user name of the user phone number of the user tag of the user verification token if email or phone number is provided flag to invalidate existing sessions for the user. OTP code entered by the user. ID of the OTP to complete (returned from `initOtp`). type of OTP being completed (OtpType.Email or OtpType.Sms). public key to use for authentication. If not provided, a new key pair may be generated. session key to use for session creation (defaults to the default session key). A successful response returns the following fields: A promise that resolves to an object containing: * `sessionToken`: the signed JWT session token. * `verificationToken`: the OTP verification token. * `action`: whether the flow resulted in a login or signup (AuthAction). # connectWalletAccount() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-connect-wallet-account Connects the specified wallet account.
  • Requires the wallet manager and its connector to be initialized.

Package: core

Defined in: **clients**/core.ts:687

wallet provider to connect. A successful response returns the following fields: A promise that resolves with the connected wallet's address. # constructor() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-constructor

Package: core

Defined in: **clients**/core.ts:195

base URL for the Turnkey API. ID for the auth proxy configuration. URL for the auth proxy. default stamper to be used for all requests ID of the organization. configuration for the passkey stamper. list of credentials to pass. Defaults to empty. optional extensions. Defaults to empty. The RPID ("Relying Party ID") for your app. This is automatically determined in web environments based on the current hostname. See [https://github.com/f-23/react-native-passkey?tab=readme-ov-file#configuration](https://github.com/f-23/react-native-passkey?tab=readme-ov-file#configuration) to set this up for react-native. name for the Relying Party (RP). This is used in the passkey creation flow on mobile. timeout value in milliseconds. Defaults to 5 minutes. override for UV flag. Defaults to "preferred". option to force platform passkeys on native platforms. option to force security passkeys on native platforms. configuration for the wallet manager. chains to support in the wallet manager. features to enable in the wallet manager. configuration for WalletConnect. A successful response returns the following fields: # createApiKeyPair() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-create-api-key-pair Creates a new API key pair and returns the public key.
  • This function generates a new API key pair and stores it in the underlying key store (IndexedDB).
  • If an external key pair is provided, it will use that key pair for creation instead of generating a new one.
  • If `storeOverride` is set to true, the generated or provided public key will be set as the override key in the API key stamper, making it the active key for subsequent signing operations.
  • Ensures the API key stamper is initialized before proceeding.
  • Handles both native CryptoKeyPair objects and raw key material.

Package: core

Defined in: **clients**/core.ts:5021

An externally generated key pair (either a CryptoKeyPair or an object with publicKey/privateKey strings) to use instead of generating a new one. If true, sets the generated or provided public key as the override key in the API key stamper (defaults to false). A successful response returns the following fields: A promise that resolves to the public key of the created or provided API key pair as a string. # createHttpClient() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-create-http-client Creates a new TurnkeySDKClientBase instance with the provided configuration. This method is used internally to create the HTTP client for making API requests, but can also be used to create an additional client with different configurations if needed. By default, it uses the configuration provided during the TurnkeyClient initialization.

Package: core

Defined in: **clients**/core.ts:272

Optional configuration parameters to override the default client configuration. The base URL of the Turnkey API (defaults to `https://api.turnkey.com` if not provided). The configuration ID to use when making Auth Proxy requests. The base URL of the Auth Proxy (defaults to `https://authproxy.turnkey.com` if not provided). The default stamper type to use for signing requests (overrides automatic detection of ApiKey, Passkey, or Wallet stampers). The organization ID to associate requests with. A successful response returns the following fields: A new instance of TurnkeySDKClientBase configured with the provided parameters. # createPasskey() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-create-passkey Creates a new passkey authenticator for the user.
  • This function generates a new passkey attestation and challenge, suitable for registration with the user's device.
  • Handles both web and React Native environments, automatically selecting the appropriate passkey creation flow.
  • The resulting attestation and challenge can be used to register the passkey with Turnkey.

Package: core

Defined in: **clients**/core.ts:311

challenge string to use for passkey registration. If not provided, a new challenge will be generated. display name for the passkey (defaults to a generated name based on the current timestamp). A successful response returns the following fields: A promise that resolves to CreatePasskeyResult attestation object returned from the passkey creation process encoded challenge string used for passkey registration # createWallet() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-create-wallet Creates a new wallet for sub-organization.
  • This function creates a new wallet for the current sub-organization.
  • If an organizationId is provided, the wallet will be created under that specific sub-organization; otherwise, it uses the current session's organizationId.
  • If a list of address formats is provided, accounts will be created in the wallet based on those formats (starting from path index 0).
  • If a list of account parameters is provided, those accounts will be created in the wallet.
  • If no accounts or address formats are provided, default Ethereum and Solana accounts will be created.
  • Optionally allows specifying the mnemonic length for the wallet seed phrase (defaults to 12).
  • Optionally allows stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).

Package: core

Defined in: **clients**/core.ts:4103

array of account parameters or address formats to create in the wallet. mnemonic length for the wallet seed phrase (defaults to 12). organization ID to create the wallet under a specific sub-organization (defaults to the current session's organizationId). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). name of the wallet to create. A successful response returns the following fields: A promise that resolves to the ID of the newly created wallet. # createWalletAccounts() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-create-wallet-accounts Creates new accounts in the specified wallet.
  • This function creates new wallet accounts based on the provided account parameters or address formats.
  • If a walletId is provided, it creates the accounts in that specific wallet; otherwise, it uses the current session's wallet.
  • If a list of address formats is provided, it will create accounts in the wallet based on those formats, automatically determining the next available path indexes to avoid duplicates with existing accounts.
  • If account parameters are provided, they are used directly for account creation.
  • Automatically queries existing wallet accounts to prevent duplicate account creation for the same address format and path.
  • Supports stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).

Package: core

Defined in: **clients**/core.ts:4180

An array of account parameters or address formats to create in the wallet. organization ID to create the accounts under a specific organization (walletId must be associated with the sub-organization). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). ID of the wallet to create accounts in. A successful response returns the following fields: A promise that resolves to an array of addresses for the newly created accounts. # deleteSubOrganization() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-delete-sub-organization Deletes the current sub-organization (sub-org) for the active session.
  • This function deletes the sub-organization associated with the current active session.
  • By default, the deletion will fail if any wallets associated with the sub-organization have not been exported.
  • If `deleteWithoutExport` is set to true, the sub-organization will be deleted even if its wallets have not been exported (potentially resulting in loss of access to those wallets).
  • Requires an active session; otherwise, an error is thrown.
  • Optionally allows stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).

Package: core

Defined in: **clients**/core.ts:4634

flag to delete the sub-organization without requiring all wallets to be exported first (defaults to false). organization ID to delete a specific sub-organization (defaults to the current session's organizationId). parameter to stamp the request with a specific stamper. A successful response returns the following fields: A promise that resolves to a `TDeleteSubOrganizationResponse` object containing the result of the deletion. # disconnectWalletAccount() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-disconnect-wallet-account Disconnects the specified wallet account.
  • Requires the wallet manager and its connector to be initialized.

Package: core

Defined in: **clients**/core.ts:730

wallet provider to disconnect. A successful response returns the following fields: A promise that resolves once the wallet account is disconnected. # ethSendErc20Transfer() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-eth-send-erc20-transfer
  • **API subject to change**
Signs and submits an ERC20 `transfer(address,uint256)` as an Ethereum transaction using a Turnkey-managed (embedded) wallet. This is a convenience wrapper around `ethSendTransaction`:
  • Encodes ERC20 transfer calldata.
  • Sends a transaction to the token contract.
  • Returns a `sendTransactionStatusId` for polling with `pollTransactionStatus`.

Package: core

Defined in: **clients**/core.ts:2711

Organization ID to execute the transaction under. Defaults to the active session's organization. Optional stamper to authorize signing (e.g., passkey). ERC20 transfer parameters. A successful response returns the following fields: A promise resolving to the `sendTransactionStatusId`. # ethSendTransaction() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-eth-send-transaction
  • **API subject to change**
Signs and submits an Ethereum transaction using a Turnkey-managed (embedded) wallet. This method performs **authorization and signing**, and submits the transaction to Turnkey’s coordinator. It **does not perform any polling** — callers must use `pollTransactionStatus` to obtain the final on-chain result. Behavior:
  • **Connected wallets**
  • Connected wallets are **not supported** by this method.
  • They must instead use `signAndSendTransaction`.
  • **Embedded wallets**
  • Constructs the payload for Turnkey's `eth_send_transaction` endpoint.
  • Forwards transaction fields directly to Turnkey's coordinator.
  • Signs and submits the transaction through Turnkey.
  • Returns a `sendTransactionStatusId`, which the caller must pass to
`pollTransactionStatus` to obtain the final result (tx hash + status).

Package: core

Defined in: **clients**/core.ts:2808

Organization ID to execute the transaction under. Defaults to the active session's organization. Optional stamper to authorize signing (e.g., passkey). The Ethereum transaction details. A successful response returns the following fields: A promise resolving to the `sendTransactionStatusId`. This ID must be passed to `pollTransactionStatus`. # exportPrivateKey() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-export-private-key Exports a private key as an encrypted bundle.
  • This function exports the specified private key as an encrypted bundle, suitable for backup or transfer.
  • The exported bundle contains the private key's key material, encrypted to the provided target public key.
  • If a targetPublicKey is provided, the bundle will be encrypted to that public key; otherwise, an error will be thrown.
  • If an organizationId is provided, the private key will be exported under that sub-organization; otherwise, the current session's organizationId is used.
  • Optionally allows stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).

Package: core

Defined in: **clients**/core.ts:4329

organization ID to export the private key under a specific sub ID of the private key to export. parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). public key to encrypt the bundle to (required). A successful response returns the following fields: A promise that resolves to an `ExportBundle` object containing the encrypted private key and metadata. # exportWallet() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-export-wallet Exports a wallet as an encrypted bundle.
  • This function exports the specified wallet and its accounts as an encrypted bundle, suitable for backup or transfer.
  • The exported bundle contains the wallet's seed phrase, encrypted to the provided target public key.
  • If a targetPublicKey is provided, the bundle will be encrypted to that public key; otherwise, an error will be thrown.
  • If an organizationId is provided, the wallet will be exported under that sub-organization; otherwise, the current session's organizationId is used.
  • Optionally allows stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).
  • The exported bundle can later be imported using the `importWallet` method.

Package: core

Defined in: **clients**/core.ts:4266

organization ID to export the wallet under a specific sub-organization (walletId must be associated with the sub-organization). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). public key to encrypt the bundle to (required). ID of the wallet to export. A successful response returns the following fields: A promise that resolves to an `ExportBundle` object containing the encrypted wallet seed phrase and metadata. # exportWalletAccount() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-export-wallet-account Exports a wallet account as an encrypted bundle.
  • This function exports the specified wallet account as an encrypted bundle, suitable for backup or transfer.
  • The exported bundle contains the wallet account's key material, encrypted to the provided target public key.
  • If a targetPublicKey is provided, the bundle will be encrypted to that public key; otherwise, an error will be thrown.
  • If an organizationId is provided, the wallet account will be exported under that sub-organization; otherwise, the current session's organizationId is used.
  • Optionally allows stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).

Package: core

Defined in: **clients**/core.ts:4394

address of the wallet account to export. organization ID to export the wallet account under a specific sub-organization. parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). public key to encrypt the bundle to. A successful response returns the following fields: A promise that resolves to an `ExportBundle` object containing the encrypted wallet account and metadata. # fetchBootProofForAppProof() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-fetch-boot-proof-for-app-proof Fetches the boot proof for a given app proof.
  • This function is idempotent: multiple calls with the same `app proof` will always return the boot proof.
  • Attempts to find the boot proof for the given app proof.
  • If a boot proof is found, it is returned as is.
  • If no boot proof is found, an error is thrown.

Package: core

Defined in: **clients**/core.ts:5098

the app proof for which the boot proof is being fetched. organization ID to specify the sub-organization (defaults to the current session's organizationId). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). A successful response returns the following fields: A promise that resolves to the v1BootProof associated with the given app proof. # fetchOrCreateP256ApiKeyUser() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-fetch-or-create-p256-api-key-user Fetches an existing user by P-256 API key public key, or creates a new one if none exists.
  • This function is idempotent: multiple calls with the same `publicKey` will always return the same user.
  • Attempts to find a user whose API keys include the given P-256 public key.
  • If a matching user is found, it is returned as-is.
  • If no matching user is found, a new user is created with the given public key as a P-256 API key.

Package: core

Defined in: **clients**/core.ts:3163

organization ID to specify the sub-organization (defaults to the current session's organizationId). the P-256 public key to use for lookup and creation. parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). A successful response returns the following fields: A promise that resolves to the existing or newly created v1User. # fetchOrCreatePolicies() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-fetch-or-create-policies Fetches each requested policy if it exists, or creates it if it does not.
  • This function is idempotent: multiple calls with the same policies will not create duplicates.
  • For every policy in the request:
  • If it already exists, it is returned with its `policyId`.
  • If it does not exist, it is created and returned with its new `policyId`.

Package: core

Defined in: **clients**/core.ts:3297

organization ID to specify the sub-organization (defaults to the current session's organizationId). the list of policies to fetch or create. parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). A successful response returns the following fields: A promise that resolves to an array of objects, each containing: * `policyId`: the unique identifier of the policy. * `policyName`: human-readable name of the policy. * `effect`: the instruction to DENY or ALLOW an activity. * `condition`: (optional) the condition expression that triggers the effect. * `consensus`: (optional) the consensus expression that triggers the effect. * `notes`: (optional) developer notes or description for the policy. # fetchPrivateKeys() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-fetch-private-keys Fetches all private keys for the current user.
  • Retrieves private keys from the Turnkey API.
  • Supports stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).

Package: core

Defined in: **clients**/core.ts:2327

organization ID to target (defaults to the session's organization ID). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). A successful response returns the following fields: A promise that resolves to an array of `v1PrivateKey` objects. # fetchUser() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-fetch-user Fetches the user details for the current session or a specified user.
  • Retrieves user details from the Turnkey API using the provided userId and organizationId, or defaults to those from the active session.
  • If no userId is provided, the userId from the current session is used.
  • If no organizationId is provided, the organizationId from the current session is used.
  • Optionally allows stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).
  • Ensures that an active session exists before making the request.

Package: core

Defined in: **clients**/core.ts:3097

organization ID to specify the sub-organization (defaults to the current session's organizationId). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). user ID to fetch specific user details (defaults to the current session's userId). A successful response returns the following fields: A promise that resolves to a `v1User` object containing the user details. # fetchWalletAccounts() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-fetch-wallet-accounts Fetches all accounts for a specific wallet, including both embedded and connected wallet accounts.
  • For embedded wallets, retrieves accounts from the Turnkey API, supporting pagination (defaults to the first page with a limit of 100 accounts).
  • For connected wallets (e.g., browser extensions or external providers), constructs account objects for each connected address from the provided or discovered wallet providers.
  • Automatically determines the account type and populates relevant fields such as address, curve, and signing capability.
  • Optionally allows filtering by a specific set of wallet providers and supports custom pagination options.
  • Supports stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).

Package: core

Defined in: **clients**/core.ts:2133

optional authenticator addresses to avoid redundant user fetches (this is used for connected wallets to determine if a connected wallet is an authenticator) organization ID to target (defaults to the session's organization ID). pagination options for embedded wallets. parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). user ID to target (defaults to the session's user ID). wallet for which to fetch accounts. list of wallet providers to filter by (used for connected wallets). A successful response returns the following fields: A promise that resolves to an array of `v1WalletAccount` objects. # fetchWalletProviders() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-fetch-wallet-providers Retrieves wallet providers from the initialized wallet manager.
  • Optionally filters providers by the specified blockchain chain.
  • Throws an error if the wallet manager is not initialized.

Package: core

Defined in: **clients**/core.ts:659

optional blockchain chain to filter the returned providers. A successful response returns the following fields: A promise that resolves to an array of wallet providers. # fetchWallets() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-fetch-wallets Fetches all wallets for the current user, including both embedded and connected wallets.
  • Retrieves all wallets associated with the organizationId from the current active session.
  • For each embedded wallet, automatically fetches and attaches all associated wallet accounts.
  • For connected wallets (e.g., browser extensions or external providers), groups providers by wallet name and attaches all connected accounts.
  • Returns both embedded and connected wallets in a single array, each with their respective accounts populated.
  • Optionally allows stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).

Package: core

Defined in: **clients**/core.ts:1925

if true, fetches only connected wallets; if false or undefined, fetches both embedded and connected wallets. organization ID to target (defaults to the session's organization ID). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). user ID to target (defaults to the session's user ID). array of wallet providers to use for fetching wallets. A successful response returns the following fields: A promise that resolves to an array of `Wallet` objects. # getActiveSessionKey() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-get-active-session-key Retrieves the active session key currently set in persistent storage.
  • This function fetches the session key that is currently marked as active in the client's persistent storage.
  • The active session key determines which session is used for all session-dependent operations.
  • If no active session key is set, returns `undefined`.
  • Useful for determining which session is currently in use, especially when managing multiple sessions.

Package: core

Defined in: **clients**/core.ts:4946

No parameters.

A successful response returns the following fields: A promise that resolves to the active session key as a string, or `undefined` if no active session is set. # getAllSessions() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-get-all-sessions Retrieves all sessions stored in persistent storage.
  • This function fetches all session objects currently stored by the client, including those that are not active.
  • Returns a record mapping each session key to its corresponding `Session` object.
  • Useful for session management, auditing, or displaying all available sessions to the user.
  • Automatically skips any session keys that do not have a valid session object.

Package: core

Defined in: **clients**/core.ts:4887

No parameters.

A successful response returns the following fields: A promise that resolves to a record of session keys and their corresponding `Session` objects, or `undefined` if no sessions exist. # getProxyAuthConfig() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-get-proxy-auth-config Fetches the WalletKit proxy authentication configuration from the auth proxy.
  • This function makes a request to the Turnkey auth proxy to retrieve the current WalletKit configuration,
including supported authentication methods, OAuth providers, and any custom proxy settings.
  • Useful for dynamically configuring the client UI or authentication flows based on the proxy's capabilities.
  • Ensures that the client is aware of the latest proxy-side configuration, which may affect available login/signup options.

Package: core

Defined in: **clients**/core.ts:5063

No parameters.

A successful response returns the following fields: A promise that resolves to a `ProxyTGetWalletKitConfigResponse` object containing the proxy authentication configuration. # getSession() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-get-session Retrieves the session associated with the specified session key, or the active session by default.
  • This function retrieves the session object from storage, using the provided session key or, if not specified, the current active session key.
  • If no session key is provided and there is no active session, it returns undefined.
  • Returns the session details, including public key, organization ID, user ID, and expiration.

Package: core

Defined in: **clients**/core.ts:4860

session key to retrieve a specific session (defaults to the current active session key). A successful response returns the following fields: A promise that resolves to a `Session` object containing the session details, or undefined if not found. # importPrivateKey() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-import-private-key Imports a private key from an encrypted bundle.
  • This function imports a private key using the provided encrypted bundle.
  • If a userId is provided, the private key will be imported for that specific user; otherwise, it uses the current session's userId.
  • Requires address formats to
  • Automatically infers the cryptographic curve used to generate the private key based on the address format (can be optionally overriden if needed).
  • The encrypted bundle MUST be encrypted to ensure security.
  • Automatically ensures an active session exists before making the request.
  • Optionally allows stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).

Package: core

Defined in: **clients**/core.ts:4550

the cryptographic curve used to generate a given private key encrypted bundle containing the private key key material and metadata. organization ID to import the private key under a specific sub-organization (private key will be associated with the sub-organization). name of the private key to create upon import. parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). user ID to import the wallet for a specific user (defaults to the current session's userId). A successful response returns the following fields: A promise that resolves to the ID of the imported wallet. # importWallet() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-import-wallet Imports a wallet from an encrypted bundle.
  • This function imports a wallet using the provided encrypted bundle and creates accounts based on the provided parameters.
  • If a userId is provided, the wallet will be imported for that specific user; otherwise, it uses the current session's userId.
  • If an accounts array is provided, those accounts will be created in the imported wallet; otherwise, default Ethereum and Solana accounts will be created.
  • The encrypted bundle MUST be encrypted to
  • Automatically ensures an active session exists before making the request.
  • Optionally allows stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).

Package: core

Defined in: **clients**/core.ts:4461

array of account parameters to create in the imported wallet (defaults to standard Ethereum and Solana accounts). encrypted bundle containing the wallet seed phrase and metadata. organization ID to import the wallet under a specific sub-organization (wallet will be associated with the sub-organization). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). user ID to import the wallet for a specific user (defaults to the current session's userId). name of the wallet to create upon import. A successful response returns the following fields: A promise that resolves to the ID of the imported wallet. # init() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-init

Package: core

Defined in: **clients**/core.ts:213

No parameters.

A successful response returns the following fields: # initOtp() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-init-otp Initializes the OTP process by sending an OTP code to the provided contact.
  • This function initiates the OTP flow by sending a one-time password (OTP) code to the user's contact information (email address or phone number) via the auth proxy.
  • Supports both email and SMS OTP types.
  • Returns an OTP ID that is required for subsequent OTP verification.

Package: core

Defined in: **clients**/core.ts:1224

contact information for the user (e.g., email address or phone number). type of OTP to initialize (OtpType.Email or OtpType.Sms). A successful response returns the following fields: A promise that resolves to the OTP ID required for verification. # loginOrSignupWithWallet() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-login-or-signup-with-wallet Logs in an existing user or signs up a new user using a wallet, creating a new sub-organization if needed.
  • This function attempts to log in the user by stamping a login request with the provided wallet.
  • If the wallet’s public key is not associated with an existing sub-organization, a new one is created.
  • Handles both wallet authentication and sub-organization creation in a single flow.
  • For Ethereum wallets, derives the public key from the signed request header; for Solana wallets, retrieves it directly from the wallet.
  • Optionally accepts additional sub-organization parameters, a custom session key, and a custom session expiration.
  • Stores the resulting session token under the specified session key, or the default session key if not provided.

Package: core

Defined in: **clients**/core.ts:1117

optional parameters for creating a sub-organization (e.g., authenticators, user metadata). list of api keys list of authenticators custom wallets to create during sub-org creation time list of wallet accounts to create name of the wallet created list of oauth providers name of the sub-organization email of the user name of the user phone number of the user tag of the user verification token if email or phone number is provided session expiration time in seconds (defaults to the configured default). optional public key to associate with the session (generated if not provided). session key to use for storing the session (defaults to the default session key). wallet provider to use for authentication. A successful response returns the following fields: A promise that resolves to an object containing: * `sessionToken`: the signed JWT session token. * `address`: the authenticated wallet address. * `action`: whether the flow resulted in a login or signup (AuthAction). # loginWithOauth() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-login-with-oauth Logs in a user using OAuth authentication.
  • This function logs in a user using the provided OIDC token and public key.
  • Optionally invalidates any existing sessions for the user if `invalidateExisting` is set to true.
  • Stores the resulting session token under the specified session key, or the default session key if not provided.
  • Handles cleanup of unused key pairs if login fails.

Package: core

Defined in: **clients**/core.ts:1763

flag to invalidate existing sessions for the user. OIDC token received after successful authentication with the OAuth provider. ID of the organization to target when creating the session. The public key bound to the login session. This key is required because it is directly tied to the nonce used during OIDC token generation and must match the value encoded in the token. session key to use for session creation (defaults to the default session key). A successful response returns the following fields: A promise that resolves to a BaseAuthResult, which includes: * `sessionToken`: the signed JWT session token. # loginWithOtp() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-login-with-otp Logs in a user using an OTP verification token.
  • This function logs in a user using the verification token received after OTP verification (from email or SMS).
  • If a public key is not provided, a new API key pair will be generated for authentication.
  • Optionally invalidates any existing sessions for the user if `invalidateExisting` is set to true.
  • Stores the resulting session token under the specified session key, or the default session key if not provided.
  • Handles cleanup of unused key pairs if login fails.

Package: core

Defined in: **clients**/core.ts:1339

flag to invalidate existing session for the user. optional organization ID to target (defaults to the verified subOrg ID linked to the verification token contact). public key to use for authentication. If not provided, a new key pair will be generated. session key to use for session creation (defaults to the default session key). verification token received after OTP verification. A successful response returns the following fields: A promise that resolves to a BaseAuthResult, which includes: * `sessionToken`: the signed JWT session token. # loginWithPasskey() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-login-with-passkey Logs in a user using a passkey, optionally specifying the public key, session key, and session expiration.
  • This function initiates the login process with a passkey and handles session creation and storage.
  • If a public key is not provided, a new key pair will be generated for authentication.
  • If a session key is not provided, the default session key will be used.
  • The session expiration can be customized via the expirationSeconds parameter.
  • Handles cleanup of unused key pairs if login fails.

Package: core

Defined in: **clients**/core.ts:445

session expiration time in seconds (defaults to the configured default). organization ID to target (defaults to the session's organization ID or the parent organization ID). public key to use for authentication. If not provided, a new key pair will be generated. session key to use for session creation (defaults to the default session key). A successful response returns the following fields: A promise that resolves to a PasskeyAuthResult, which includes: * `sessionToken`: the signed JWT session token. * `credentialId`: an empty string. # loginWithWallet() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-login-with-wallet Logs in a user using the specified wallet provider.
  • This function logs in a user by authenticating with the provided wallet provider via a wallet-based signature.
  • If a public key is not provided, a new one will be generated for authentication.
  • Optionally accepts a custom session key and session expiration time.
  • Stores the resulting session token under the specified session key, or the default session key if not provided.
  • Throws an error if a public key cannot be found or generated, or if the login process fails.

Package: core

Defined in: **clients**/core.ts:962

optional session expiration time in seconds (defaults to the configured default). organization ID to target (defaults to the session's organization ID or the parent organization ID). optional public key to associate with the session (generated if not provided). optional key to store the session under (defaults to the default session key). wallet provider to use for authentication. A successful response returns the following fields: A promise that resolves to a WalletAuthResult, which includes: * `sessionToken`: the signed JWT session token. * `address`: the authenticated wallet address. # logout() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-logout Logs out the current client session.
  • This function clears the specified session and removes any associated key pairs from storage.
  • If a sessionKey is provided, it logs out from that session; otherwise, it logs out from the active session.
  • Cleans up any api keys associated with the session.

Package: core

Defined in: **clients**/core.ts:397

session key to specify which session to log out from (defaults to the active session). A successful response returns the following fields: A promise that resolves when the logout process is complete. # pollTransactionStatus() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-poll-transaction-status **API subject to change** Polls Turnkey for the final result of a previously submitted transaction. This function repeatedly calls `getSendTransactionStatus` until the transaction reaches a terminal state. Terminal states:
  • **COMPLETED** or **INCLUDED** → resolves with chain-specific transaction details
  • **FAILED** rejects with an error
Behavior:
  • Queries Turnkey every 500ms.
  • Stops polling automatically when a terminal state is reached.
  • Returns the full status payload from Turnkey.
  • When available, Ethereum transaction details are exposed at `resp.eth.txHash`.

Package: core

Defined in: **clients**/core.ts:3014

Organization ID under which the transaction was submitted. Optional polling interval in milliseconds (default: 500ms). Status ID returned by `ethSendTransaction` or `solSendTransaction`. Optional stamper to use for polling. A successful response returns the following fields: A promise resolving to the transaction status payload if successful. # refreshSession() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-refresh-session Refreshes the session associated with the specified session key, or the active session by default.
  • This function refreshes the session and updates the session token and key pair associated with the given session key.
  • If a sessionKey is provided, it will refresh the session under that key; otherwise, it will use the current active session key.
  • Optionally allows specifying a new expiration time for the session, a custom public key, and whether to invalidate the existing session after refreshing.
  • Makes a request to the Turnkey API to stamp a new login and stores the refreshed session token.
  • Automatically manages key pair cleanup and session storage to ensure consistency.
  • Optionally allows stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).

Package: core

Defined in: **clients**/core.ts:4777

expiration time in seconds for the refreshed session (defaults to the configured default). flag to invalidate the existing session before refreshing (defaults to false). public key to use for the refreshed session (if not provided, a new key pair will be generated). session key to refresh the session under (defaults to the active session key). parameter to stamp the request with a specific stamper. A successful response returns the following fields: A promise that resolves to a `TStampLoginResponse` object containing the refreshed session details. # removeOauthProviders() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-remove-oauth-providers Removes a list of OAuth providers from the user.
  • This function removes OAuth providers (e.g., Google, Apple) from the user's account.
  • If a userId is provided, it removes the providers for that specific user; otherwise, it uses the current session's userId.
  • Automatically ensures an active session exists before making the request.
  • Optionally allows stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).
  • Returns an array of remaining provider IDs associated with the user after removal.

Package: core

Defined in: **clients**/core.ts:3905

organization ID to specify the sub-organization (defaults to the current session's organizationId). IDs of the OAuth providers to remove. parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). user ID to remove the provider for a specific user (defaults to the current session's userId). A successful response returns the following fields: A promise that resolves to an array of provider IDs that were removed. # removePasskeys() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-remove-passkeys Removes passkeys (authenticator) from the user.
  • This function removes passkeys (WebAuthn/FIDO2 authenticators) from the user's account.
  • If a userId is provided, it removes the passkeys for that specific user; otherwise, it uses the current session's userId.
  • Automatically ensures an active session exists before making the request.
  • Optionally allows stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).
  • Returns an array of remaining authenticator IDs for the user after removal.

Package: core

Defined in: **clients**/core.ts:4039

IDs of the authenticators (passkeys) to remove. organization ID to specify the sub-organization (defaults to the current session's organizationId). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). user ID to remove the passkeys for a specific user (defaults to the current session's userId). A successful response returns the following fields: A promise that resolves to an array of authenticator IDs that were removed. # removeUserEmail() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-remove-user-email Removes the user's email address.
  • This function removes the user's email address by setting it to an empty string.
  • If a userId is provided, it removes the email for that specific user; otherwise, it uses the current session's userId.
  • Automatically ensures an active session exists before making the request.
  • Optionally allows stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).

Package: core

Defined in: **clients**/core.ts:3498

organization ID to specify the sub-organization (defaults to the current session's organizationId). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). user ID to remove a specific user's email address (defaults to the current session's userId). A successful response returns the following fields: A promise that resolves to the userId of the user whose email was removed. # removeUserPhoneNumber() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-remove-user-phone-number Removes the user's phone number.
  • This function removes the user's phone number by setting it to an empty string.
  • If a userId is provided, it removes the phone number for that specific user; otherwise, it uses the current session's userId.
  • Automatically ensures an active session exists before making the request.
  • Optionally allows stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).

Package: core

Defined in: **clients**/core.ts:3635

organization ID to specify the sub-organization (defaults to the current session's organizationId). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). user ID to remove a specific user's phone number (defaults to the current session's userId). A successful response returns the following fields: A promise that resolves to the userId of the user whose phone number was removed. # setActiveSession() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-set-active-session Sets the active session to the specified session key.
  • This function updates the `activeSessionKey` in persistent storage to the specified session key.
  • Ensures that subsequent operations use the session associated with this key as the active session.
  • Does not validate whether the session key exists or is valid; it simply updates the pointer.
  • Useful for switching between multiple stored sessions or restoring a previous session context.

Package: core

Defined in: **clients**/core.ts:4922

session key to set as the active session. A successful response returns the following fields: A promise that resolves when the active session key is successfully set. # signAndSendTransaction() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-sign-and-send-transaction Signs and broadcasts a transaction using the specified wallet account. Behavior differs depending on the type of wallet:
  • **Connected wallets**
  • *Ethereum*: delegates to the wallet’s native `signAndSendTransaction` method.
  • Does **not** require an `rpcUrl` (the wallet handles broadcasting).
  • *Solana*: signs the transaction locally with the connected wallet, but requires an `rpcUrl` to broadcast it.
  • Other chains: not supported; will throw an error.
  • **Embedded wallets**
  • Signs the transaction using the Turnkey API.
  • Requires an `rpcUrl` to broadcast the signed transaction, since Turnkey does not broadcast directly.
  • Broadcasts the transaction using a JSON-RPC client and returns the resulting transaction hash/signature.
  • Optionally allows stamping with a specific stamper (`StamperType.Passkey`, `StamperType.ApiKey`, or `StamperType.Wallet`).

Package: core

Defined in: **clients**/core.ts:2601

**Only for Turnkey embedded wallets**: organization ID to target (defaults to the session's organization ID). JSON-RPC endpoint used for broadcasting (required for Solana connected wallets and all embedded wallets). optional stamper to use when signing (`StamperType.Passkey`, `StamperType.ApiKey`, or `StamperType.Wallet`). type of transaction (e.g., `"TRANSACTION_TYPE_SOLANA"`, `"TRANSACTION_TYPE_ETHEREUM"`). unsigned transaction data as a serialized string in the canonical encoding for the given `transactionType`. wallet account to use for signing and broadcasting. A successful response returns the following fields: A promise that resolves to a transaction signature or hash. # signMessage() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-sign-message Signs a message using the specified wallet account. Behavior differs depending on the wallet type:
  • **Connected wallets**
  • Delegates signing to the wallet provider’s native signing method.
  • *Ethereum*: signatures always follow [EIP-191](https://eips.ethereum.org/EIPS/eip-191).
  • The wallet automatically prefixes messages with
`"\x19Ethereum Signed Message:\n" + message length` before signing.
  • As a result, these signatures cannot be used as raw transaction signatures or broadcast on-chain.
  • If `addEthereumPrefix` is set to `false`, an error is thrown because connected Ethereum wallets always prefix.
  • *Other chains*: follows the native connected wallet behavior.
  • **Embedded wallets**
  • Uses the Turnkey API to sign the message directly.
  • Supports optional `addEthereumPrefix`:
  • If `true` (default for Ethereum), the message is prefixed before signing.
  • If `false`, the raw message is signed without any prefix.
Additional details:
  • Automatically handles encoding and hashing based on the wallet account’s address format,
unless explicitly overridden.
  • Optionally allows stamping with a specific stamper
(`StamperType.Passkey`, `StamperType.ApiKey`, or `StamperType.Wallet`).

Package: core

Defined in: **clients**/core.ts:2406

whether to prefix the message with Ethereum’s `"\x19Ethereum Signed Message:\n"` string (default: `true` for Ethereum). override for payload encoding (defaults to the encoding appropriate for the address format). override for hash function (defaults to the function appropriate for the address format). plaintext (UTF-8) message to sign. organization ID to target (defaults to the session's organization ID). optional stamper for the signing request. wallet account to use for signing. A successful response returns the following fields: A promise that resolves to a `v1SignRawPayloadResult` containing the signature and metadata. # signTransaction() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-sign-transaction Signs a transaction using the specified wallet account. Behavior differs depending on the type of wallet:
  • **Connected wallets**
  • Ethereum: does not support raw transaction signing. Calling this function will throw an error instructing you to use `signAndSendTransaction` instead.
  • Solana: supports raw transaction signing via the connected wallet provider.
  • Other chains: not supported; will throw an error.
  • **Embedded wallets**
  • Delegates signing to the Turnkey API, which returns the signed transaction.
  • Supports all Turnkey-supported transaction types (e.g., Ethereum, Solana, Tron).
  • Optionally allows stamping with a specific stamper (`StamperType.Passkey`, `StamperType.ApiKey`, or `StamperType.Wallet`).
  • Note: For embedded Ethereum wallets, the returned signature doesn’t include the `0x` prefix. You should add `0x` before
broadcasting if it’s missing. It’s a good idea to check whether the signature already starts with `0x` before adding it, since we plan to include the prefix by default in a future breaking change.

Package: core

Defined in: **clients**/core.ts:2518

organization ID to target (defaults to the session's organization ID). stamper to use for signing (`StamperType.Passkey`, `StamperType.ApiKey`, or `StamperType.Wallet`). type of transaction (e.g., "TRANSACTION\_TYPE\_ETHEREUM", "TRANSACTION\_TYPE\_SOLANA", "TRANSACTION\_TYPE\_TRON"). unsigned transaction data as a serialized string in the canonical encoding for the given `transactionType`. wallet account to use for signing. A successful response returns the following fields: A promise that resolves to the signed transaction string. # signUpWithOauth() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-sign-up-with-oauth Signs up a user using OAuth authentication.
  • This function creates a new sub-organization for the user using the provided OIDC token, public key, and provider name.
  • Handles the full OAuth sign-up flow, including sub-organization creation and session management.
  • Optionally accepts additional sub-organization creation parameters and a custom session key.
  • After successful sign-up, automatically logs in the user and returns a signed JWT session token.

Package: core

Defined in: **clients**/core.ts:1856

parameters for sub-organization creation (e.g., authenticators, user metadata). list of api keys list of authenticators custom wallets to create during sub-org creation time list of wallet accounts to create name of the wallet created list of oauth providers name of the sub-organization email of the user name of the user phone number of the user tag of the user verification token if email or phone number is provided OIDC token received after successful authentication with the OAuth provider. name of the OAuth provider (e.g., "Google", "Apple"). public key to associate with the new sub-organization. session key to use for session creation (defaults to the default session key). A successful response returns the following fields: A promise that resolves to a BaseAuthResult, which includes: * `sessionToken`: the signed JWT session token. # signUpWithOtp() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-sign-up-with-otp Signs up a user using an OTP verification token.
  • This function signs up a user using the verification token received after OTP verification (from email or SMS).
  • Creates a new sub-organization for the user with the provided parameters and associates the contact (email or phone) with the sub-organization.
  • Automatically generates a new API key pair for authentication and session management.
  • Stores the resulting session token under the specified session key, or the default session key if not provided.
  • Handles both email and SMS OTP types, and supports additional sub-organization creation parameters.

Package: core

Defined in: **clients**/core.ts:1455

contact information for the user (e.g., email address or phone number). parameters for creating a sub-organization (e.g., authenticators, user metadata). list of api keys list of authenticators custom wallets to create during sub-org creation time list of wallet accounts to create name of the wallet created list of oauth providers name of the sub-organization email of the user name of the user phone number of the user tag of the user verification token if email or phone number is provided flag to invalidate existing session for the user. type of OTP being used (OtpType.Email or OtpType.Sms). session key to use for session creation (defaults to the default session key). verification token received after OTP verification. A successful response returns the following fields: A promise that resolves to a BaseAuthResult, which includes: * `sessionToken`: the signed JWT session token. # signUpWithPasskey() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-sign-up-with-passkey Signs up a user using a passkey, creating a new sub-organization and session.
  • This function creates a new passkey authenticator and uses it to register a new sub-organization for the user.
  • Handles both passkey creation and sub-organization creation in a single flow.
  • Optionally accepts additional sub-organization parameters, a custom session key, a custom passkey display name, and a custom session expiration.
  • Automatically generates a new API key pair for authentication and session management.
  • Stores the resulting session token and manages cleanup of unused key pairs.

Package: core

Defined in: **clients**/core.ts:538

challenge string to use for passkey registration. If not provided, a new challenge will be generated. parameters for creating a sub-organization (e.g., authenticators, user metadata). list of api keys list of authenticators custom wallets to create during sub-org creation time list of wallet accounts to create name of the wallet created list of oauth providers name of the sub-organization email of the user name of the user phone number of the user tag of the user verification token if email or phone number is provided session expiration time in seconds (defaults to the configured default). organization ID to target (defaults to the session's organization ID or the parent organization ID). display name for the passkey (defaults to a generated name based on the current timestamp). session key to use for storing the session (defaults to the default session key). A successful response returns the following fields: A promise that resolves to a PasskeyAuthResult, which includes: * `sessionToken`: the signed JWT session token. * `credentialId`: the credential ID associated with the passkey created. # signUpWithWallet() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-sign-up-with-wallet Signs up a user using a wallet, creating a new sub-organization and session.
  • This function creates a new wallet authenticator and uses it to register a new sub-organization for the user.
  • Handles both wallet authentication and sub-organization creation in a single flow.
  • Optionally accepts additional sub-organization parameters, a custom session key, and a custom session expiration.
  • Automatically generates additional API key pairs for authentication and session management.
  • Stores the resulting session token under the specified session key, or the default session key if not provided, and manages cleanup of unused key pairs.

Package: core

Defined in: **clients**/core.ts:1025

parameters for creating a sub-organization (e.g., authenticators, user metadata). list of api keys list of authenticators custom wallets to create during sub-org creation time list of wallet accounts to create name of the wallet created list of oauth providers name of the sub-organization email of the user name of the user phone number of the user tag of the user verification token if email or phone number is provided session expiration time in seconds (defaults to the configured default). session key to use for storing the session (defaults to the default session key). wallet provider to use for authentication. A successful response returns the following fields: A promise that resolves to a WalletAuthResult, which includes: * `sessionToken`: the signed JWT session token. * `address`: the authenticated wallet address. # solSendTransaction() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-sol-send-transaction
  • **API subject to change**
Signs and submits a Solana transaction using a Turnkey-managed (embedded) wallet. This method performs **authorization and signing**, and submits the transaction to Turnkey’s coordinator. It **does not perform any polling** — callers must use `pollTransactionStatus` to obtain the final on-chain result. Behavior:
  • **Connected wallets**
  • Connected wallets are **not supported** by this method.
  • They must instead use `signAndSendTransaction`.
  • **Embedded wallets**
  • Constructs the payload for Turnkey's `sol_send_transaction` endpoint.
  • Signs and submits the transaction through Turnkey.
  • Returns a `sendTransactionStatusId`, which the caller must pass to
`pollTransactionStatus` to obtain the final result (signature + status).

Package: core

Defined in: **clients**/core.ts:2924

Organization ID to execute the transaction under. Defaults to the active session's organization. Optional stamper to authorize signing (e.g., passkey). The Solana transaction details. A successful response returns the following fields: A promise resolving to the `sendTransactionStatusId`. This ID must be passed to `pollTransactionStatus`. # storeSession() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-store-session Stores a session token and updates the session associated with the specified session key, or by default the active session.
  • This function parses and stores a signed JWT session token in local storage, associating it with the given session key.
  • If a sessionKey is provided, the session will be stored under that key; otherwise, it will use the default session key.
  • If a session already exists for the session key, its associated key pair will be deleted before storing the new session.
  • After storing the session, any unused key pairs are automatically cleared from storage.
  • Ensures that session management is consistent and prevents orphaned key pairs.

Package: core

Defined in: **clients**/core.ts:4678

session key to store the session under (defaults to the default session key). JWT session token to store. A successful response returns the following fields: A promise that resolves when the session is successfully stored. # switchWalletAccountChain() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-switch-wallet-account-chain Switches the wallet provider associated with a given wallet account to a different chain.
  • Requires the wallet manager and its connector to be initialized
  • Only works for connected wallet accounts
  • Looks up the provider for the given account address
  • Does nothing if the provider is already on the desired chain.

Package: core

Defined in: **clients**/core.ts:767

The target chain, specified as a chain ID string or a SwitchableChain object. The wallet account whose provider should be switched. Optional list of wallet providers to search; falls back to `fetchWalletProviders()` if omitted. A successful response returns the following fields: A promise that resolves once the chain switch is complete. # updateUserEmail() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-update-user-email Updates the user's email address.
  • This function updates the user's email address and, if provided, verifies it using a verification token (typically from an OTP flow).
  • If a userId is provided, it updates the email for that specific user; otherwise, it uses the current session's userId.
  • If a verificationToken is not provided, the email will be updated but will not be marked as verified.
  • Automatically ensures an active session exists before making the request.
  • Handles session management and error reporting for both update and verification flows.

Package: core

Defined in: **clients**/core.ts:3421

new email address to set for the user. organization ID to specify the sub-organization (defaults to the current session's organizationId). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). user ID to update a specific user's email (defaults to the current session's userId). verification token from OTP email verification (required if verifying the email). A successful response returns the following fields: A promise that resolves to the userId of the updated user. # updateUserName() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-update-user-name Updates the user's name.
  • This function updates the user's display name.
  • If a userId is provided, it updates the name for that specific user; otherwise, it uses the current session's userId.
  • Automatically ensures an active session exists before making the request.
  • Optionally allows stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).
  • Handles session management and error reporting for the update flow.

Package: core

Defined in: **clients**/core.ts:3694

organization ID to specify the sub-organization (defaults to the current session's organizationId). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). user ID to update a specific user's name (defaults to the current session's userId). new name to set for the user. A successful response returns the following fields: A promise that resolves to the userId of the updated user. # updateUserPhoneNumber() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-update-user-phone-number Updates the user's phone number.
  • This function updates the user's phone number and, if provided, verifies it using a verification token (from an OTP flow).
  • If a userId is provided, it updates the phone number for that specific user; otherwise, it uses the current session's userId.
  • If a verificationToken is not provided, the phone number will be updated but will not be marked as verified.
  • Automatically ensures an active session exists before making the request.
  • Handles session management and error reporting for both update and verification flows.

Package: core

Defined in: **clients**/core.ts:3556

organization ID to specify the sub-organization (defaults to the current session's organizationId). new phone number to set for the user. parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). user ID to update a specific user's phone number (defaults to the current session's userId). verification token from OTP phone verification (required if verifying the phone number). A successful response returns the following fields: A promise that resolves to the userId of the updated user. # verifyAppProofs() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-verify-app-proofs Verifies a list of app proofs against their corresponding boot proofs.
  • This function iterates through each provided app proof, fetches the corresponding boot proof, and verifies the app proof against the boot proof.
  • If any app proof fails verification, an error is thrown.

Package: core

Defined in: **clients**/core.ts:5165

the app proofs to verify. organization ID to specify the sub-organization (defaults to the current session's organizationId). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). A successful response returns the following fields: A promise that resolves when all app proofs have been successfully verified. # verifyOtp() Source: https://docs.turnkey.com/generated-docs/core/turnkey-client-verify-otp Verifies the OTP code sent to the user.
  • This function verifies the OTP code entered by the user against the OTP sent to their contact information (email or phone) using the auth proxy.
  • If verification is successful, it returns the sub-organization ID associated with the contact (if it exists) and a verification token.
  • The verification token can be used for subsequent login or sign-up flows.
  • Handles both email and SMS OTP types.

Package: core

Defined in: **clients**/core.ts:1270

contact information for the user (e.g., email address or phone number). OTP code entered by the user. ID of the OTP to verify (returned from `initOtp`). type of OTP being verified (OtpType.Email or OtpType.Sms). public key the verification token is bound to for ownership verification (client signature verification during login/signup). This public key is optional; if not provided, a new key pair will be generated. A successful response returns the following fields: A promise that resolves to an object containing: * subOrganizationId: sub-organization ID if the contact is already associated with a sub-organization, or an empty string if not. * verificationToken: verification token to be used for login or sign-up. # addOauthProvider() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-add-oauth-provider

Package: react-native-wallet-kit

Adds an OAuth provider to the user.
  • This function adds an OAuth provider (e.g., Google, Apple) to the user account.
  • If a userId is provided, it adds the provider for that specific user; otherwise, it uses the current session's userId.
  • Automatically checks if an account already exists for the provided OIDC token and prevents duplicate associations.
  • If the user's email is not set or not verified, attempts to update and verify the email using the email from the OIDC token.
  • Handles session management and error reporting for the add provider flow.
  • Optionally allows stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).
OIDC token for the OAuth provider. organization ID to specify the sub-organization (defaults to the current session's organizationId). name of the OAuth provider to add (e.g., "Google", "Apple"). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). user ID to add the provider for a specific user (defaults to current session's userId). A successful response returns the following fields: A promise that resolves to an array of provider IDs associated with the user. # addPasskey() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-add-passkey

Package: react-native-wallet-kit

Adds a new passkey authenticator for the user.
  • This function prompts the user to create a new passkey (WebAuthn/FIDO2) and adds it as an authenticator for the user.
  • Handles both web and React Native environments, automatically selecting the appropriate passkey creation flow.
  • If a userId is provided, the passkey is added for that specific user; otherwise, it uses the current session's userId.
  • The passkey's name and display name can be customized; if not provided, defaults are generated.
  • The resulting passkey attestation and challenge are registered with Turnkey as a new authenticator.
display name of the passkey (defaults to the value of `name`). name of the passkey (defaults to "Turnkey Passkey-`timestamp`"). organization ID to specify the sub-organization (defaults to the current session's organizationId). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). user ID to add the passkey for a specific user (defaults to the current session's userId). A successful response returns the following fields: A promise that resolves to an array of authenticator IDs for the newly added passkey(s). # clearAllSessions() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-clear-all-sessions

Package: react-native-wallet-kit

Clears all sessions and resets the active session state.
  • This function removes all session data from the client and persistent storage, including all associated key pairs.
  • Iterates through all stored session keys, clearing each session and deleting its corresponding API key pair.
  • After clearing, there will be no active session, and all session-related data will be removed from local storage.
  • Throws an error if no sessions exist or if there is an error during the clearing process.

No parameters.

A successful response returns the following fields: A promise that resolves when all sessions are successfully cleared. # clearSession() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-clear-session

Package: react-native-wallet-kit

Clears the session associated with the specified session key, or the active session by default.
  • This function deletes the session and its associated key pair from storage.
  • If a sessionKey is provided, it will clear the session under that key; otherwise, it will clear the default (active) session.
  • Removes the session data from local storage and deletes the corresponding API key pair from the key store.
  • Throws an error if the session does not exist or if there is an error during the clearing process.
session key to clear the session under (defaults to the default session key). A successful response returns the following fields: A promise that resolves when the session is successfully cleared. # clearUnusedKeyPairs() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-clear-unused-key-pairs

Package: react-native-wallet-kit

Clears any unused API key pairs from persistent storage.
  • This function scans all API key pairs stored in indexedDB and removes any key pairs that are not associated with a session in persistent storage.
  • Ensures that only key pairs referenced by existing sessions are retained, preventing orphaned or stale key pairs from accumulating.
  • Iterates through all stored session keys and builds a map of in-use public keys, then deletes any key pairs not present in this map.
  • Intended to be called after session changes (e.g., login, logout, session replacement) to keep key storage clean and secure.

No parameters.

A successful response returns the following fields: A promise that resolves when all unused key pairs are successfully cleared. # completeOauth() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-complete-oauth

Package: react-native-wallet-kit

Completes the OAuth authentication flow by either signing up or logging in the user, depending on whether a sub-organization already exists for the provided OIDC token.
  • This function first checks if there is an existing sub-organization associated with the OIDC token.
  • If a sub-organization exists, it proceeds with the OAuth login flow.
  • If no sub-organization exists, it creates a new sub-organization and completes the sign-up flow.
  • Optionally accepts a custom OAuth provider name, session key, and additional sub-organization creation parameters.
  • Handles session storage and management, and supports invalidating existing sessions if specified.
parameters for sub-organization creation (e.g., authenticators, user metadata). flag to invalidate existing sessions for the user. OIDC token received after successful authentication with the OAuth provider. name of the OAuth provider (defaults to a generated name with a timestamp). public key to use for authentication. Must be generated prior to calling this function, this is because the OIDC nonce has to be set to `sha256(publicKey)`. session key to use for session creation (defaults to the default session key). A successful response returns the following fields: A promise that resolves to an object containing: * `sessionToken`: the signed JWT session token. * `action`: whether the flow resulted in a login or signup (AuthAction). # completeOtp() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-complete-otp

Package: react-native-wallet-kit

Completes the OTP authentication flow by verifying the OTP code and then either signing up or logging in the user.
  • This function first verifies the OTP code for the provided contact and OTP type.
  • If the contact is not associated with an existing sub-organization, it will automatically create a new sub-organization and complete the sign-up flow.
  • If the contact is already associated with a sub-organization, it will complete the login flow.
  • Supports passing a custom public key for authentication, invalidating existing session, specifying a session key, and providing additional sub-organization creation parameters.
  • Handles both email and SMS OTP types.
contact information for the user (e.g., email address or phone number). parameters for sub-organization creation (e.g., authenticators, user metadata). flag to invalidate existing sessions for the user. OTP code entered by the user. ID of the OTP to complete (returned from `initOtp`). type of OTP being completed (OtpType.Email or OtpType.Sms). public key to use for authentication. If not provided, a new key pair may be generated. session key to use for session creation (defaults to the default session key). A successful response returns the following fields: A promise that resolves to an object containing: * `sessionToken`: the signed JWT session token. * `verificationToken`: the OTP verification token. * `action`: whether the flow resulted in a login or signup (AuthAction). # createApiKeyPair() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-create-api-key-pair

Package: react-native-wallet-kit

Creates a new API key pair and returns the public key.
  • This function generates a new API key pair and stores it in the underlying key store (IndexedDB).
  • If an external key pair is provided, it will use that key pair for creation instead of generating a new one.
  • If `storeOverride` is set to true, the generated or provided public key will be set as the override key in the API key stamper, making it the active key for subsequent signing operations.
  • Ensures the API key stamper is initialized before proceeding.
  • Handles both native CryptoKeyPair objects and raw key material.
An externally generated key pair (either a CryptoKeyPair or an object with publicKey/privateKey strings) to use instead of generating a new one. If true, sets the generated or provided public key as the override key in the API key stamper (defaults to false). A successful response returns the following fields: A promise that resolves to the public key of the created or provided API key pair as a string. # createHttpClient() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-create-http-client

Package: react-native-wallet-kit

Creates a new TurnkeySDKClientBase instance with the provided configuration. This method is used internally to create the HTTP client for making API requests, but can also be used to create an additional client with different configurations if needed. By default, it uses the configuration provided during the TurnkeyClient initialization. Optional configuration parameters to override the default client configuration. A successful response returns the following fields: A new instance of TurnkeySDKClientBase configured with the provided parameters. # createPasskey() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-create-passkey

Package: react-native-wallet-kit

Creates a new passkey authenticator for the user.
  • This function generates a new passkey attestation and challenge, suitable for registration with the user's device.
  • Handles both web and React Native environments, automatically selecting the appropriate passkey creation flow.
  • The resulting attestation and challenge can be used to register the passkey with Turnkey.
challenge string to use for passkey registration. If not provided, a new challenge will be generated. display name for the passkey (defaults to a generated name based on the current timestamp). A successful response returns the following fields: A promise that resolves to CreatePasskeyResult attestation object returned from the passkey creation process encoded challenge string used for passkey registration # createWallet() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-create-wallet

Package: react-native-wallet-kit

Creates a new wallet for sub-organization.
  • This function creates a new wallet for the current sub-organization.
  • If an organizationId is provided, the wallet will be created under that specific sub-organization; otherwise, it uses the current session's organizationId.
  • If a list of address formats is provided, accounts will be created in the wallet based on those formats (starting from path index 0).
  • If a list of account parameters is provided, those accounts will be created in the wallet.
  • If no accounts or address formats are provided, default Ethereum and Solana accounts will be created.
  • Optionally allows specifying the mnemonic length for the wallet seed phrase (defaults to 12).
  • Optionally allows stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).
array of account parameters or address formats to create in the wallet. mnemonic length for the wallet seed phrase (defaults to 12). organization ID to create the wallet under a specific sub-organization (defaults to the current session's organizationId). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). name of the wallet to create. A successful response returns the following fields: A promise that resolves to the ID of the newly created wallet. # createWalletAccounts() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-create-wallet-accounts

Package: react-native-wallet-kit

Creates new accounts in the specified wallet.
  • This function creates new wallet accounts based on the provided account parameters or address formats.
  • If a walletId is provided, it creates the accounts in that specific wallet; otherwise, it uses the current session's wallet.
  • If a list of address formats is provided, it will create accounts in the wallet based on those formats, automatically determining the next available path indexes to avoid duplicates with existing accounts.
  • If account parameters are provided, they are used directly for account creation.
  • Automatically queries existing wallet accounts to prevent duplicate account creation for the same address format and path.
  • Supports stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).
An array of account parameters or address formats to create in the wallet. organization ID to create the accounts under a specific organization (walletId must be associated with the sub-organization). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). ID of the wallet to create accounts in. A successful response returns the following fields: A promise that resolves to an array of addresses for the newly created accounts. # deleteSubOrganization() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-delete-sub-organization

Package: react-native-wallet-kit

Deletes the current sub-organization (sub-org) for the active session.
  • This function deletes the sub-organization associated with the current active session.
  • By default, the deletion will fail if any wallets associated with the sub-organization have not been exported.
  • If `deleteWithoutExport` is set to true, the sub-organization will be deleted even if its wallets have not been exported (potentially resulting in loss of access to those wallets).
  • Requires an active session; otherwise, an error is thrown.
  • Optionally allows stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).
flag to delete the sub-organization without requiring all wallets to be exported first (defaults to false). organization ID to delete a specific sub-organization (defaults to the current session's organizationId). parameter to stamp the request with a specific stamper. A successful response returns the following fields: A promise that resolves to a `TDeleteSubOrganizationResponse` object containing the result of the deletion. # ethSendErc20Transfer() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-eth-send-erc20-transfer

Package: react-native-wallet-kit

  • **API subject to change**
Signs and submits an ERC20 `transfer(address,uint256)` as an Ethereum transaction using a Turnkey-managed (embedded) wallet. This is a convenience wrapper around `ethSendTransaction`:
  • Encodes ERC20 transfer calldata.
  • Sends a transaction to the token contract.
  • Returns a `sendTransactionStatusId` for polling with `pollTransactionStatus`.
A successful response returns the following fields: A promise resolving to the `sendTransactionStatusId`. # ethSendTransaction() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-eth-send-transaction

Package: react-native-wallet-kit

  • **API subject to change**
Signs and submits an Ethereum transaction using a Turnkey-managed (embedded) wallet. This method performs **authorization and signing**, and submits the transaction to Turnkey’s coordinator. It **does not perform any polling** — callers must use `pollTransactionStatus` to obtain the final on-chain result. Behavior:
  • **Connected wallets**
  • Connected wallets are **not supported** by this method.
  • They must instead use `signAndSendTransaction`.
  • **Embedded wallets**
  • Constructs the payload for Turnkey's `eth_send_transaction` endpoint.
  • Forwards transaction fields directly to Turnkey's coordinator.
  • Signs and submits the transaction through Turnkey.
  • Returns a `sendTransactionStatusId`, which the caller must pass to
`pollTransactionStatus` to obtain the final result (tx hash + status). Organization ID to execute the transaction under. Defaults to the active session's organization. Optional stamper to authorize signing (e.g., passkey). The Ethereum transaction details. A successful response returns the following fields: A promise resolving to the `sendTransactionStatusId`. This ID must be passed to `pollTransactionStatus`. # fetchBootProofForAppProof() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-fetch-boot-proof-for-app-proof

Package: react-native-wallet-kit

Fetches the boot proof for a given app proof.
  • This function is idempotent: multiple calls with the same `app proof` will always return the boot proof.
  • Attempts to find the boot proof for the given app proof.
  • If a boot proof is found, it is returned as is.
  • If no boot proof is found, an error is thrown.
A successful response returns the following fields: A promise that resolves to the v1BootProof associated with the given app proof. # fetchOrCreateP256ApiKeyUser() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-fetch-or-create-p256-api-key-user

Package: react-native-wallet-kit

Fetches an existing user by P-256 API key public key, or creates a new one if none exists.
  • This function is idempotent: multiple calls with the same `publicKey` will always return the same user.
  • Attempts to find a user whose API keys include the given P-256 public key.
  • If a matching user is found, it is returned as-is.
  • If no matching user is found, a new user is created with the given public key as a P-256 API key.
organization ID to specify the sub-organization (defaults to the current session's organizationId). the P-256 public key to use for lookup and creation. parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). A successful response returns the following fields: A promise that resolves to the existing or newly created v1User. # fetchOrCreatePolicies() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-fetch-or-create-policies

Package: react-native-wallet-kit

Fetches each requested policy if it exists, or creates it if it does not.
  • This function is idempotent: multiple calls with the same policies will not create duplicates.
  • For every policy in the request:
  • If it already exists, it is returned with its `policyId`.
  • If it does not exist, it is created and returned with its new `policyId`.
organization ID to specify the sub-organization (defaults to the current session's organizationId). the list of policies to fetch or create. parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). A successful response returns the following fields: A promise that resolves to an array of objects, each containing: * `policyId`: the unique identifier of the policy. * `policyName`: human-readable name of the policy. * `effect`: the instruction to DENY or ALLOW an activity. * `condition`: (optional) the condition expression that triggers the effect. * `consensus`: (optional) the consensus expression that triggers the effect. * `notes`: (optional) developer notes or description for the policy. # fetchPrivateKeys() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-fetch-private-keys

Package: react-native-wallet-kit

Fetches all private keys for the current user.
  • Retrieves private keys from the Turnkey API.
  • Supports stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).
organization ID to target (defaults to the session's organization ID). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). A successful response returns the following fields: A promise that resolves to an array of `v1PrivateKey` objects. # fetchUser() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-fetch-user

Package: react-native-wallet-kit

Fetches the user details for the current session or a specified user.
  • Retrieves user details from the Turnkey API using the provided userId and organizationId, or defaults to those from the active session.
  • If no userId is provided, the userId from the current session is used.
  • If no organizationId is provided, the organizationId from the current session is used.
  • Optionally allows stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).
  • Ensures that an active session exists before making the request.
organization ID to specify the sub-organization (defaults to the current session's organizationId). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). user ID to fetch specific user details (defaults to the current session's userId). A successful response returns the following fields: A promise that resolves to a `v1User` object containing the user details. # fetchWalletAccounts() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-fetch-wallet-accounts

Package: react-native-wallet-kit

Fetches all accounts for a specific wallet, including both embedded and connected wallet accounts.
  • For embedded wallets, retrieves accounts from the Turnkey API, supporting pagination (defaults to the first page with a limit of 100 accounts).
  • For connected wallets (e.g., browser extensions or external providers), constructs account objects for each connected address from the provided or discovered wallet providers.
  • Automatically determines the account type and populates relevant fields such as address, curve, and signing capability.
  • Optionally allows filtering by a specific set of wallet providers and supports custom pagination options.
  • Supports stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).
optional authenticator addresses to avoid redundant user fetches (this is used for connected wallets to determine if a connected wallet is an authenticator) organization ID to target (defaults to the session's organization ID). pagination options for embedded wallets. parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). user ID to target (defaults to the session's user ID). wallet for which to fetch accounts. list of wallet providers to filter by (used for connected wallets). A successful response returns the following fields: A promise that resolves to an array of `v1WalletAccount` objects. # fetchWallets() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-fetch-wallets

Package: react-native-wallet-kit

Fetches all wallets for the current user, including both embedded and connected wallets.
  • Retrieves all wallets associated with the organizationId from the current active session.
  • For each embedded wallet, automatically fetches and attaches all associated wallet accounts.
  • For connected wallets (e.g., browser extensions or external providers), groups providers by wallet name and attaches all connected accounts.
  • Returns both embedded and connected wallets in a single array, each with their respective accounts populated.
  • Optionally allows stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).
if true, fetches only connected wallets; if false or undefined, fetches both embedded and connected wallets. organization ID to target (defaults to the session's organization ID). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). user ID to target (defaults to the session's user ID). array of wallet providers to use for fetching wallets. A successful response returns the following fields: A promise that resolves to an array of `Wallet` objects. # getActiveSessionKey() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-get-active-session-key

Package: react-native-wallet-kit

Retrieves the active session key currently set in persistent storage.
  • This function fetches the session key that is currently marked as active in the client's persistent storage.
  • The active session key determines which session is used for all session-dependent operations.
  • If no active session key is set, returns `undefined`.
  • Useful for determining which session is currently in use, especially when managing multiple sessions.

No parameters.

A successful response returns the following fields: A promise that resolves to the active session key as a string, or `undefined` if no active session is set. # getAllSessions() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-get-all-sessions

Package: react-native-wallet-kit

Retrieves all sessions stored in persistent storage.
  • This function fetches all session objects currently stored by the client, including those that are not active.
  • Returns a record mapping each session key to its corresponding `Session` object.
  • Useful for session management, auditing, or displaying all available sessions to the user.
  • Automatically skips any session keys that do not have a valid session object.

No parameters.

A successful response returns the following fields: A promise that resolves to a record of session keys and their corresponding `Session` objects, or `undefined` if no sessions exist. # getProxyAuthConfig() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-get-proxy-auth-config

Package: react-native-wallet-kit

Fetches the WalletKit proxy authentication configuration from the auth proxy.
  • This function makes a request to the Turnkey auth proxy to retrieve the current WalletKit configuration,
including supported authentication methods, OAuth providers, and any custom proxy settings.
  • Useful for dynamically configuring the client UI or authentication flows based on the proxy's capabilities.
  • Ensures that the client is aware of the latest proxy-side configuration, which may affect available login/signup options.

No parameters.

A successful response returns the following fields: A promise that resolves to a `ProxyTGetWalletKitConfigResponse` object containing the proxy authentication configuration. # getSession() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-get-session

Package: react-native-wallet-kit

Retrieves the session associated with the specified session key, or the active session by default.
  • This function retrieves the session object from storage, using the provided session key or, if not specified, the current active session key.
  • If no session key is provided and there is no active session, it returns undefined.
  • Returns the session details, including public key, organization ID, user ID, and expiration.
session key to retrieve a specific session (defaults to the current active session key). A successful response returns the following fields: A promise that resolves to a `Session` object containing the session details, or undefined if not found. # handleAppleOauth() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-handle-apple-oauth

Package: react-native-wallet-kit

Defined in: react-native-wallet-kit/src/providers/Types.tsx:307

Handles the Apple OAuth flow.
  • This function initiates the Apple OAuth flow by opening the in-app browser and deep-linking back to the app.
  • On React Native, the flow always uses the in-app browser.
  • Generates a new ephemeral API key pair and uses its public key as the nonce for the OAuth request, ensuring cryptographic binding of the session.
  • Constructs the Apple OAuth URL with all required parameters, including client ID, redirect URI, response type, response mode, nonce, and state.
  • The `state` parameter includes the provider, flow type, public key, and any additional state parameters for tracking or custom logic.
  • The flow resolves when the app is deep-linked back; it rejects if the in-app browser is closed or times out.
  • On successful authentication, the function either calls the provided `onOauthSuccess` callback, triggers the `onOauthRedirect` callback from provider callbacks, or completes the OAuth flow internally by calling `completeOauth`.
  • Handles all error cases, including missing configuration, in-app browser failures, and timeouts, and throws a `TurnkeyError` with appropriate error codes.
Additional key-value pairs to include in the OAuth state parameter for custom tracking or logic. The Apple Client ID to use (defaults to the client ID from configuration). Callback function to handle the successful OAuth response (receives `{ oidcToken, providerName, publicKey }`). onOauthSuccess params: * oidcToken: The OIDC token received from the OAuth flow. * providerName: The name of the OAuth provider ("apple"). * publicKey: The public key used for the OAuth flow. A successful response returns the following fields: A promise that resolves when the OAuth flow is successfully initiated and completed, or rejects on error or timeout. # handleDiscordOauth() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-handle-discord-oauth

Package: react-native-wallet-kit

Defined in: react-native-wallet-kit/src/providers/Types.tsx:227

Handles the Discord OAuth 2.0 flow.
  • This function initiates the OAuth 2.0 PKCE flow with Discord by opening the in-app browser and deep-linking back to the app.
  • On React Native, the flow always uses the in-app browser.
  • Generates a new ephemeral API key pair and uses its public key as part of the state and a cryptographic nonce to bind the OAuth session.
  • Creates a PKCE verifier/challenge pair, storing the verifier in `AsyncStorage` for later use in the token exchange.
  • Constructs the Discord OAuth URL with all required parameters, including client ID, redirect URI, response type, scope, PKCE code challenge, nonce, and state.
  • The `state` parameter encodes the provider name, flow type, ephemeral public key, and any additional key-value pairs provided in `additionalState`.
  • The flow resolves when the app is deep-linked back; it rejects if the in-app browser is closed or times out.
  • On receiving an authorization code, the function exchanges it for an OIDC token via the Turnkey proxy (`proxyOAuth2Authenticate`) using the PKCE verifier, redirect URI, and nonce.
  • On successful authentication, the function either calls the provided `onOauthSuccess` callback, triggers the `onOauthRedirect` callback from provider callbacks, or completes the OAuth flow internally by calling `completeOauth`.
  • Handles error cases such as missing configuration, in-app browser failures, missing PKCE verifier, or Turnkey proxy failures, throwing a `TurnkeyError` with appropriate error codes.
Additional key-value pairs to include in the OAuth state parameter for tracking or custom logic. The Discord Client ID to use (defaults to the client ID from configuration). Callback function to handle the successful OAuth response (receives `{ oidcToken, providerName, publicKey }`). onOauthSuccess params: * oidcToken: The OIDC token issued by Turnkey after exchanging the auth code. * providerName: The name of the OAuth provider ("discord"). * publicKey: The public key used for the OAuth flow. A successful response returns the following fields: A promise that resolves when the OAuth flow is successfully initiated and completed, or rejects on error or timeout. # handleFacebookOauth() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-handle-facebook-oauth

Package: react-native-wallet-kit

Defined in: react-native-wallet-kit/src/providers/Types.tsx:334

Handles the Facebook OAuth flow.
  • This function initiates the Facebook OAuth flow by opening the in-app browser and deep-linking back to the app.
  • On React Native, the flow always uses the in-app browser.
  • Generates a new ephemeral API key pair and uses its public key as the nonce for the OAuth request, ensuring cryptographic binding of the session.
  • Uses PKCE (Proof Key for Code Exchange) for enhanced security, generating a code verifier and challenge for the Facebook OAuth flow.
  • Constructs the Facebook OAuth URL with all required parameters, including client ID, redirect URI, response type, code challenge, nonce, and state.
  • The `state` parameter includes the provider, flow type, public key, and any additional state parameters for tracking or custom logic.
  • The flow resolves when the app is deep-linked back; it rejects if the in-app browser is closed or times out.
  • On successful authentication, the function either calls the provided `onOauthSuccess` callback, triggers the `onOauthRedirect` callback from provider callbacks, or completes the OAuth flow internally by calling `completeOauth`.
  • Handles all error cases, including missing configuration, in-app browser failures, and timeouts, and throws a `TurnkeyError` with appropriate error codes.
Additional key-value pairs to include in the OAuth state parameter for custom tracking or logic. The Facebook Client ID to use (defaults to the client ID from configuration). Callback function to handle the successful OAuth response (receives `{ oidcToken, providerName, publicKey }`). onOauthSuccess params: * oidcToken: The OIDC token received from the OAuth flow. * providerName: The name of the OAuth provider ("facebook"). * publicKey: The public key used for the OAuth flow. A successful response returns the following fields: A promise that resolves when the OAuth flow is successfully initiated and completed, or rejects on error or timeout. # handleGoogleOauth() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-handle-google-oauth

Package: react-native-wallet-kit

Defined in: react-native-wallet-kit/src/providers/Types.tsx:281

Handles the Google OAuth flow.
  • This function initiates the Google OAuth flow by opening the in-app browser and deep-linking back to the app.
  • On React Native, the flow always uses the in-app browser.
  • Generates a new ephemeral API key pair and uses its public key as the nonce for the OAuth request, ensuring cryptographic binding of the session.
  • Constructs the Google OAuth URL with all required parameters, including client ID, redirect URI, response type, scope, nonce, and state.
  • The `state` parameter includes the provider, flow type, public key, and any additional state parameters for tracking or custom logic.
  • The flow resolves when the app is deep-linked back; it rejects if the in-app browser is closed or times out.
  • On successful authentication, the function either calls the provided `onOauthSuccess` callback, triggers the `onOauthRedirect` callback from provider callbacks, or completes the OAuth flow internally by calling `completeOauth`.
  • Handles all error cases, including missing configuration, in-app browser failures, and timeouts, and throws a `TurnkeyError` with appropriate error codes.
Additional key-value pairs to include in the OAuth state parameter for custom tracking or logic. The Google Client ID to use (defaults to the client ID from configuration). Callback function to handle the successful OAuth response (receives `{ oidcToken, providerName, publicKey }`). onOauthSuccess params: * oidcToken: The OIDC token received from the OAuth flow. * providerName: The name of the OAuth provider ("google"). * publicKey: The public key used for the OAuth flow. A successful response returns the following fields: A promise that resolves when the OAuth flow is successfully initiated and completed, or rejects on error or timeout. # handleXOauth() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-handle-xoauth

Package: react-native-wallet-kit

Defined in: react-native-wallet-kit/src/providers/Types.tsx:255

Handles the Twitter (X) OAuth 2.0 flow.
  • This function initiates the OAuth 2.0 PKCE flow with Twitter (X) by opening the in-app browser and deep-linking back to the app.
  • On React Native, the flow always uses the in-app browser.
  • Generates a new ephemeral API key pair and uses its public key as part of the state and a cryptographic nonce to bind the OAuth session.
  • Creates a PKCE verifier/challenge pair, storing the verifier in `AsyncStorage` for later use in the token exchange.
  • Constructs the Twitter (X) OAuth URL with all required parameters, including client ID, redirect URI, response type, scope, PKCE code challenge, nonce, and state.
  • The `state` parameter encodes the provider name, flow type, ephemeral public key, and any additional key-value pairs provided in `additionalState`.
  • The flow resolves when the app is deep-linked back; it rejects if the in-app browser is closed or times out.
  • On receiving an authorization code, the function exchanges it for an OIDC token via the Turnkey proxy (`proxyOAuth2Authenticate`) using the PKCE verifier, redirect URI, and nonce.
  • On successful authentication, the function either calls the provided `onOauthSuccess` callback, triggers the `onOauthRedirect` callback from provider callbacks, or completes the OAuth flow internally by calling `completeOauth`.
  • Handles error cases such as missing configuration, in-app browser failures, missing PKCE verifier, or Turnkey proxy failures, throwing a `TurnkeyError` with appropriate error codes.
Additional key-value pairs to include in the OAuth state parameter for tracking or custom logic. The Twitter (X) Client ID to use (defaults to the client ID from configuration). Callback function to handle the successful OAuth response (receives `{ oidcToken, providerName, publicKey }`). onOauthSuccess params: * oidcToken: The OIDC token issued by Turnkey after exchanging the auth code. * providerName: The name of the OAuth provider ("twitter"). * publicKey: The public key used for the OAuth flow. A successful response returns the following fields: A promise that resolves when the OAuth flow is successfully initiated and completed, or rejects on error or timeout. # initOtp() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-init-otp

Package: react-native-wallet-kit

Initializes the OTP process by sending an OTP code to the provided contact.
  • This function initiates the OTP flow by sending a one-time password (OTP) code to the user's contact information (email address or phone number) via the auth proxy.
  • Supports both email and SMS OTP types.
  • Returns an OTP ID that is required for subsequent OTP verification.
contact information for the user (e.g., email address or phone number). type of OTP to initialize (OtpType.Email or OtpType.Sms). A successful response returns the following fields: A promise that resolves to the OTP ID required for verification. # loginWithOauth() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-login-with-oauth

Package: react-native-wallet-kit

Logs in a user using OAuth authentication.
  • This function logs in a user using the provided OIDC token and public key.
  • Optionally invalidates any existing sessions for the user if `invalidateExisting` is set to true.
  • Stores the resulting session token under the specified session key, or the default session key if not provided.
  • Handles cleanup of unused key pairs if login fails.
flag to invalidate existing sessions for the user. OIDC token received after successful authentication with the OAuth provider. ID of the organization to target when creating the session. The public key bound to the login session. This key is required because it is directly tied to the nonce used during OIDC token generation and must match the value encoded in the token. session key to use for session creation (defaults to the default session key). A successful response returns the following fields: A promise that resolves to a BaseAuthResult, which includes: * `sessionToken`: the signed JWT session token. # loginWithOtp() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-login-with-otp

Package: react-native-wallet-kit

Logs in a user using an OTP verification token.
  • This function logs in a user using the verification token received after OTP verification (from email or SMS).
  • If a public key is not provided, a new API key pair will be generated for authentication.
  • Optionally invalidates any existing sessions for the user if `invalidateExisting` is set to true.
  • Stores the resulting session token under the specified session key, or the default session key if not provided.
  • Handles cleanup of unused key pairs if login fails.
flag to invalidate existing session for the user. optional organization ID to target (defaults to the verified subOrg ID linked to the verification token contact). public key to use for authentication. If not provided, a new key pair will be generated. session key to use for session creation (defaults to the default session key). verification token received after OTP verification. A successful response returns the following fields: A promise that resolves to a BaseAuthResult, which includes: * `sessionToken`: the signed JWT session token. # loginWithPasskey() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-login-with-passkey

Package: react-native-wallet-kit

Logs in a user using a passkey, optionally specifying the public key, session key, and session expiration.
  • This function initiates the login process with a passkey and handles session creation and storage.
  • If a public key is not provided, a new key pair will be generated for authentication.
  • If a session key is not provided, the default session key will be used.
  • The session expiration can be customized via the expirationSeconds parameter.
  • Handles cleanup of unused key pairs if login fails.
session expiration time in seconds (defaults to the configured default). organization ID to target (defaults to the session's organization ID or the parent organization ID). public key to use for authentication. If not provided, a new key pair will be generated. session key to use for session creation (defaults to the default session key). A successful response returns the following fields: A promise that resolves to a PasskeyAuthResult, which includes: * `sessionToken`: the signed JWT session token. * `credentialId`: an empty string. # logout() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-logout

Package: react-native-wallet-kit

Logs out the current client session.
  • This function clears the specified session and removes any associated key pairs from storage.
  • If a sessionKey is provided, it logs out from that session; otherwise, it logs out from the active session.
  • Cleans up any api keys associated with the session.
session key to specify which session to log out from (defaults to the active session). A successful response returns the following fields: A promise that resolves when the logout process is complete. # refreshSession() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-refresh-session

Package: react-native-wallet-kit

Refreshes the session associated with the specified session key, or the active session by default.
  • This function refreshes the session and updates the session token and key pair associated with the given session key.
  • If a sessionKey is provided, it will refresh the session under that key; otherwise, it will use the current active session key.
  • Optionally allows specifying a new expiration time for the session, a custom public key, and whether to invalidate the existing session after refreshing.
  • Makes a request to the Turnkey API to stamp a new login and stores the refreshed session token.
  • Automatically manages key pair cleanup and session storage to ensure consistency.
  • Optionally allows stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).
expiration time in seconds for the refreshed session (defaults to the configured default). flag to invalidate the existing session before refreshing (defaults to false). public key to use for the refreshed session (if not provided, a new key pair will be generated). session key to refresh the session under (defaults to the active session key). parameter to stamp the request with a specific stamper. A successful response returns the following fields: A promise that resolves to a `TStampLoginResponse` object containing the refreshed session details. # refreshUser() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-refresh-user

Package: react-native-wallet-kit

Defined in: react-native-wallet-kit/src/providers/Types.tsx:177

Refreshes the user details.
  • This function fetches the latest user details for the current session (or optionally for a specific user/organization if provided)
and updates the `user` state variable in the provider.
  • If a `stampWith` parameter is provided, it will use that stamper to fetch the user details (supports Passkey, ApiKey, or Wallet stampers).
  • Automatically handles error reporting via the configured callbacks.
  • Typically used after authentication, user profile updates, or linking/unlinking authenticators to ensure the provider state is up to date.
  • If no user is found, the state will not be updated.
parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). A successful response returns the following fields: A promise that resolves when the user details are successfully refreshed and state is updated. # refreshWallets() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-refresh-wallets

Package: react-native-wallet-kit

Defined in: react-native-wallet-kit/src/providers/Types.tsx:197

Refreshes the wallets state for the current user session.
  • This function fetches the latest list of wallets associated with the current session or user,
and updates the `wallets` state variable in the provider.
  • If a `stampWith` parameter is provided, it will use that stamper to fetch the wallets
(supports Passkey, ApiKey, or Wallet stampers for granular authentication control).
  • Automatically handles error reporting via the configured callbacks.
  • Typically used after wallet creation, import, export, account changes, or authentication
to ensure the provider state is up to date.
  • If no wallets are found, the state will be set to an empty array.
parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). A successful response returns the following fields: A promise that resolves when the wallets are successfully refreshed and state is updated. # removeOauthProviders() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-remove-oauth-providers

Package: react-native-wallet-kit

Removes a list of OAuth providers from the user.
  • This function removes OAuth providers (e.g., Google, Apple) from the user's account.
  • If a userId is provided, it removes the providers for that specific user; otherwise, it uses the current session's userId.
  • Automatically ensures an active session exists before making the request.
  • Optionally allows stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).
  • Returns an array of remaining provider IDs associated with the user after removal.
organization ID to specify the sub-organization (defaults to the current session's organizationId). IDs of the OAuth providers to remove. parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). user ID to remove the provider for a specific user (defaults to the current session's userId). A successful response returns the following fields: A promise that resolves to an array of provider IDs that were removed. # removePasskeys() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-remove-passkeys

Package: react-native-wallet-kit

Removes passkeys (authenticator) from the user.
  • This function removes passkeys (WebAuthn/FIDO2 authenticators) from the user's account.
  • If a userId is provided, it removes the passkeys for that specific user; otherwise, it uses the current session's userId.
  • Automatically ensures an active session exists before making the request.
  • Optionally allows stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).
  • Returns an array of remaining authenticator IDs for the user after removal.
IDs of the authenticators (passkeys) to remove. organization ID to specify the sub-organization (defaults to the current session's organizationId). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). user ID to remove the passkeys for a specific user (defaults to the current session's userId). A successful response returns the following fields: A promise that resolves to an array of authenticator IDs that were removed. # removeUserEmail() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-remove-user-email

Package: react-native-wallet-kit

Removes the user's email address.
  • This function removes the user's email address by setting it to an empty string.
  • If a userId is provided, it removes the email for that specific user; otherwise, it uses the current session's userId.
  • Automatically ensures an active session exists before making the request.
  • Optionally allows stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).
organization ID to specify the sub-organization (defaults to the current session's organizationId). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). user ID to remove a specific user's email address (defaults to the current session's userId). A successful response returns the following fields: A promise that resolves to the userId of the user whose email was removed. # removeUserPhoneNumber() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-remove-user-phone-number

Package: react-native-wallet-kit

Removes the user's phone number.
  • This function removes the user's phone number by setting it to an empty string.
  • If a userId is provided, it removes the phone number for that specific user; otherwise, it uses the current session's userId.
  • Automatically ensures an active session exists before making the request.
  • Optionally allows stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).
organization ID to specify the sub-organization (defaults to the current session's organizationId). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). user ID to remove a specific user's phone number (defaults to the current session's userId). A successful response returns the following fields: A promise that resolves to the userId of the user whose phone number was removed. # setActiveSession() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-set-active-session

Package: react-native-wallet-kit

Sets the active session to the specified session key.
  • This function updates the `activeSessionKey` in persistent storage to the specified session key.
  • Ensures that subsequent operations use the session associated with this key as the active session.
  • Does not validate whether the session key exists or is valid; it simply updates the pointer.
  • Useful for switching between multiple stored sessions or restoring a previous session context.
session key to set as the active session. A successful response returns the following fields: A promise that resolves when the active session key is successfully set. # signAndSendTransaction() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-sign-and-send-transaction

Package: react-native-wallet-kit

Signs and broadcasts a transaction using the specified wallet account. Behavior differs depending on the type of wallet:
  • **Connected wallets**
  • *Ethereum*: delegates to the wallet’s native `signAndSendTransaction` method.
  • Does **not** require an `rpcUrl` (the wallet handles broadcasting).
  • *Solana*: signs the transaction locally with the connected wallet, but requires an `rpcUrl` to broadcast it.
  • Other chains: not supported; will throw an error.
  • **Embedded wallets**
  • Signs the transaction using the Turnkey API.
  • Requires an `rpcUrl` to broadcast the signed transaction, since Turnkey does not broadcast directly.
  • Broadcasts the transaction using a JSON-RPC client and returns the resulting transaction hash/signature.
  • Optionally allows stamping with a specific stamper (`StamperType.Passkey`, `StamperType.ApiKey`, or `StamperType.Wallet`).
**Only for Turnkey embedded wallets**: organization ID to target (defaults to the session's organization ID). JSON-RPC endpoint used for broadcasting (required for Solana connected wallets and all embedded wallets). optional stamper to use when signing (`StamperType.Passkey`, `StamperType.ApiKey`, or `StamperType.Wallet`). type of transaction (e.g., `"TRANSACTION_TYPE_SOLANA"`, `"TRANSACTION_TYPE_ETHEREUM"`). unsigned transaction data as a serialized string in the canonical encoding for the given `transactionType`. wallet account to use for signing and broadcasting. A successful response returns the following fields: A promise that resolves to a transaction signature or hash. # signMessage() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-sign-message

Package: react-native-wallet-kit

Signs a message using the specified wallet account. Behavior differs depending on the wallet type:
  • **Connected wallets**
  • Delegates signing to the wallet provider’s native signing method.
  • *Ethereum*: signatures always follow [EIP-191](https://eips.ethereum.org/EIPS/eip-191).
  • The wallet automatically prefixes messages with
`"\x19Ethereum Signed Message:\n" + message length` before signing.
  • As a result, these signatures cannot be used as raw transaction signatures or broadcast on-chain.
  • If `addEthereumPrefix` is set to `false`, an error is thrown because connected Ethereum wallets always prefix.
  • *Other chains*: follows the native connected wallet behavior.
  • **Embedded wallets**
  • Uses the Turnkey API to sign the message directly.
  • Supports optional `addEthereumPrefix`:
  • If `true` (default for Ethereum), the message is prefixed before signing.
  • If `false`, the raw message is signed without any prefix.
Additional details:
  • Automatically handles encoding and hashing based on the wallet account’s address format,
unless explicitly overridden.
  • Optionally allows stamping with a specific stamper
(`StamperType.Passkey`, `StamperType.ApiKey`, or `StamperType.Wallet`). whether to prefix the message with Ethereum’s `"\x19Ethereum Signed Message:\n"` string (default: `true` for Ethereum). override for payload encoding (defaults to the encoding appropriate for the address format). override for hash function (defaults to the function appropriate for the address format). plaintext (UTF-8) message to sign. organization ID to target (defaults to the session's organization ID). optional stamper for the signing request. wallet account to use for signing. A successful response returns the following fields: A promise that resolves to a `v1SignRawPayloadResult` containing the signature and metadata. # signTransaction() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-sign-transaction

Package: react-native-wallet-kit

Signs a transaction using the specified wallet account. Behavior differs depending on the type of wallet:
  • **Connected wallets**
  • Ethereum: does not support raw transaction signing. Calling this function will throw an error instructing you to use `signAndSendTransaction` instead.
  • Solana: supports raw transaction signing via the connected wallet provider.
  • Other chains: not supported; will throw an error.
  • **Embedded wallets**
  • Delegates signing to the Turnkey API, which returns the signed transaction.
  • Supports all Turnkey-supported transaction types (e.g., Ethereum, Solana, Tron).
  • Optionally allows stamping with a specific stamper (`StamperType.Passkey`, `StamperType.ApiKey`, or `StamperType.Wallet`).
  • Note: For embedded Ethereum wallets, the returned signature doesn’t include the `0x` prefix. You should add `0x` before
broadcasting if it’s missing. It’s a good idea to check whether the signature already starts with `0x` before adding it, since we plan to include the prefix by default in a future breaking change. organization ID to target (defaults to the session's organization ID). stamper to use for signing (`StamperType.Passkey`, `StamperType.ApiKey`, or `StamperType.Wallet`). type of transaction (e.g., "TRANSACTION\_TYPE\_ETHEREUM", "TRANSACTION\_TYPE\_SOLANA", "TRANSACTION\_TYPE\_TRON"). unsigned transaction data as a serialized string in the canonical encoding for the given `transactionType`. wallet account to use for signing. A successful response returns the following fields: A promise that resolves to the signed transaction string. # signUpWithOauth() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-sign-up-with-oauth

Package: react-native-wallet-kit

Signs up a user using OAuth authentication.
  • This function creates a new sub-organization for the user using the provided OIDC token, public key, and provider name.
  • Handles the full OAuth sign-up flow, including sub-organization creation and session management.
  • Optionally accepts additional sub-organization creation parameters and a custom session key.
  • After successful sign-up, automatically logs in the user and returns a signed JWT session token.
parameters for sub-organization creation (e.g., authenticators, user metadata). OIDC token received after successful authentication with the OAuth provider. name of the OAuth provider (e.g., "Google", "Apple"). public key to associate with the new sub-organization. session key to use for session creation (defaults to the default session key). A successful response returns the following fields: A promise that resolves to a BaseAuthResult, which includes: * `sessionToken`: the signed JWT session token. # signUpWithOtp() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-sign-up-with-otp

Package: react-native-wallet-kit

Signs up a user using an OTP verification token.
  • This function signs up a user using the verification token received after OTP verification (from email or SMS).
  • Creates a new sub-organization for the user with the provided parameters and associates the contact (email or phone) with the sub-organization.
  • Automatically generates a new API key pair for authentication and session management.
  • Stores the resulting session token under the specified session key, or the default session key if not provided.
  • Handles both email and SMS OTP types, and supports additional sub-organization creation parameters.
contact information for the user (e.g., email address or phone number). parameters for creating a sub-organization (e.g., authenticators, user metadata). flag to invalidate existing session for the user. type of OTP being used (OtpType.Email or OtpType.Sms). session key to use for session creation (defaults to the default session key). verification token received after OTP verification. A successful response returns the following fields: A promise that resolves to a BaseAuthResult, which includes: * `sessionToken`: the signed JWT session token. # signUpWithPasskey() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-sign-up-with-passkey

Package: react-native-wallet-kit

Signs up a user using a passkey, creating a new sub-organization and session.
  • This function creates a new passkey authenticator and uses it to register a new sub-organization for the user.
  • Handles both passkey creation and sub-organization creation in a single flow.
  • Optionally accepts additional sub-organization parameters, a custom session key, a custom passkey display name, and a custom session expiration.
  • Automatically generates a new API key pair for authentication and session management.
  • Stores the resulting session token and manages cleanup of unused key pairs.
challenge string to use for passkey registration. If not provided, a new challenge will be generated. parameters for creating a sub-organization (e.g., authenticators, user metadata). session expiration time in seconds (defaults to the configured default). organization ID to target (defaults to the session's organization ID or the parent organization ID). display name for the passkey (defaults to a generated name based on the current timestamp). session key to use for storing the session (defaults to the default session key). A successful response returns the following fields: A promise that resolves to a PasskeyAuthResult, which includes: * `sessionToken`: the signed JWT session token. * `credentialId`: the credential ID associated with the passkey created. # solSendTransaction() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-sol-send-transaction

Package: react-native-wallet-kit

  • **API subject to change**
Signs and submits a Solana transaction using a Turnkey-managed (embedded) wallet. This method performs **authorization and signing**, and submits the transaction to Turnkey’s coordinator. It **does not perform any polling** — callers must use `pollTransactionStatus` to obtain the final on-chain result. Behavior:
  • **Connected wallets**
  • Connected wallets are **not supported** by this method.
  • They must instead use `signAndSendTransaction`.
  • **Embedded wallets**
  • Constructs the payload for Turnkey's `sol_send_transaction` endpoint.
  • Signs and submits the transaction through Turnkey.
  • Returns a `sendTransactionStatusId`, which the caller must pass to
`pollTransactionStatus` to obtain the final result (signature + status). A successful response returns the following fields: A promise resolving to the `sendTransactionStatusId`. This ID must be passed to `pollTransactionStatus`. # storeSession() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-store-session

Package: react-native-wallet-kit

Stores a session token and updates the session associated with the specified session key, or by default the active session.
  • This function parses and stores a signed JWT session token in local storage, associating it with the given session key.
  • If a sessionKey is provided, the session will be stored under that key; otherwise, it will use the default session key.
  • If a session already exists for the session key, its associated key pair will be deleted before storing the new session.
  • After storing the session, any unused key pairs are automatically cleared from storage.
  • Ensures that session management is consistent and prevents orphaned key pairs.
session key to store the session under (defaults to the default session key). JWT session token to store. A successful response returns the following fields: A promise that resolves when the session is successfully stored. # updateUserEmail() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-update-user-email

Package: react-native-wallet-kit

Updates the user's email address.
  • This function updates the user's email address and, if provided, verifies it using a verification token (typically from an OTP flow).
  • If a userId is provided, it updates the email for that specific user; otherwise, it uses the current session's userId.
  • If a verificationToken is not provided, the email will be updated but will not be marked as verified.
  • Automatically ensures an active session exists before making the request.
  • Handles session management and error reporting for both update and verification flows.
new email address to set for the user. organization ID to specify the sub-organization (defaults to the current session's organizationId). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). user ID to update a specific user's email (defaults to the current session's userId). verification token from OTP email verification (required if verifying the email). A successful response returns the following fields: A promise that resolves to the userId of the updated user. # updateUserName() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-update-user-name

Package: react-native-wallet-kit

Updates the user's name.
  • This function updates the user's display name.
  • If a userId is provided, it updates the name for that specific user; otherwise, it uses the current session's userId.
  • Automatically ensures an active session exists before making the request.
  • Optionally allows stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).
  • Handles session management and error reporting for the update flow.
organization ID to specify the sub-organization (defaults to the current session's organizationId). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). user ID to update a specific user's name (defaults to the current session's userId). new name to set for the user. A successful response returns the following fields: A promise that resolves to the userId of the updated user. # updateUserPhoneNumber() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-update-user-phone-number

Package: react-native-wallet-kit

Updates the user's phone number.
  • This function updates the user's phone number and, if provided, verifies it using a verification token (from an OTP flow).
  • If a userId is provided, it updates the phone number for that specific user; otherwise, it uses the current session's userId.
  • If a verificationToken is not provided, the phone number will be updated but will not be marked as verified.
  • Automatically ensures an active session exists before making the request.
  • Handles session management and error reporting for both update and verification flows.
organization ID to specify the sub-organization (defaults to the current session's organizationId). new phone number to set for the user. parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). user ID to update a specific user's phone number (defaults to the current session's userId). verification token from OTP phone verification (required if verifying the phone number). A successful response returns the following fields: A promise that resolves to the userId of the updated user. # verifyAppProofs() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-verify-app-proofs

Package: react-native-wallet-kit

Verifies a list of app proofs against their corresponding boot proofs.
  • This function iterates through each provided app proof, fetches the corresponding boot proof, and verifies the app proof against the boot proof.
  • If any app proof fails verification, an error is thrown.
A successful response returns the following fields: A promise that resolves when all app proofs have been successfully verified. # verifyOtp() Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/client-context-type-verify-otp

Package: react-native-wallet-kit

Verifies the OTP code sent to the user.
  • This function verifies the OTP code entered by the user against the OTP sent to their contact information (email or phone) using the auth proxy.
  • If verification is successful, it returns the sub-organization ID associated with the contact (if it exists) and a verification token.
  • The verification token can be used for subsequent login or sign-up flows.
  • Handles both email and SMS OTP types.
contact information for the user (e.g., email address or phone number). OTP code entered by the user. ID of the OTP to verify (returned from `initOtp`). type of OTP being verified (OtpType.Email or OtpType.Sms). public key the verification token is bound to for ownership verification (client signature verification during login/signup). This public key is optional; if not provided, a new key pair will be generated. A successful response returns the following fields: A promise that resolves to an object containing: * subOrganizationId: sub-organization ID if the contact is already associated with a sub-organization, or an empty string if not. * verificationToken: verification token to be used for login or sign-up. # TurnkeyProviderConfig Source: https://docs.turnkey.com/generated-docs/react-native-wallet-kit/turnkey-provider-config Configuration for the TurnkeyProvider. This interface extends the TurnkeySDKClientConfig to include additional UI and auth configurations. It is used to initialize the TurnkeyProvider with various options such as colors, dark mode, auth methods, and more. TurnkeyProviderConfig

Package: react-native-wallet-kit

Defined in: react-native-wallet-kit/src/types/base.ts:46

base URL for the Turnkey API. configuration for authentication methods. whether to automatically refresh the session. parameters for creating a sub-organization for each authentication method. parameters for email OTP authentication. parameters for OAuth authentication. parameters for passkey authentication. parameters for SMS OTP authentication. OAuth settings per provider application deep link scheme used to complete OAuth in React Native (e.g., "myapp"). provider enablement/configuration (boolean enables; object configures and enables) shared default redirect URI for OAuth providers one-time password (OTP) settings and enablement OTP alphanumeric mode (proxy controlled if using auth proxy) enable email OTP OTP length (proxy controlled if using auth proxy) enable SMS OTP passkey enablement and options session expiration time in seconds. If using the auth proxy, you must configure this setting through the dashboard. Changing this through the TurnkeyProvider will have no effect. ID for the auth proxy configuration. URL for the auth proxy. whether to automatically fetch the wallet kit config on initialization. whether to automatically refresh managed state variables default stamper type to use for requests that require stamping. ID of the organization. configuration for the passkey stamper. # addOauthProvider() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-add-oauth-provider

Package: react-wallet-kit

Adds an OAuth provider to the user.
  • This function adds an OAuth provider (e.g., Google, Apple) to the user account.
  • If a userId is provided, it adds the provider for that specific user; otherwise, it uses the current session's userId.
  • Automatically checks if an account already exists for the provided OIDC token and prevents duplicate associations.
  • If the user's email is not set or not verified, attempts to update and verify the email using the email from the OIDC token.
  • Handles session management and error reporting for the add provider flow.
  • Optionally allows stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).
OIDC token for the OAuth provider. organization ID to specify the sub-organization (defaults to the current session's organizationId). name of the OAuth provider to add (e.g., "Google", "Apple"). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). user ID to add the provider for a specific user (defaults to current session's userId). A successful response returns the following fields: A promise that resolves to an array of provider IDs associated with the user. # addPasskey() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-add-passkey

Package: react-wallet-kit

Adds a new passkey authenticator for the user.
  • This function prompts the user to create a new passkey (WebAuthn/FIDO2) and adds it as an authenticator for the user.
  • Handles both web and React Native environments, automatically selecting the appropriate passkey creation flow.
  • If a userId is provided, the passkey is added for that specific user; otherwise, it uses the current session's userId.
  • The passkey's name and display name can be customized; if not provided, defaults are generated.
  • The resulting passkey attestation and challenge are registered with Turnkey as a new authenticator.
display name of the passkey (defaults to the value of `name`). name of the passkey (defaults to "Turnkey Passkey-`timestamp`"). organization ID to specify the sub-organization (defaults to the current session's organizationId). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). user ID to add the passkey for a specific user (defaults to the current session's userId). A successful response returns the following fields: A promise that resolves to an array of authenticator IDs for the newly added passkey(s). # buildWalletLoginRequest() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-build-wallet-login-request

Package: react-wallet-kit

Builds and signs a wallet login request without submitting it to Turnkey.
  • This function prepares a signed request for wallet authentication, which can later be used
to log in or sign up a user with Turnkey.
  • It initializes the wallet stamper, ensures a valid session public key (generating one if needed),
and signs the login intent with the connected wallet.
  • For Ethereum wallets, derives the public key from the stamped request header.
  • For Solana wallets, retrieves the public key directly from the connected wallet.
  • The signed request is not sent to Turnkey immediately; it is meant to be used in a subsequent flow
(e.g., `loginOrSignupWithWallet`) where sub-organization existence is verified or created first. A successful response returns the following fields: A promise resolving to an object containing: * `signedRequest`: the signed wallet login request. * `publicKey`: the public key associated with the signed request. # clearAllSessions() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-clear-all-sessions

Package: react-wallet-kit

Clears all sessions and resets the active session state.
  • This function removes all session data from the client and persistent storage, including all associated key pairs.
  • Iterates through all stored session keys, clearing each session and deleting its corresponding API key pair.
  • After clearing, there will be no active session, and all session-related data will be removed from local storage.
  • Throws an error if no sessions exist or if there is an error during the clearing process.

No parameters.

A successful response returns the following fields: A promise that resolves when all sessions are successfully cleared. # clearSession() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-clear-session

Package: react-wallet-kit

Clears the session associated with the specified session key, or the active session by default.
  • This function deletes the session and its associated key pair from storage.
  • If a sessionKey is provided, it will clear the session under that key; otherwise, it will clear the default (active) session.
  • Removes the session data from local storage and deletes the corresponding API key pair from the key store.
  • Throws an error if the session does not exist or if there is an error during the clearing process.
session key to clear the session under (defaults to the default session key). A successful response returns the following fields: A promise that resolves when the session is successfully cleared. # clearUnusedKeyPairs() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-clear-unused-key-pairs

Package: react-wallet-kit

Clears any unused API key pairs from persistent storage.
  • This function scans all API key pairs stored in indexedDB and removes any key pairs that are not associated with a session in persistent storage.
  • Ensures that only key pairs referenced by existing sessions are retained, preventing orphaned or stale key pairs from accumulating.
  • Iterates through all stored session keys and builds a map of in-use public keys, then deletes any key pairs not present in this map.
  • Intended to be called after session changes (e.g., login, logout, session replacement) to keep key storage clean and secure.

No parameters.

A successful response returns the following fields: A promise that resolves when all unused key pairs are successfully cleared. # completeOauth() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-complete-oauth

Package: react-wallet-kit

Completes the OAuth authentication flow by either signing up or logging in the user, depending on whether a sub-organization already exists for the provided OIDC token.
  • This function first checks if there is an existing sub-organization associated with the OIDC token.
  • If a sub-organization exists, it proceeds with the OAuth login flow.
  • If no sub-organization exists, it creates a new sub-organization and completes the sign-up flow.
  • Optionally accepts a custom OAuth provider name, session key, and additional sub-organization creation parameters.
  • Handles session storage and management, and supports invalidating existing sessions if specified.
parameters for sub-organization creation (e.g., authenticators, user metadata). flag to invalidate existing sessions for the user. OIDC token received after successful authentication with the OAuth provider. name of the OAuth provider (defaults to a generated name with a timestamp). public key to use for authentication. Must be generated prior to calling this function, this is because the OIDC nonce has to be set to `sha256(publicKey)`. session key to use for session creation (defaults to the default session key). A successful response returns the following fields: A promise that resolves to an object containing: * `sessionToken`: the signed JWT session token. * `action`: whether the flow resulted in a login or signup (AuthAction). # completeOtp() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-complete-otp

Package: react-wallet-kit

Completes the OTP authentication flow by verifying the OTP code and then either signing up or logging in the user.
  • This function first verifies the OTP code for the provided contact and OTP type.
  • If the contact is not associated with an existing sub-organization, it will automatically create a new sub-organization and complete the sign-up flow.
  • If the contact is already associated with a sub-organization, it will complete the login flow.
  • Supports passing a custom public key for authentication, invalidating existing session, specifying a session key, and providing additional sub-organization creation parameters.
  • Handles both email and SMS OTP types.
contact information for the user (e.g., email address or phone number). parameters for sub-organization creation (e.g., authenticators, user metadata). flag to invalidate existing sessions for the user. OTP code entered by the user. ID of the OTP to complete (returned from `initOtp`). type of OTP being completed (OtpType.Email or OtpType.Sms). public key to use for authentication. If not provided, a new key pair may be generated. session key to use for session creation (defaults to the default session key). A successful response returns the following fields: A promise that resolves to an object containing: * `sessionToken`: the signed JWT session token. * `verificationToken`: the OTP verification token. * `action`: whether the flow resulted in a login or signup (AuthAction). # connectWalletAccount() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-connect-wallet-account

Package: react-wallet-kit

Defined in: react-wallet-kit/src/providers/client/Types.tsx:94

Connects the specified wallet account.
  • Requires the wallet manager and its connector to be initialized.
wallet provider to connect. A successful response returns the following fields: A promise that resolves once the wallet account is connected. # createApiKeyPair() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-create-api-key-pair

Package: react-wallet-kit

Creates a new API key pair and returns the public key.
  • This function generates a new API key pair and stores it in the underlying key store (IndexedDB).
  • If an external key pair is provided, it will use that key pair for creation instead of generating a new one.
  • If `storeOverride` is set to true, the generated or provided public key will be set as the override key in the API key stamper, making it the active key for subsequent signing operations.
  • Ensures the API key stamper is initialized before proceeding.
  • Handles both native CryptoKeyPair objects and raw key material.
An externally generated key pair (either a CryptoKeyPair or an object with publicKey/privateKey strings) to use instead of generating a new one. If true, sets the generated or provided public key as the override key in the API key stamper (defaults to false). A successful response returns the following fields: A promise that resolves to the public key of the created or provided API key pair as a string. # createHttpClient() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-create-http-client

Package: react-wallet-kit

Creates a new TurnkeySDKClientBase instance with the provided configuration. This method is used internally to create the HTTP client for making API requests, but can also be used to create an additional client with different configurations if needed. By default, it uses the configuration provided during the TurnkeyClient initialization. Optional configuration parameters to override the default client configuration. A successful response returns the following fields: A new instance of TurnkeySDKClientBase configured with the provided parameters. # createPasskey() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-create-passkey

Package: react-wallet-kit

Creates a new passkey authenticator for the user.
  • This function generates a new passkey attestation and challenge, suitable for registration with the user's device.
  • Handles both web and React Native environments, automatically selecting the appropriate passkey creation flow.
  • The resulting attestation and challenge can be used to register the passkey with Turnkey.
challenge string to use for passkey registration. If not provided, a new challenge will be generated. display name for the passkey (defaults to a generated name based on the current timestamp). A successful response returns the following fields: A promise that resolves to CreatePasskeyResult attestation object returned from the passkey creation process encoded challenge string used for passkey registration # createWallet() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-create-wallet

Package: react-wallet-kit

Creates a new wallet for sub-organization.
  • This function creates a new wallet for the current sub-organization.
  • If an organizationId is provided, the wallet will be created under that specific sub-organization; otherwise, it uses the current session's organizationId.
  • If a list of address formats is provided, accounts will be created in the wallet based on those formats (starting from path index 0).
  • If a list of account parameters is provided, those accounts will be created in the wallet.
  • If no accounts or address formats are provided, default Ethereum and Solana accounts will be created.
  • Optionally allows specifying the mnemonic length for the wallet seed phrase (defaults to 12).
  • Optionally allows stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).
array of account parameters or address formats to create in the wallet. mnemonic length for the wallet seed phrase (defaults to 12). organization ID to create the wallet under a specific sub-organization (defaults to the current session's organizationId). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). name of the wallet to create. A successful response returns the following fields: A promise that resolves to the ID of the newly created wallet. # createWalletAccounts() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-create-wallet-accounts

Package: react-wallet-kit

Creates new accounts in the specified wallet.
  • This function creates new wallet accounts based on the provided account parameters or address formats.
  • If a walletId is provided, it creates the accounts in that specific wallet; otherwise, it uses the current session's wallet.
  • If a list of address formats is provided, it will create accounts in the wallet based on those formats, automatically determining the next available path indexes to avoid duplicates with existing accounts.
  • If account parameters are provided, they are used directly for account creation.
  • Automatically queries existing wallet accounts to prevent duplicate account creation for the same address format and path.
  • Supports stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).
An array of account parameters or address formats to create in the wallet. organization ID to create the accounts under a specific organization (walletId must be associated with the sub-organization). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). ID of the wallet to create accounts in. A successful response returns the following fields: A promise that resolves to an array of addresses for the newly created accounts. # deleteSubOrganization() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-delete-sub-organization

Package: react-wallet-kit

Deletes the current sub-organization (sub-org) for the active session.
  • This function deletes the sub-organization associated with the current active session.
  • By default, the deletion will fail if any wallets associated with the sub-organization have not been exported.
  • If `deleteWithoutExport` is set to true, the sub-organization will be deleted even if its wallets have not been exported (potentially resulting in loss of access to those wallets).
  • Requires an active session; otherwise, an error is thrown.
  • Optionally allows stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).
flag to delete the sub-organization without requiring all wallets to be exported first (defaults to false). organization ID to delete a specific sub-organization (defaults to the current session's organizationId). parameter to stamp the request with a specific stamper. A successful response returns the following fields: A promise that resolves to a `TDeleteSubOrganizationResponse` object containing the result of the deletion. # disconnectWalletAccount() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-disconnect-wallet-account

Package: react-wallet-kit

Disconnects the specified wallet account.
  • Requires the wallet manager and its connector to be initialized.
wallet provider to disconnect. A successful response returns the following fields: A promise that resolves once the wallet account is disconnected. # ethSendErc20Transfer() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-eth-send-erc20-transfer

Package: react-wallet-kit

  • **API subject to change**
Signs and submits an ERC20 `transfer(address,uint256)` as an Ethereum transaction using a Turnkey-managed (embedded) wallet. This is a convenience wrapper around `ethSendTransaction`:
  • Encodes ERC20 transfer calldata.
  • Sends a transaction to the token contract.
  • Returns a `sendTransactionStatusId` for polling with `pollTransactionStatus`.
A successful response returns the following fields: A promise resolving to the `sendTransactionStatusId`. # ethSendTransaction() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-eth-send-transaction

Package: react-wallet-kit

  • **API subject to change**
Signs and submits an Ethereum transaction using a Turnkey-managed (embedded) wallet. This method performs **authorization and signing**, and submits the transaction to Turnkey’s coordinator. It **does not perform any polling** — callers must use `pollTransactionStatus` to obtain the final on-chain result. Behavior:
  • **Connected wallets**
  • Connected wallets are **not supported** by this method.
  • They must instead use `signAndSendTransaction`.
  • **Embedded wallets**
  • Constructs the payload for Turnkey's `eth_send_transaction` endpoint.
  • Forwards transaction fields directly to Turnkey's coordinator.
  • Signs and submits the transaction through Turnkey.
  • Returns a `sendTransactionStatusId`, which the caller must pass to
`pollTransactionStatus` to obtain the final result (tx hash + status). Organization ID to execute the transaction under. Defaults to the active session's organization. Optional stamper to authorize signing (e.g., passkey). The Ethereum transaction details. A successful response returns the following fields: A promise resolving to the `sendTransactionStatusId`. This ID must be passed to `pollTransactionStatus`. # exportPrivateKey() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-export-private-key

Package: react-wallet-kit

Exports a private key as an encrypted bundle.
  • This function exports the specified private key as an encrypted bundle, suitable for backup or transfer.
  • The exported bundle contains the private key's key material, encrypted to the provided target public key.
  • If a targetPublicKey is provided, the bundle will be encrypted to that public key; otherwise, an error will be thrown.
  • If an organizationId is provided, the private key will be exported under that sub-organization; otherwise, the current session's organizationId is used.
  • Optionally allows stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).
organization ID to export the private key under a specific sub ID of the private key to export. parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). public key to encrypt the bundle to (required). A successful response returns the following fields: A promise that resolves to an `ExportBundle` object containing the encrypted private key and metadata. # exportWallet() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-export-wallet

Package: react-wallet-kit

Exports a wallet as an encrypted bundle.
  • This function exports the specified wallet and its accounts as an encrypted bundle, suitable for backup or transfer.
  • The exported bundle contains the wallet's seed phrase, encrypted to the provided target public key.
  • If a targetPublicKey is provided, the bundle will be encrypted to that public key; otherwise, an error will be thrown.
  • If an organizationId is provided, the wallet will be exported under that sub-organization; otherwise, the current session's organizationId is used.
  • Optionally allows stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).
  • The exported bundle can later be imported using the `importWallet` method.
organization ID to export the wallet under a specific sub-organization (walletId must be associated with the sub-organization). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). public key to encrypt the bundle to (required). ID of the wallet to export. A successful response returns the following fields: A promise that resolves to an `ExportBundle` object containing the encrypted wallet seed phrase and metadata. # exportWalletAccount() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-export-wallet-account

Package: react-wallet-kit

Exports a wallet account as an encrypted bundle.
  • This function exports the specified wallet account as an encrypted bundle, suitable for backup or transfer.
  • The exported bundle contains the wallet account's key material, encrypted to the provided target public key.
  • If a targetPublicKey is provided, the bundle will be encrypted to that public key; otherwise, an error will be thrown.
  • If an organizationId is provided, the wallet account will be exported under that sub-organization; otherwise, the current session's organizationId is used.
  • Optionally allows stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).
address of the wallet account to export. organization ID to export the wallet account under a specific sub-organization. parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). public key to encrypt the bundle to. A successful response returns the following fields: A promise that resolves to an `ExportBundle` object containing the encrypted wallet account and metadata. # fetchBootProofForAppProof() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-fetch-boot-proof-for-app-proof

Package: react-wallet-kit

Fetches the boot proof for a given app proof.
  • This function is idempotent: multiple calls with the same `app proof` will always return the boot proof.
  • Attempts to find the boot proof for the given app proof.
  • If a boot proof is found, it is returned as is.
  • If no boot proof is found, an error is thrown.
A successful response returns the following fields: A promise that resolves to the v1BootProof associated with the given app proof. # fetchOrCreateP256ApiKeyUser() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-fetch-or-create-p256-api-key-user

Package: react-wallet-kit

Fetches an existing user by P-256 API key public key, or creates a new one if none exists.
  • This function is idempotent: multiple calls with the same `publicKey` will always return the same user.
  • Attempts to find a user whose API keys include the given P-256 public key.
  • If a matching user is found, it is returned as-is.
  • If no matching user is found, a new user is created with the given public key as a P-256 API key.
organization ID to specify the sub-organization (defaults to the current session's organizationId). the P-256 public key to use for lookup and creation. parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). A successful response returns the following fields: A promise that resolves to the existing or newly created v1User. # fetchOrCreatePolicies() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-fetch-or-create-policies

Package: react-wallet-kit

Fetches each requested policy if it exists, or creates it if it does not.
  • This function is idempotent: multiple calls with the same policies will not create duplicates.
  • For every policy in the request:
  • If it already exists, it is returned with its `policyId`.
  • If it does not exist, it is created and returned with its new `policyId`.
organization ID to specify the sub-organization (defaults to the current session's organizationId). the list of policies to fetch or create. parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). A successful response returns the following fields: A promise that resolves to an array of objects, each containing: * `policyId`: the unique identifier of the policy. * `policyName`: human-readable name of the policy. * `effect`: the instruction to DENY or ALLOW an activity. * `condition`: (optional) the condition expression that triggers the effect. * `consensus`: (optional) the consensus expression that triggers the effect. * `notes`: (optional) developer notes or description for the policy. # fetchPrivateKeys() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-fetch-private-keys

Package: react-wallet-kit

Fetches all private keys for the current user.
  • Retrieves private keys from the Turnkey API.
  • Supports stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).
organization ID to target (defaults to the session's organization ID). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). A successful response returns the following fields: A promise that resolves to an array of `v1PrivateKey` objects. # fetchUser() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-fetch-user

Package: react-wallet-kit

Fetches the user details for the current session or a specified user.
  • Retrieves user details from the Turnkey API using the provided userId and organizationId, or defaults to those from the active session.
  • If no userId is provided, the userId from the current session is used.
  • If no organizationId is provided, the organizationId from the current session is used.
  • Optionally allows stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).
  • Ensures that an active session exists before making the request.
organization ID to specify the sub-organization (defaults to the current session's organizationId). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). user ID to fetch specific user details (defaults to the current session's userId). A successful response returns the following fields: A promise that resolves to a `v1User` object containing the user details. # fetchWalletAccounts() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-fetch-wallet-accounts

Package: react-wallet-kit

Fetches all accounts for a specific wallet, including both embedded and connected wallet accounts.
  • For embedded wallets, retrieves accounts from the Turnkey API, supporting pagination (defaults to the first page with a limit of 100 accounts).
  • For connected wallets (e.g., browser extensions or external providers), constructs account objects for each connected address from the provided or discovered wallet providers.
  • Automatically determines the account type and populates relevant fields such as address, curve, and signing capability.
  • Optionally allows filtering by a specific set of wallet providers and supports custom pagination options.
  • Supports stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).
optional authenticator addresses to avoid redundant user fetches (this is used for connected wallets to determine if a connected wallet is an authenticator) organization ID to target (defaults to the session's organization ID). pagination options for embedded wallets. parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). user ID to target (defaults to the session's user ID). wallet for which to fetch accounts. list of wallet providers to filter by (used for connected wallets). A successful response returns the following fields: A promise that resolves to an array of `v1WalletAccount` objects. # fetchWalletProviders() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-fetch-wallet-providers

Package: react-wallet-kit

Retrieves wallet providers from the initialized wallet manager.
  • Optionally filters providers by the specified blockchain chain.
  • Throws an error if the wallet manager is not initialized.
optional blockchain chain to filter the returned providers. A successful response returns the following fields: A promise that resolves to an array of wallet providers. # fetchWallets() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-fetch-wallets

Package: react-wallet-kit

Fetches all wallets for the current user, including both embedded and connected wallets.
  • Retrieves all wallets associated with the organizationId from the current active session.
  • For each embedded wallet, automatically fetches and attaches all associated wallet accounts.
  • For connected wallets (e.g., browser extensions or external providers), groups providers by wallet name and attaches all connected accounts.
  • Returns both embedded and connected wallets in a single array, each with their respective accounts populated.
  • Optionally allows stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).
if true, fetches only connected wallets; if false or undefined, fetches both embedded and connected wallets. organization ID to target (defaults to the session's organization ID). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). user ID to target (defaults to the session's user ID). array of wallet providers to use for fetching wallets. A successful response returns the following fields: A promise that resolves to an array of `Wallet` objects. # getActiveSessionKey() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-get-active-session-key

Package: react-wallet-kit

Retrieves the active session key currently set in persistent storage.
  • This function fetches the session key that is currently marked as active in the client's persistent storage.
  • The active session key determines which session is used for all session-dependent operations.
  • If no active session key is set, returns `undefined`.
  • Useful for determining which session is currently in use, especially when managing multiple sessions.

No parameters.

A successful response returns the following fields: A promise that resolves to the active session key as a string, or `undefined` if no active session is set. # getAllSessions() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-get-all-sessions

Package: react-wallet-kit

Retrieves all sessions stored in persistent storage.
  • This function fetches all session objects currently stored by the client, including those that are not active.
  • Returns a record mapping each session key to its corresponding `Session` object.
  • Useful for session management, auditing, or displaying all available sessions to the user.
  • Automatically skips any session keys that do not have a valid session object.

No parameters.

A successful response returns the following fields: A promise that resolves to a record of session keys and their corresponding `Session` objects, or `undefined` if no sessions exist. # getProxyAuthConfig() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-get-proxy-auth-config

Package: react-wallet-kit

Fetches the WalletKit proxy authentication configuration from the auth proxy.
  • This function makes a request to the Turnkey auth proxy to retrieve the current WalletKit configuration,
including supported authentication methods, OAuth providers, and any custom proxy settings.
  • Useful for dynamically configuring the client UI or authentication flows based on the proxy's capabilities.
  • Ensures that the client is aware of the latest proxy-side configuration, which may affect available login/signup options.

No parameters.

A successful response returns the following fields: A promise that resolves to a `ProxyTGetWalletKitConfigResponse` object containing the proxy authentication configuration. # getSession() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-get-session

Package: react-wallet-kit

Retrieves the session associated with the specified session key, or the active session by default.
  • This function retrieves the session object from storage, using the provided session key or, if not specified, the current active session key.
  • If no session key is provided and there is no active session, it returns undefined.
  • Returns the session details, including public key, organization ID, user ID, and expiration.
session key to retrieve a specific session (defaults to the current active session key). A successful response returns the following fields: A promise that resolves to a `Session` object containing the session details, or undefined if not found. # handleAddEmail() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-handle-add-email

Package: react-wallet-kit

Defined in: react-wallet-kit/src/providers/client/Types.tsx:513

Handles the add user email flow.
  • This function opens a modal with the UpdateEmail component, using a modified title and flow for adding and verifying the user's email address.
  • If an email is provided, it will immediately send an OTP request to the user and display the OTP verification modal.
  • Supports both manual entry and pre-filled email addresses, as well as custom modal titles and subtitles.
  • Uses the addEmailContinue helper to manage the OTP flow, verification, and update logic.
  • After successful verification and update, the user details state is refreshed and an optional success page can be shown.
  • Supports customizing the duration of the success page after update.
  • Handles all error cases and throws a TurnkeyError with appropriate error codes.
parameter to specify the new email address. organization ID to target (defaults to the session's organization ID or the parent organization ID). parameter to specify the stamper to use for the update (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). subtitle for the modal. duration (in ms) for the success page after update (default: 0, no success page). title for the modal (defaults to "Connect an email" if the user does not have an email). user ID to target (defaults to the session's user ID). A successful response returns the following fields: A promise that resolves to the userId of the user that was changed. # handleAddOauthProvider() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-handle-add-oauth-provider

Package: react-wallet-kit

Defined in: react-wallet-kit/src/providers/client/Types.tsx:565

Handles the addition of an OAuth provider for the user.
  • This function opens a modal-driven flow for linking a new OAuth provider (Google, Apple, or Facebook) to the user's account.
  • It supports all enabled OAuth providers as defined in the configuration and dynamically triggers the appropriate OAuth flow.
  • Uses the handleGoogleOauth, handleAppleOauth, and handleFacebookOauth functions to initiate the provider-specific OAuth authentication process.
  • After successful authentication, the provider is linked to the user's account and a success page is shown.
  • Automatically refreshes the user details state after linking to ensure the latest provider list is available in the provider.
  • If `openInPage` is true, the current page is redirected to the OAuth URL and the function returns a promise that resolves on redirect or rejects after 5 minutes if no redirect occurs.
  • If `openInPage` is false, a popup window is opened for the OAuth flow, and the function returns a promise that resolves when the OAuth code is captured or rejects if the popup is closed or times out.
  • Optionally allows specifying the stamper to use for the addition (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet) for granular authentication control.
  • Handles all error cases and throws a TurnkeyError with appropriate error codes.
whether to open the OAuth flow in the current page (redirect) or a popup window (default: false). organization ID to target (defaults to the session's organization ID or the parent organization ID). The name of the OAuth provider to add (OAuthProviders.GOOGLE, OAuthProviders.APPLE, OAuthProviders.FACEBOOK). parameter to specify the stamper to use for the addition (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). duration (in ms) for the success page after addition (default: 0, no success page). user ID to target (defaults to the session's user ID). A successful response returns the following fields: A void promise. # handleAddPasskey() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-handle-add-passkey

Package: react-wallet-kit

Defined in: react-wallet-kit/src/providers/client/Types.tsx:616

Handles the addition of a passkey (authenticator) for the user.
  • This function opens a modal-driven flow for adding a new passkey authenticator (WebAuthn/FIDO2) to the user's account.
  • If a `name` or `displayName` is provided, those will be used for the passkey metadata; otherwise, defaults are generated based on the website and timestamp.
  • The passkey is created and linked to the specified user (by `userId`) or the current session's user if not provided.
  • After successful addition, a success page is shown for the specified duration (or skipped if `successPageDuration` is 0).
  • Supports stamping the request with a specific stamper (`StamperType.Passkey`, `StamperType.ApiKey`, or `StamperType.Wallet`) for granular authentication control.
  • Automatically refreshes the user details state after successful addition to ensure the latest authenticators list is available in the provider.
  • Handles all error cases and throws a `TurnkeyError` with appropriate error codes.
display name for the passkey (shown to the user in the UI). internal name for the passkey (for backend or developer reference). organization ID to target (defaults to the session's organization ID or the parent organization ID). parameter to stamp the request with a specific stamper (`StamperType.Passkey`, `StamperType.ApiKey`, or `StamperType.Wallet`). duration (in ms) for the success page after addition (default: 0, no success page). user ID to add the passkey for a specific user (defaults to current session's userId). A successful response returns the following fields: A promise that resolves to the user's updated passkeys. # handleAddPhoneNumber() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-handle-add-phone-number

Package: react-wallet-kit

Defined in: react-wallet-kit/src/providers/client/Types.tsx:538

Handles the add phone number flow.
  • This function opens a modal with the UpdatePhoneNumber component for adding and verifying the user's phone number.
  • If a phone number is provided, it will immediately send an OTP request to the user and display the OTP verification modal.
  • Supports both manual entry and pre-filled phone numbers, as well as custom modal titles and subtitles.
  • Uses the addPhoneNumberContinue helper to manage the OTP flow, verification, and update logic.
  • After successful verification and update, the user details state is refreshed and an optional success page can be shown.
  • Supports customizing the duration of the success page after update.
  • Handles all error cases and throws a TurnkeyError with appropriate error codes.
parameter to specify the formatted phone number. organization ID to target (defaults to the session's organization ID or the parent organization ID). parameter to specify the new phone number. parameter to specify the stamper to use for the update (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). subtitle for the modal. duration (in ms) for the success page after update (default: 0, no success page). title for the modal. user ID to target (defaults to the session's user ID). A successful response returns the following fields: A promise that resolves to the userId of the user that was changed. # handleAppleOauth() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-handle-apple-oauth

Package: react-wallet-kit

Defined in: react-wallet-kit/src/providers/client/Types.tsx:263

Handles the Apple OAuth flow.
  • This function initiates the Apple OAuth flow by either redirecting the user to the Apple authorization page or opening it in a popup window.
  • The flow type is determined by the `openInPage` parameter: if true, the current page is redirected; if false (default), a popup window is used.
  • Generates a new ephemeral API key pair and uses its public key as the nonce for the OAuth request, ensuring cryptographic binding of the session.
  • Constructs the Apple OAuth URL with all required parameters, including client ID, redirect URI, response type, response mode, nonce, and state.
  • The `state` parameter includes the provider, flow type, public key, and any additional state parameters for tracking or custom logic.
  • If `openInPage` is true, the function redirects and returns a promise that resolves on redirect or times out after 5 minutes.
  • If `openInPage` is false, a popup window is opened and the function returns a promise that resolves when the flow completes, or rejects if the window is closed or times out.
  • On successful authentication, the function either calls the provided `onOauthSuccess` callback, triggers the `onOauthRedirect` callback from provider callbacks, or completes the OAuth flow internally by calling `completeOauth`.
  • Handles all error cases, including missing configuration, popup failures, and timeouts, and throws a `TurnkeyError` with appropriate error codes.
Additional key-value pairs to include in the OAuth state parameter for custom tracking or logic. The Apple Client ID to use (defaults to the client ID from configuration). Callback function to handle the successful OAuth response (receives `{ oidcToken, providerName }`). onOauthSuccess params: * oidcToken: The OIDC token received from the OAuth flow. * providerName: The name of the OAuth provider ("apple"). Whether to open the OAuth flow in the current page (redirect) or a popup window (default: false). A successful response returns the following fields: A promise that resolves when the OAuth flow is successfully initiated and completed, or rejects on error or timeout. # handleConnectExternalWallet() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-handle-connect-external-wallet

Package: react-wallet-kit

Defined in: react-wallet-kit/src/providers/client/Types.tsx:683

Handles the connecting of an external wallet account to the user's Turnkey account.
  • This function opens a modal with the ConnectWalletModal component, allowing the user to select and connect an external wallet provider (such as MetaMask, Phantom, etc.).
  • It fetches the list of available wallet providers (for all supported chains) and passes them to the modal for user selection.
  • After a successful wallet connection, the provider state is refreshed to include the newly connected wallet account.
  • Optionally, a success page is shown for the specified duration after connecting (default: 2000ms).
  • Supports both Ethereum and Solana wallet providers, and can be extended to additional chains as supported by Turnkey.
  • Handles all error cases and throws a TurnkeyError with appropriate error codes if the client is not initialized or no active session is found.
duration (in ms) for the success page after connecting (default: 2000ms). A successful response returns the following fields: A promise that resolves to an object describing the action: * `{ type: "connect", account: WalletAccount }` when a wallet is successfully connected. * `{ type: "disconnect", account?: WalletAccount }` when a wallet is disconnected. # handleDiscordOauth() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-handle-discord-oauth

Package: react-wallet-kit

Defined in: react-wallet-kit/src/providers/client/Types.tsx:180

Handles the Discord OAuth 2.0 flow.
  • This function initiates the OAuth 2.0 PKCE flow with Discord by redirecting the user to the Discord authorization page or opening it in a popup window.
  • It supports both "popup" and "redirect" flows, determined by the `openInPage` parameter.
  • Generates a new ephemeral API key pair and uses its public key as part of the state and a cryptographic nonce to bind the OAuth session.
  • Creates a PKCE verifier/challenge pair, storing the verifier in `sessionStorage` for later use in the token exchange.
  • Constructs the Discord OAuth URL with all required parameters, including client ID, redirect URI, response type, scope, PKCE code challenge, nonce, and state.
  • The `state` parameter encodes the provider name, flow type, ephemeral public key, and any additional key-value pairs provided in `additionalState`.
  • If `openInPage` is true, the current page is redirected to the OAuth URL and the function returns a promise that resolves on redirect or rejects after 5 minutes if no redirect occurs.
  • If `openInPage` is false, a popup window is opened for the OAuth flow, and the function returns a promise that resolves when the OAuth code is captured or rejects if the popup is closed or times out.
  • On receiving an authorization code, the function exchanges it for an OIDC token via the Turnkey proxy (`proxyOAuth2Authenticate`) using the PKCE verifier, redirect URI, and nonce.
  • On successful authentication, the function either calls the provided `onOauthSuccess` callback, triggers the `onOauthRedirect` callback from provider callbacks, or completes the OAuth flow internally by calling `completeOauth`.
  • Handles error cases such as missing configuration, popup failures, missing PKCE verifier, or Turnkey proxy failures, throwing a `TurnkeyError` with appropriate error codes.
Additional key-value pairs to include in the OAuth state parameter for tracking or custom logic. The Discord Client ID to use (defaults to the client ID from configuration). Callback function to handle the successful OAuth response (receives `{ oidcToken, providerName }`). onOauthSuccess params: * oidcToken: The OIDC token issued by Turnkey after exchanging the auth code. * providerName: The name of the OAuth provider ("discord"). Whether to open the OAuth flow in the current page (redirect) or a popup window (default: false). A successful response returns the following fields: A promise that resolves when the OAuth flow is successfully initiated and completed, or rejects on error or timeout. # handleExportPrivateKey() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-handle-export-private-key

Package: react-wallet-kit

Defined in: react-wallet-kit/src/providers/client/Types.tsx:336

handles the export private key flow.
  • This function opens a modal with the ExportComponent for exporting a private key.
  • Uses Turnkey's export iframe flow to securely export private key material.
  • The export process encrypts the exported bundle to a target public key, which is generated and managed inside the iframe for maximum security.
  • A request is made to the Turnkey API to export the private key, encrypted to the target public key.
  • The resulting export bundle is injected into the iframe, where it is decrypted and displayed to the user.
  • If a custom iframe URL is used, a target public key can be provided explicitly.
  • Hexadecimal and Solana address formats are supported for wallet account exports - defaulting to Hexadecimal if not specified.
  • Optionally allows specifying the stamper to use for the export (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet) for granular authentication control.
  • The modal-driven UI ensures the user is guided through the export process and can securely retrieve their exported material.
The format of the private key to export (KeyFormat.Hexadecimal or KeyFormat.Solana). The organization ID to target (defaults to the session's organization ID or the parent organization ID). The ID of the private key to export. The stamper to use for the export (Passkey, ApiKey, or Wallet). The target public key to encrypt the export bundle to (required for custom iframe flows). The user ID to target (defaults to the session's user ID). A successful response returns the following fields: A void promise. # handleExportWallet() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-handle-export-wallet

Package: react-wallet-kit

Defined in: react-wallet-kit/src/providers/client/Types.tsx:313

Handles the export wallet flow.
  • This function opens a modal with the ExportComponent for exporting a wallet.
  • Uses Turnkey's export iframe flow to securely export wallet material.
  • The export process encrypts the exported bundle to a target public key, which is generated and managed inside the iframe for maximum security.
  • A request is made to the Turnkey API to export the wallet, encrypted to the target public key.
  • The resulting export bundle is injected into the iframe, where it is decrypted and displayed to the user.
  • If a custom iframe URL is used, a target public key can be provided explicitly.
  • Optionally allows specifying the stamper to use for the export (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet) for granular authentication control.
  • The modal-driven UI ensures the user is guided through the export process and can securely retrieve their exported material.
The organization ID to target (defaults to the session's organization ID or the parent organization ID). The stamper to use for the export (Passkey, ApiKey, or Wallet). The target public key to encrypt the export bundle to (required for custom iframe flows). The user ID to target (defaults to the session's user ID). The ID of the wallet to export. A successful response returns the following fields: A void promise. # handleExportWalletAccount() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-handle-export-wallet-account

Package: react-wallet-kit

Defined in: react-wallet-kit/src/providers/client/Types.tsx:363

Handles the export wallet account flow.
  • This function opens a modal with the ExportComponent for exporting a wallet account.
  • Uses Turnkey's export iframe flow to securely export wallet account material.
  • The export process encrypts the exported bundle to a target public key, which is generated and managed inside the iframe for maximum security.
  • A request is made to the Turnkey API to export the wallet account, encrypted to the target public key.
  • The resulting export bundle is injected into the iframe, where it is decrypted and displayed to the user.
  • If a custom iframe URL is used, a target public key can be provided explicitly.
  • Hexadecimal and Solana address formats are supported for wallet account exports - defaulting to Hexadecimal if not specified.
  • Optionally allows specifying the stamper to use for the export (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet) for granular authentication control.
  • The modal-driven UI ensures the user is guided through the export process and can securely retrieve their exported material.
The address of the wallet account to export. The format of the address to export (KeyFormat.Hexadecimal or KeyFormat.Solana). The organization ID to target (defaults to the session's organization ID or the parent organization ID). The stamper to use for the export (Passkey, ApiKey, or Wallet). The target public key to encrypt the export bundle to (required for custom iframe flows). The user ID to target (defaults to the session's user ID). A successful response returns the following fields: A void promise. # handleFacebookOauth() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-handle-facebook-oauth

Package: react-wallet-kit

Defined in: react-wallet-kit/src/providers/client/Types.tsx:291

Handles the Facebook OAuth flow.
  • This function initiates the Facebook OAuth flow by either redirecting the user to the Facebook authorization page or opening it in a popup window.
  • The flow type is determined by the `openInPage` parameter: if true, the current page is redirected; if false (default), a popup window is used.
  • Generates a new ephemeral API key pair and uses its public key as the nonce for the OAuth request, ensuring cryptographic binding of the session.
  • Uses PKCE (Proof Key for Code Exchange) for enhanced security, generating a code verifier and challenge for the Facebook OAuth flow.
  • Constructs the Facebook OAuth URL with all required parameters, including client ID, redirect URI, response type, code challenge, nonce, and state.
  • The `state` parameter includes the provider, flow type, public key, and any additional state parameters for tracking or custom logic.
  • If `openInPage` is true, the function redirects and returns a promise that resolves on redirect or times out after 5 minutes.
  • If `openInPage` is false, a popup window is opened and the function returns a promise that resolves when the flow completes, or rejects if the window is closed or times out.
  • On successful authentication, the function either calls the provided `onOauthSuccess` callback, triggers the `onOauthRedirect` callback from provider callbacks, or completes the OAuth flow internally by calling `completeOauth`.
  • Handles all error cases, including missing configuration, popup failures, and timeouts, and throws a `TurnkeyError` with appropriate error codes.
Additional key-value pairs to include in the OAuth state parameter for custom tracking or logic. The Facebook Client ID to use (defaults to the client ID from configuration). Callback function to handle the successful OAuth response (receives `{ oidcToken, providerName }`). onOauthSuccess params: * oidcToken: The OIDC token received from the OAuth flow. * providerName: The name of the OAuth provider ("facebook"). Whether to open the OAuth flow in the current page (redirect) or a popup window (default: false). A successful response returns the following fields: A promise that resolves when the OAuth flow is successfully initiated and completed, or rejects on error or timeout. # handleGoogleOauth() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-handle-google-oauth

Package: react-wallet-kit

Defined in: react-wallet-kit/src/providers/client/Types.tsx:236

Handles the Google OAuth flow.
  • This function initiates the Google OAuth flow by redirecting the user to the Google authorization page or opening it in a popup window.
  • It supports both "popup" and "redirect" flows, determined by the `openInPage` parameter.
  • Generates a new ephemeral API key pair and uses its public key as the nonce for the OAuth request, ensuring cryptographic binding of the session.
  • Constructs the Google OAuth URL with all required parameters, including client ID, redirect URI, response type, scope, nonce, and state.
  • The `state` parameter includes the provider, flow type, public key, and any additional state parameters for tracking or custom logic.
  • If `openInPage` is true, the current page is redirected to the Google OAuth URL and the function returns a promise that resolves on redirect or times out after 5 minutes.
  • If `openInPage` is false, a popup window is opened for the OAuth flow, and the function returns a promise that resolves when the flow completes or rejects if the window is closed or times out.
  • On successful authentication, the function either calls the provided `onOauthSuccess` callback, triggers the `onOauthRedirect` callback from provider callbacks, or completes the OAuth flow internally by calling `completeOauth`.
  • Handles all error cases, including missing configuration, popup failures, and timeouts, and throws a `TurnkeyError` with appropriate error codes.
Additional key-value pairs to include in the OAuth state parameter for custom tracking or logic. The Google Client ID to use (defaults to the client ID from configuration). Callback function to handle the successful OAuth response (receives `{ oidcToken, providerName }`). onOauthSuccess params: * oidcToken: The OIDC token received from the OAuth flow. * providerName: The name of the OAuth provider ("google"). Whether to open the OAuth flow in the current page (redirect) or a popup window (default: false). A successful response returns the following fields: A promise that resolves when the OAuth flow is successfully initiated and completed, or rejects on error or timeout. # handleImportPrivateKey() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-handle-import-private-key

Package: react-wallet-kit

Defined in: react-wallet-kit/src/providers/client/Types.tsx:411

Handles the import private key flow.
  • This function opens a modal with the ImportComponent for importing a private key.
  • Supports importing private keys using an encrypted bundle.
  • Address formats (v1AddressFormat\[]) and curve (v1Curve) must be specified based on the type of private key the user will import.
  • Supports customizing the duration of the success page shown after a successful import.
  • Allows specifying the stamper to use for the import (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet) for granular authentication control.
  • Ensures the imported private key is added to the user's wallet list and the provider state is refreshed.
array of address formats (v1AddressFormat\[]) that the private key supports (Eg: "ADDRESS\_FORMAT\_ETHEREUM" for Ethereum, "ADDRESS\_FORMAT\_SOLANA" for Solana). whether to clear the clipboard after pasting the import bundle (default: true). curve type (v1Curve) for the private key (Eg: "CURVE\_SECP256K1" for Ethereum, "CURVE\_ED25519" for Solana). format of the private key to import (KeyFormat.Hexadecimal, KeyFormat.BitcoinMainNetWIF, KeyFormat.BitcoinTestNetWIF, KeyFormat.SuiBech32 or KeyFormat.Solana). Defaults to Hexadecimal. name for the imported private key, if not provided, an input box will be shown for the name. The organization ID to target (defaults to the session's organization ID or the parent organization ID). parameter to specify the stamper to use for the import (Passkey, ApiKey, or Wallet). duration (in ms) for the success page after import (default: 0, no success page). The user ID to target (defaults to the session's user ID). A successful response returns the following fields: A promise that resolves to the new private key's ID. # handleImportWallet() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-handle-import-wallet

Package: react-wallet-kit

Defined in: react-wallet-kit/src/providers/client/Types.tsx:387

Handles the import wallet flow.
  • This function opens a modal with the ImportComponent for importing a wallet.
  • Supports importing wallets using an encrypted bundle, with optional default accounts or custom account parameters.
  • Allows users to specify default wallet accounts (address formats or account params) to pre-fill the import form.
  • Supports customizing the duration of the success page shown after a successful import.
  • Allows specifying the stamper to use for the import (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet) for granular authentication control.
  • Ensures the imported wallet is added to the user's wallet list and the provider state is refreshed.
whether to clear the clipboard after pasting the import bundle (default: true). array of default wallet accounts (v1AddressFormat\[] or v1WalletAccountParams\[]) to pre-fill the import form. The organization ID to target (defaults to the session's organization ID or the parent organization ID). parameter to specify the stamper to use for the import (Passkey, ApiKey, or Wallet). duration (in ms) for the success page after import (default: 0, no success page). The user ID to target (defaults to the session's user ID). name for the imported wallet, if not provided, an input box will be shown for the name. A successful response returns the following fields: A promise that resolves to the new wallet's ID. # handleLogin() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-handle-login

Package: react-wallet-kit

Defined in: react-wallet-kit/src/providers/client/Types.tsx:151

Handles the login or sign-up flow.
  • This function opens a modal with the AuthComponent, allowing the user to log in or sign up using any enabled authentication method (Passkey, Wallet, OTP, or OAuth).
  • It automatically determines available authentication methods based on the current provider configuration and proxy settings.
  • The modal-driven flow guides the user through the appropriate authentication steps, including social login if enabled.
  • After successful authentication, the provider state is updated and all relevant session, user, and wallet data are refreshed.
  • This function is typically used to trigger authentication from a UI button or navigation event.
additional CSS class names to apply to the logo image for custom styling. URL of a custom logo image to display at the top of the login modal in dark mode (overrides config.ui.logoDark). URL of a custom logo image to display at the top of the login modal in light mode (overrides config.ui.logoLight). session key to resume an existing session or pre-fill session details in the login modal. title text to display at the top of the login modal (defaults to "Log in or sign up"). A successful response returns the following fields: A void promise. # handleOnRamp() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-handle-on-ramp

Package: react-wallet-kit

Defined in: react-wallet-kit/src/providers/client/Types.tsx:772

Handles the fiat onramp process for converting fiat currency into crypto and funding a wallet.
  • Initializes a fiat onramp transaction with a specified provider (e.g., Coinbase or MoonPay).
  • Opens the provider flow in a new window and polls the transaction status until completion.
  • Displays a modal to show progress and success state.
  • Supports both sandbox and production modes.
optional ISO 3166-1 country code. optional ISO 3166-2 subdivision code, e.g., NY. optional cryptocurrency to purchase, e.g., FIAT\_ON\_RAMP\_CRYPTO\_CURRENCY\_BTC, defaults to the native currency associated with the network/wallet address passed in. optional preset fiat amount, e.g., '100'. optional fiat currency to use, e.g., FIAT\_ON\_RAMP\_CURRENCY\_ETH. optional blockchain network, e.g., FIAT\_ON\_RAMP\_BLOCKCHAIN\_NETWORK\_ETHEREUM, defaults to the network associated with the wallet address passed in. optional onramp provider, e.g., FIAT\_ON\_RAMP\_PROVIDER\_COINBASE or FIAT\_ON\_RAMP\_PROVIDER\_MOONPAY, defaults to FIAT\_ON\_RAMP\_PROVIDER\_MOONPAY. organization ID to specify the sub-organization (defaults to the current session's organizationId). optional payment method, e.g., FIAT\_ON\_RAMP\_PAYMENT\_METHOD\_CREDIT\_DEBIT\_CARD. optional flag to use sandbox (test) mode (default: true). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). optional duration (in ms) for the success page after connecting (default: 2000ms). optional MoonPay Widget URL to sign. destination wallet account for the buy transaction. A successful response returns the following fields: A promise that resolves when the onramp flow completes successfully. # handleRemoveOauthProvider() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-handle-remove-oauth-provider

Package: react-wallet-kit

Defined in: react-wallet-kit/src/providers/client/Types.tsx:591

Handles the removal of an OAuth provider.
  • This function opens a modal with the RemoveOAuthProvider component, allowing the user to confirm and remove an OAuth provider (such as Google, Apple, or Facebook) from their account.
  • It supports specifying the provider ID to remove, as well as optional modal title and subtitle for custom UI messaging.
  • After successful removal, the user details state is refreshed to reflect the updated list of linked OAuth providers.
  • Optionally, a callback can be provided to handle successful removal, receiving the updated list of provider IDs.
  • Supports customizing the duration of the success page shown after removal.
  • Allows specifying the stamper to use for the removal (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet) for granular authentication control.
  • Handles all error cases and throws a TurnkeyError with appropriate error codes.
organization ID to target (defaults to the session's organization ID or the parent organization ID). The ID of the OAuth provider to remove (as found in the user's provider list). parameter to specify the stamper to use for the removal (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). subtitle for the modal. duration (in ms) for the success page after removal (default: 0, no success page). title for the modal. A successful response returns the following fields: A promise that resolves to an array of provider IDs that were removed. # handleRemovePasskey() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-handle-remove-passkey

Package: react-wallet-kit

Defined in: react-wallet-kit/src/providers/client/Types.tsx:639

Handles the removal of a passkey (authenticator) for the user.
  • This function opens a modal with the RemovePasskey component, allowing the user to confirm and remove a passkey authenticator from their account.
  • It supports specifying the authenticator ID to remove, as well as optional modal title and subtitle for custom UI messaging.
  • After successful removal, the user details state is refreshed to reflect the updated list of authenticators.
  • Supports customizing the duration of the success page shown after removal.
  • Allows specifying the stamper to use for the removal (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet) for granular authentication control.
  • Handles all error cases and throws a TurnkeyError with appropriate error codes.
The ID of the authenticator (passkey) to remove. organization ID to target (defaults to the session's organization ID or the parent organization ID). parameter to specify the stamper to use for the removal (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). subtitle for the modal. duration (in ms) for the success page after removal (default: 0, no success page). title for the modal. user ID to remove the passkey for a specific user (defaults to current session's userId). A successful response returns the following fields: A promise that resolves to an array of authenticator IDs that were removed. # handleRemoveUserEmail() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-handle-remove-user-email

Package: react-wallet-kit

Defined in: react-wallet-kit/src/providers/client/Types.tsx:706

Handles the removal of a user's email address from their Turnkey account.
  • Opens a modal with the RemoveUserEmail component, allowing the user to confirm and remove their email address.
  • Supports optional overrides for userId, organizationId, and stamper type.
  • Returns the user ID associated with the removed email.
organization ID to target (defaults to the session's organization ID or the parent organization ID). stamper type to use for the removal (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). duration in milliseconds to display the success page after removal (default: 0, no success page). user ID to remove the email for (defaults to the current session's userId). A successful response returns the following fields: A promise that resolves to the user ID associated with the removed email. # handleRemoveUserPhoneNumber() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-handle-remove-user-phone-number

Package: react-wallet-kit

Defined in: react-wallet-kit/src/providers/client/Types.tsx:726

Handles the removal of a user's phone number from their Turnkey account.
  • Opens a modal with the RemovePhoneNumber component, allowing the user to confirm and remove their phone number.
  • Supports optional overrides for userId, organizationId, and stamper type.
  • Returns the user ID associated with the removed phone number.
organization ID to target (defaults to the session's organization ID or the parent organization ID). stamper type to use for the removal (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). duration in milliseconds to display the success page after removal (default: 0, no success page). user ID to remove the phone number for (defaults to the current session's userId). A successful response returns the following fields: A promise that resolves to the user ID associated with the removed phone number. # handleSendErc20Transfer() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-handle-send-erc20-transfer

Package: react-wallet-kit

Defined in: react-wallet-kit/src/providers/client/Types.tsx:813

Handles signing and sending an ERC20 `transfer(address,uint256)` transaction.
  • Submits an ERC20 transfer intent to Turnkey for signing and execution.
  • Automatically polls the transaction status until it reaches a terminal state.
  • Displays a modal showing progress and a success page upon completion.
Optional icon to display in the transaction modal. Optional Turnkey organization or sub-organization ID (defaults to the active session). Optional stamper override (e.g. Passkey, API key, Wallet). Optional duration (in ms) to display the success page after completion (default: 2000ms). ERC20 transfer fields (`from`, `tokenAddress`, `to`, `amount`, `caip2`). A successful response returns the following fields: A promise that resolves when the transfer reaches a terminal state. # handleSendTransaction() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-handle-send-transaction

Package: react-wallet-kit

Defined in: react-wallet-kit/src/providers/client/Types.tsx:793

Handles signing and sending an EVM or Solana transaction.
  • Submits a send-transaction intent to Turnkey for signing and execution.
  • Automatically polls the transaction status until it reaches a terminal state.
  • Displays a modal showing progress and a success page upon completion.
  • Supports EVM (EIP-1559 or sponsored Gas Station meta-transactions) and Solana.
Optional icon to display in the transaction modal. Optional Turnkey organization or sub-organization ID (defaults to the active session). Optional stamper override (e.g. Passkey, API key, Wallet). Optional duration (in ms) to display the success page after completion (default: 2000ms). The EVM or Solana transaction to sign and send. A successful response returns the following fields: A promise that resolves when the transaction reaches a terminal state. # handleSignMessage() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-handle-sign-message

Package: react-wallet-kit

Defined in: react-wallet-kit/src/providers/client/Types.tsx:662

Handles the signing of a message by displaying a modal for user interaction.
  • This function opens a modal with the SignMessageModal component, prompting the user to review and approve the message signing request.
  • Supports signing with any wallet account managed by Turnkey, including externally connected wallets.
  • Allows for optional overrides of the encoding and hash function used for the payload, enabling advanced use cases or compatibility with specific blockchains.
  • Optionally displays a subtext in the modal for additional context or instructions to the user.
  • Returns a promise that resolves to a `v1SignRawPayloadResult` object containing the signed message, signature, and metadata.
whether to add the Ethereum prefix to the message (default: false). encoding for the payload (defaults to the proper encoding for the account type). hash function to use (defaults to the appropriate function for the account type). The message to sign. organization ID to target (defaults to the session's organization ID or the parent organization ID). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). subtext to display in the modal. duration in seconds to display the success page after signing. The wallet account to use for signing. A successful response returns the following fields: A promise that resolves to a `v1SignRawPayloadResult` object containing the signed message. # handleUpdateUserEmail() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-handle-update-user-email

Package: react-wallet-kit

Defined in: react-wallet-kit/src/providers/client/Types.tsx:437

Handles the update user email flow.
  • This function opens a modal with the UpdateEmail component for updating and verifying the user's email address.
  • If an email is provided, it will immediately send an OTP request to the user and display the OTP verification modal.
  • Supports both manual entry and pre-filled email addresses, as well as custom modal titles and subtitles.
  • Uses the updateEmailContinue helper to manage the OTP flow, verification, and update logic.
  • After successful verification and update, the user details state is refreshed and an optional success page can be shown.
  • Supports customizing the duration of the success page after update.
  • Handles all error cases and throws a TurnkeyError with appropriate error codes.
parameter to specify the new email address. organization ID to target (defaults to the session's organization ID or the parent organization ID). parameter to specify the stamper to use for the update (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). subtitle for the modal. duration (in ms) for the success page after update (default: 0, no success page). title for the modal. user ID to target (defaults to the session's user ID). A successful response returns the following fields: A promise that resolves to the userId of the user that was changed. # handleUpdateUserName() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-handle-update-user-name

Package: react-wallet-kit

Defined in: react-wallet-kit/src/providers/client/Types.tsx:488

Handles the update user name flow.
  • This function opens a modal with the UpdateUserName component for updating and verifying the user's name.
  • If a userName is provided, it will directly update the user name without showing the modal.
  • Uses updateUserName under the hood to perform the update and automatically refreshes the user details state after a successful update.
  • Optionally displays a success page after the update, with customizable duration.
  • Supports passing a custom title and subtitle for the modal UI.
  • Handles all error cases and throws a TurnkeyError with appropriate error codes.
organization ID to target (defaults to the session's organization ID or the parent organization ID). parameter to specify the stamper to use for the update (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). subtitle for the modal. duration (in ms) for the success page after update (default: 0, no success page). title for the modal. user ID to target (defaults to the session's user ID). parameter to specify the new user name. A successful response returns the following fields: A promise that resolves to the userId of the user that was changed. # handleUpdateUserPhoneNumber() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-handle-update-user-phone-number

Package: react-wallet-kit

Defined in: react-wallet-kit/src/providers/client/Types.tsx:464

Handles the update user phone number flow.
  • This function opens a modal with the UpdatePhoneNumber component for updating and verifying the user's phone number.
  • If a phoneNumber is provided, it will directly send an OTP request to the user and display the OTP verification modal.
  • Supports both manual entry and pre-filled phone numbers, as well as custom modal titles and subtitles.
  • Uses the updatePhoneNumberContinue helper to manage the OTP flow, verification, and update logic.
  • After successful verification and update, the user details state is refreshed and an optional success page can be shown.
  • Supports customizing the duration of the success page after update.
  • Throws a TurnkeyError if the client is not initialized, no active session is found, SMS OTP is not enabled, or if there is an error updating the phone number.
parameter to specify the formatted phone number. organization ID to target (defaults to the session's organization ID or the parent organization ID). parameter to specify the new phone number. parameter to specify the stamper to use for the update (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). subtitle for the modal. duration for the success page (default: 0, no success page). title for the modal. user ID to target (defaults to the session's user ID). A successful response returns the following fields: A promise that resolves to the userId of the user that was changed. # handleVerifyAppProofs() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-handle-verify-app-proofs

Package: react-wallet-kit

Defined in: react-wallet-kit/src/providers/client/Types.tsx:744

Handles verification of a list of app proofs against their corresponding boot proofs.
  • This function iterates through each provided app proof, fetches the corresponding boot proof, and verifies the app proof against the boot proof.
  • If any app proof fails verification, an error is thrown.
  • A modal is opened to show the progress of the verification
the app proofs to verify. organization ID to specify the sub-organization (defaults to the current session's organizationId). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). duration (in ms) for the success page after verification (default: 0, no success page). A successful response returns the following fields: A promise that resolves when all app proofs have been successfully verified. # handleXOauth() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-handle-xoauth

Package: react-wallet-kit

Defined in: react-wallet-kit/src/providers/client/Types.tsx:209

Handles the Twitter (X) OAuth 2.0 flow.
  • This function initiates the OAuth 2.0 PKCE flow with Twitter (X) by redirecting the user to the X authorization page or opening it in a popup window.
  • It supports both "popup" and "redirect" flows, determined by the `openInPage` parameter.
  • Generates a new ephemeral API key pair and uses its public key as part of the state and a cryptographic nonce to bind the OAuth session.
  • Creates a PKCE verifier/challenge pair, storing the verifier in `sessionStorage` for later use in the token exchange.
  • Constructs the Twitter (X) OAuth URL with all required parameters, including client ID, redirect URI, response type, scope, PKCE code challenge, nonce, and state.
  • The `state` parameter encodes the provider name, flow type, ephemeral public key, and any additional key-value pairs provided in `additionalState`.
  • If `openInPage` is true, the current page is redirected to the OAuth URL and the function returns a promise that resolves on redirect or rejects after 5 minutes if no redirect occurs.
  • If `openInPage` is false, a popup window is opened for the OAuth flow, and the function returns a promise that resolves when the OAuth code is captured or rejects if the popup is closed or times out.
  • On receiving an authorization code, the function exchanges it for an OIDC token via the Turnkey proxy (`proxyOAuth2Authenticate`) using the PKCE verifier, redirect URI, and nonce.
  • On successful authentication, the function either calls the provided `onOauthSuccess` callback, triggers the `onOauthRedirect` callback from provider callbacks, or completes the OAuth flow internally by calling `completeOauth`.
  • Handles error cases such as missing configuration, popup failures, missing PKCE verifier, or Turnkey proxy failures, throwing a `TurnkeyError` with appropriate error codes.
Additional key-value pairs to include in the OAuth state parameter for tracking or custom logic. The Twitter (X) Client ID to use (defaults to the client ID from configuration). Callback function to handle the successful OAuth response (receives `{ oidcToken, providerName }`). onOauthSuccess params: * oidcToken: The OIDC token issued by Turnkey after exchanging the auth code. * providerName: The name of the OAuth provider ("twitter"). Whether to open the OAuth flow in the current page (redirect) or a popup window (default: false). A successful response returns the following fields: A promise that resolves when the OAuth flow is successfully initiated and completed, or rejects on error or timeout. # importPrivateKey() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-import-private-key

Package: react-wallet-kit

Imports a private key from an encrypted bundle.
  • This function imports a private key using the provided encrypted bundle.
  • If a userId is provided, the private key will be imported for that specific user; otherwise, it uses the current session's userId.
  • Requires address formats to
  • Automatically infers the cryptographic curve used to generate the private key based on the address format (can be optionally overriden if needed).
  • The encrypted bundle MUST be encrypted to ensure security.
  • Automatically ensures an active session exists before making the request.
  • Optionally allows stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).
the cryptographic curve used to generate a given private key encrypted bundle containing the private key key material and metadata. organization ID to import the private key under a specific sub-organization (private key will be associated with the sub-organization). name of the private key to create upon import. parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). user ID to import the wallet for a specific user (defaults to the current session's userId). A successful response returns the following fields: A promise that resolves to the ID of the imported wallet. # importWallet() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-import-wallet

Package: react-wallet-kit

Imports a wallet from an encrypted bundle.
  • This function imports a wallet using the provided encrypted bundle and creates accounts based on the provided parameters.
  • If a userId is provided, the wallet will be imported for that specific user; otherwise, it uses the current session's userId.
  • If an accounts array is provided, those accounts will be created in the imported wallet; otherwise, default Ethereum and Solana accounts will be created.
  • The encrypted bundle MUST be encrypted to
  • Automatically ensures an active session exists before making the request.
  • Optionally allows stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).
array of account parameters to create in the imported wallet (defaults to standard Ethereum and Solana accounts). encrypted bundle containing the wallet seed phrase and metadata. organization ID to import the wallet under a specific sub-organization (wallet will be associated with the sub-organization). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). user ID to import the wallet for a specific user (defaults to the current session's userId). name of the wallet to create upon import. A successful response returns the following fields: A promise that resolves to the ID of the imported wallet. # initOtp() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-init-otp

Package: react-wallet-kit

Initializes the OTP process by sending an OTP code to the provided contact.
  • This function initiates the OTP flow by sending a one-time password (OTP) code to the user's contact information (email address or phone number) via the auth proxy.
  • Supports both email and SMS OTP types.
  • Returns an OTP ID that is required for subsequent OTP verification.
contact information for the user (e.g., email address or phone number). type of OTP to initialize (OtpType.Email or OtpType.Sms). A successful response returns the following fields: A promise that resolves to the OTP ID required for verification. # loginOrSignupWithWallet() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-login-or-signup-with-wallet

Package: react-wallet-kit

Logs in an existing user or signs up a new user using a wallet, creating a new sub-organization if needed.
  • This function attempts to log in the user by stamping a login request with the provided wallet.
  • If the wallet’s public key is not associated with an existing sub-organization, a new one is created.
  • Handles both wallet authentication and sub-organization creation in a single flow.
  • For Ethereum wallets, derives the public key from the signed request header; for Solana wallets, retrieves it directly from the wallet.
  • Optionally accepts additional sub-organization parameters, a custom session key, and a custom session expiration.
  • Stores the resulting session token under the specified session key, or the default session key if not provided.
optional parameters for creating a sub-organization (e.g., authenticators, user metadata). session expiration time in seconds (defaults to the configured default). optional public key to associate with the session (generated if not provided). session key to use for storing the session (defaults to the default session key). wallet provider to use for authentication. A successful response returns the following fields: A promise that resolves to an object containing: * `sessionToken`: the signed JWT session token. * `address`: the authenticated wallet address. * `action`: whether the flow resulted in a login or signup (AuthAction). # loginWithOauth() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-login-with-oauth

Package: react-wallet-kit

Logs in a user using OAuth authentication.
  • This function logs in a user using the provided OIDC token and public key.
  • Optionally invalidates any existing sessions for the user if `invalidateExisting` is set to true.
  • Stores the resulting session token under the specified session key, or the default session key if not provided.
  • Handles cleanup of unused key pairs if login fails.
flag to invalidate existing sessions for the user. OIDC token received after successful authentication with the OAuth provider. ID of the organization to target when creating the session. The public key bound to the login session. This key is required because it is directly tied to the nonce used during OIDC token generation and must match the value encoded in the token. session key to use for session creation (defaults to the default session key). A successful response returns the following fields: A promise that resolves to a BaseAuthResult, which includes: * `sessionToken`: the signed JWT session token. # loginWithOtp() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-login-with-otp

Package: react-wallet-kit

Logs in a user using an OTP verification token.
  • This function logs in a user using the verification token received after OTP verification (from email or SMS).
  • If a public key is not provided, a new API key pair will be generated for authentication.
  • Optionally invalidates any existing sessions for the user if `invalidateExisting` is set to true.
  • Stores the resulting session token under the specified session key, or the default session key if not provided.
  • Handles cleanup of unused key pairs if login fails.
flag to invalidate existing session for the user. optional organization ID to target (defaults to the verified subOrg ID linked to the verification token contact). public key to use for authentication. If not provided, a new key pair will be generated. session key to use for session creation (defaults to the default session key). verification token received after OTP verification. A successful response returns the following fields: A promise that resolves to a BaseAuthResult, which includes: * `sessionToken`: the signed JWT session token. # loginWithPasskey() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-login-with-passkey

Package: react-wallet-kit

Logs in a user using a passkey, optionally specifying the public key, session key, and session expiration.
  • This function initiates the login process with a passkey and handles session creation and storage.
  • If a public key is not provided, a new key pair will be generated for authentication.
  • If a session key is not provided, the default session key will be used.
  • The session expiration can be customized via the expirationSeconds parameter.
  • Handles cleanup of unused key pairs if login fails.
session expiration time in seconds (defaults to the configured default). organization ID to target (defaults to the session's organization ID or the parent organization ID). public key to use for authentication. If not provided, a new key pair will be generated. session key to use for session creation (defaults to the default session key). A successful response returns the following fields: A promise that resolves to a PasskeyAuthResult, which includes: * `sessionToken`: the signed JWT session token. * `credentialId`: an empty string. # loginWithWallet() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-login-with-wallet

Package: react-wallet-kit

Logs in a user using the specified wallet provider.
  • This function logs in a user by authenticating with the provided wallet provider via a wallet-based signature.
  • If a public key is not provided, a new one will be generated for authentication.
  • Optionally accepts a custom session key and session expiration time.
  • Stores the resulting session token under the specified session key, or the default session key if not provided.
  • Throws an error if a public key cannot be found or generated, or if the login process fails.
optional session expiration time in seconds (defaults to the configured default). organization ID to target (defaults to the session's organization ID or the parent organization ID). optional public key to associate with the session (generated if not provided). optional key to store the session under (defaults to the default session key). wallet provider to use for authentication. A successful response returns the following fields: A promise that resolves to a WalletAuthResult, which includes: * `sessionToken`: the signed JWT session token. * `address`: the authenticated wallet address. # logout() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-logout

Package: react-wallet-kit

Logs out the current client session.
  • This function clears the specified session and removes any associated key pairs from storage.
  • If a sessionKey is provided, it logs out from that session; otherwise, it logs out from the active session.
  • Cleans up any api keys associated with the session.
session key to specify which session to log out from (defaults to the active session). A successful response returns the following fields: A promise that resolves when the logout process is complete. # refreshSession() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-refresh-session

Package: react-wallet-kit

Refreshes the session associated with the specified session key, or the active session by default.
  • This function refreshes the session and updates the session token and key pair associated with the given session key.
  • If a sessionKey is provided, it will refresh the session under that key; otherwise, it will use the current active session key.
  • Optionally allows specifying a new expiration time for the session, a custom public key, and whether to invalidate the existing session after refreshing.
  • Makes a request to the Turnkey API to stamp a new login and stores the refreshed session token.
  • Automatically manages key pair cleanup and session storage to ensure consistency.
  • Optionally allows stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).
expiration time in seconds for the refreshed session (defaults to the configured default). flag to invalidate the existing session before refreshing (defaults to false). public key to use for the refreshed session (if not provided, a new key pair will be generated). session key to refresh the session under (defaults to the active session key). parameter to stamp the request with a specific stamper. A successful response returns the following fields: A promise that resolves to a `TStampLoginResponse` object containing the refreshed session details. # refreshUser() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-refresh-user

Package: react-wallet-kit

Defined in: react-wallet-kit/src/providers/client/Types.tsx:112

Refreshes the user details.
  • This function fetches the latest user details for the current session (or optionally for a specific user/organization if provided)
and updates the `user` state variable in the provider.
  • If a `stampWith` parameter is provided, it will use that stamper to fetch the user details (supports Passkey, ApiKey, or Wallet stampers).
  • Automatically handles error reporting via the configured callbacks.
  • Typically used after authentication, user profile updates, or linking/unlinking authenticators to ensure the provider state is up to date.
  • If no user is found, the state will not be updated.
organization ID to target (defaults to the session's organization ID or the parent organization ID). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). user ID to target (defaults to the session's user ID). A successful response returns the following fields: A promise that resolves when the user details are successfully refreshed and state is updated. # refreshWallets() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-refresh-wallets

Package: react-wallet-kit

Defined in: react-wallet-kit/src/providers/client/Types.tsx:132

Refreshes the wallets state for the current user session.
  • This function fetches the latest list of wallets associated with the current session or user,
and updates the `wallets` state variable in the provider.
  • If a `stampWith` parameter is provided, it will use that stamper to fetch the wallets
(supports Passkey, ApiKey, or Wallet stampers for granular authentication control).
  • Automatically handles error reporting via the configured callbacks.
  • Typically used after wallet creation, import, export, account changes, or authentication
to ensure the provider state is up to date.
  • If no wallets are found, the state will be set to an empty array.
organization ID to target (defaults to the session's organization ID or the parent organization ID). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). user ID to target (defaults to the session's user ID). A successful response returns the following fields: A promise that resolves with the latest list of wallets. # removeOauthProviders() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-remove-oauth-providers

Package: react-wallet-kit

Removes a list of OAuth providers from the user.
  • This function removes OAuth providers (e.g., Google, Apple) from the user's account.
  • If a userId is provided, it removes the providers for that specific user; otherwise, it uses the current session's userId.
  • Automatically ensures an active session exists before making the request.
  • Optionally allows stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).
  • Returns an array of remaining provider IDs associated with the user after removal.
organization ID to specify the sub-organization (defaults to the current session's organizationId). IDs of the OAuth providers to remove. parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). user ID to remove the provider for a specific user (defaults to the current session's userId). A successful response returns the following fields: A promise that resolves to an array of provider IDs that were removed. # removePasskeys() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-remove-passkeys

Package: react-wallet-kit

Removes passkeys (authenticator) from the user.
  • This function removes passkeys (WebAuthn/FIDO2 authenticators) from the user's account.
  • If a userId is provided, it removes the passkeys for that specific user; otherwise, it uses the current session's userId.
  • Automatically ensures an active session exists before making the request.
  • Optionally allows stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).
  • Returns an array of remaining authenticator IDs for the user after removal.
IDs of the authenticators (passkeys) to remove. organization ID to specify the sub-organization (defaults to the current session's organizationId). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). user ID to remove the passkeys for a specific user (defaults to the current session's userId). A successful response returns the following fields: A promise that resolves to an array of authenticator IDs that were removed. # removeUserEmail() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-remove-user-email

Package: react-wallet-kit

Removes the user's email address.
  • This function removes the user's email address by setting it to an empty string.
  • If a userId is provided, it removes the email for that specific user; otherwise, it uses the current session's userId.
  • Automatically ensures an active session exists before making the request.
  • Optionally allows stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).
organization ID to specify the sub-organization (defaults to the current session's organizationId). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). user ID to remove a specific user's email address (defaults to the current session's userId). A successful response returns the following fields: A promise that resolves to the userId of the user whose email was removed. # removeUserPhoneNumber() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-remove-user-phone-number

Package: react-wallet-kit

Removes the user's phone number.
  • This function removes the user's phone number by setting it to an empty string.
  • If a userId is provided, it removes the phone number for that specific user; otherwise, it uses the current session's userId.
  • Automatically ensures an active session exists before making the request.
  • Optionally allows stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).
organization ID to specify the sub-organization (defaults to the current session's organizationId). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). user ID to remove a specific user's phone number (defaults to the current session's userId). A successful response returns the following fields: A promise that resolves to the userId of the user whose phone number was removed. # setActiveSession() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-set-active-session

Package: react-wallet-kit

Sets the active session to the specified session key.
  • This function updates the `activeSessionKey` in persistent storage to the specified session key.
  • Ensures that subsequent operations use the session associated with this key as the active session.
  • Does not validate whether the session key exists or is valid; it simply updates the pointer.
  • Useful for switching between multiple stored sessions or restoring a previous session context.
session key to set as the active session. A successful response returns the following fields: A promise that resolves when the active session key is successfully set. # signAndSendTransaction() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-sign-and-send-transaction

Package: react-wallet-kit

Signs and broadcasts a transaction using the specified wallet account. Behavior differs depending on the type of wallet:
  • **Connected wallets**
  • *Ethereum*: delegates to the wallet’s native `signAndSendTransaction` method.
  • Does **not** require an `rpcUrl` (the wallet handles broadcasting).
  • *Solana*: signs the transaction locally with the connected wallet, but requires an `rpcUrl` to broadcast it.
  • Other chains: not supported; will throw an error.
  • **Embedded wallets**
  • Signs the transaction using the Turnkey API.
  • Requires an `rpcUrl` to broadcast the signed transaction, since Turnkey does not broadcast directly.
  • Broadcasts the transaction using a JSON-RPC client and returns the resulting transaction hash/signature.
  • Optionally allows stamping with a specific stamper (`StamperType.Passkey`, `StamperType.ApiKey`, or `StamperType.Wallet`).
**Only for Turnkey embedded wallets**: organization ID to target (defaults to the session's organization ID). JSON-RPC endpoint used for broadcasting (required for Solana connected wallets and all embedded wallets). optional stamper to use when signing (`StamperType.Passkey`, `StamperType.ApiKey`, or `StamperType.Wallet`). type of transaction (e.g., `"TRANSACTION_TYPE_SOLANA"`, `"TRANSACTION_TYPE_ETHEREUM"`). unsigned transaction data as a serialized string in the canonical encoding for the given `transactionType`. wallet account to use for signing and broadcasting. A successful response returns the following fields: A promise that resolves to a transaction signature or hash. # signMessage() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-sign-message

Package: react-wallet-kit

Signs a message using the specified wallet account. Behavior differs depending on the wallet type:
  • **Connected wallets**
  • Delegates signing to the wallet provider’s native signing method.
  • *Ethereum*: signatures always follow [EIP-191](https://eips.ethereum.org/EIPS/eip-191).
  • The wallet automatically prefixes messages with
`"\x19Ethereum Signed Message:\n" + message length` before signing.
  • As a result, these signatures cannot be used as raw transaction signatures or broadcast on-chain.
  • If `addEthereumPrefix` is set to `false`, an error is thrown because connected Ethereum wallets always prefix.
  • *Other chains*: follows the native connected wallet behavior.
  • **Embedded wallets**
  • Uses the Turnkey API to sign the message directly.
  • Supports optional `addEthereumPrefix`:
  • If `true` (default for Ethereum), the message is prefixed before signing.
  • If `false`, the raw message is signed without any prefix.
Additional details:
  • Automatically handles encoding and hashing based on the wallet account’s address format,
unless explicitly overridden.
  • Optionally allows stamping with a specific stamper
(`StamperType.Passkey`, `StamperType.ApiKey`, or `StamperType.Wallet`). whether to prefix the message with Ethereum’s `"\x19Ethereum Signed Message:\n"` string (default: `true` for Ethereum). override for payload encoding (defaults to the encoding appropriate for the address format). override for hash function (defaults to the function appropriate for the address format). plaintext (UTF-8) message to sign. organization ID to target (defaults to the session's organization ID). optional stamper for the signing request. wallet account to use for signing. A successful response returns the following fields: A promise that resolves to a `v1SignRawPayloadResult` containing the signature and metadata. # signTransaction() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-sign-transaction

Package: react-wallet-kit

Signs a transaction using the specified wallet account. Behavior differs depending on the type of wallet:
  • **Connected wallets**
  • Ethereum: does not support raw transaction signing. Calling this function will throw an error instructing you to use `signAndSendTransaction` instead.
  • Solana: supports raw transaction signing via the connected wallet provider.
  • Other chains: not supported; will throw an error.
  • **Embedded wallets**
  • Delegates signing to the Turnkey API, which returns the signed transaction.
  • Supports all Turnkey-supported transaction types (e.g., Ethereum, Solana, Tron).
  • Optionally allows stamping with a specific stamper (`StamperType.Passkey`, `StamperType.ApiKey`, or `StamperType.Wallet`).
  • Note: For embedded Ethereum wallets, the returned signature doesn’t include the `0x` prefix. You should add `0x` before
broadcasting if it’s missing. It’s a good idea to check whether the signature already starts with `0x` before adding it, since we plan to include the prefix by default in a future breaking change. organization ID to target (defaults to the session's organization ID). stamper to use for signing (`StamperType.Passkey`, `StamperType.ApiKey`, or `StamperType.Wallet`). type of transaction (e.g., "TRANSACTION\_TYPE\_ETHEREUM", "TRANSACTION\_TYPE\_SOLANA", "TRANSACTION\_TYPE\_TRON"). unsigned transaction data as a serialized string in the canonical encoding for the given `transactionType`. wallet account to use for signing. A successful response returns the following fields: A promise that resolves to the signed transaction string. # signUpWithOauth() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-sign-up-with-oauth

Package: react-wallet-kit

Signs up a user using OAuth authentication.
  • This function creates a new sub-organization for the user using the provided OIDC token, public key, and provider name.
  • Handles the full OAuth sign-up flow, including sub-organization creation and session management.
  • Optionally accepts additional sub-organization creation parameters and a custom session key.
  • After successful sign-up, automatically logs in the user and returns a signed JWT session token.
parameters for sub-organization creation (e.g., authenticators, user metadata). OIDC token received after successful authentication with the OAuth provider. name of the OAuth provider (e.g., "Google", "Apple"). public key to associate with the new sub-organization. session key to use for session creation (defaults to the default session key). A successful response returns the following fields: A promise that resolves to a BaseAuthResult, which includes: * `sessionToken`: the signed JWT session token. # signUpWithOtp() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-sign-up-with-otp

Package: react-wallet-kit

Signs up a user using an OTP verification token.
  • This function signs up a user using the verification token received after OTP verification (from email or SMS).
  • Creates a new sub-organization for the user with the provided parameters and associates the contact (email or phone) with the sub-organization.
  • Automatically generates a new API key pair for authentication and session management.
  • Stores the resulting session token under the specified session key, or the default session key if not provided.
  • Handles both email and SMS OTP types, and supports additional sub-organization creation parameters.
contact information for the user (e.g., email address or phone number). parameters for creating a sub-organization (e.g., authenticators, user metadata). flag to invalidate existing session for the user. type of OTP being used (OtpType.Email or OtpType.Sms). session key to use for session creation (defaults to the default session key). verification token received after OTP verification. A successful response returns the following fields: A promise that resolves to a BaseAuthResult, which includes: * `sessionToken`: the signed JWT session token. # signUpWithPasskey() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-sign-up-with-passkey

Package: react-wallet-kit

Signs up a user using a passkey, creating a new sub-organization and session.
  • This function creates a new passkey authenticator and uses it to register a new sub-organization for the user.
  • Handles both passkey creation and sub-organization creation in a single flow.
  • Optionally accepts additional sub-organization parameters, a custom session key, a custom passkey display name, and a custom session expiration.
  • Automatically generates a new API key pair for authentication and session management.
  • Stores the resulting session token and manages cleanup of unused key pairs.
challenge string to use for passkey registration. If not provided, a new challenge will be generated. parameters for creating a sub-organization (e.g., authenticators, user metadata). session expiration time in seconds (defaults to the configured default). organization ID to target (defaults to the session's organization ID or the parent organization ID). display name for the passkey (defaults to a generated name based on the current timestamp). session key to use for storing the session (defaults to the default session key). A successful response returns the following fields: A promise that resolves to a PasskeyAuthResult, which includes: * `sessionToken`: the signed JWT session token. * `credentialId`: the credential ID associated with the passkey created. # signUpWithWallet() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-sign-up-with-wallet

Package: react-wallet-kit

Signs up a user using a wallet, creating a new sub-organization and session.
  • This function creates a new wallet authenticator and uses it to register a new sub-organization for the user.
  • Handles both wallet authentication and sub-organization creation in a single flow.
  • Optionally accepts additional sub-organization parameters, a custom session key, and a custom session expiration.
  • Automatically generates additional API key pairs for authentication and session management.
  • Stores the resulting session token under the specified session key, or the default session key if not provided, and manages cleanup of unused key pairs.
parameters for creating a sub-organization (e.g., authenticators, user metadata). session expiration time in seconds (defaults to the configured default). session key to use for storing the session (defaults to the default session key). wallet provider to use for authentication. A successful response returns the following fields: A promise that resolves to a WalletAuthResult, which includes: * `sessionToken`: the signed JWT session token. * `address`: the authenticated wallet address. # solSendTransaction() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-sol-send-transaction

Package: react-wallet-kit

  • **API subject to change**
Signs and submits a Solana transaction using a Turnkey-managed (embedded) wallet. This method performs **authorization and signing**, and submits the transaction to Turnkey’s coordinator. It **does not perform any polling** — callers must use `pollTransactionStatus` to obtain the final on-chain result. Behavior:
  • **Connected wallets**
  • Connected wallets are **not supported** by this method.
  • They must instead use `signAndSendTransaction`.
  • **Embedded wallets**
  • Constructs the payload for Turnkey's `sol_send_transaction` endpoint.
  • Signs and submits the transaction through Turnkey.
  • Returns a `sendTransactionStatusId`, which the caller must pass to
`pollTransactionStatus` to obtain the final result (signature + status). A successful response returns the following fields: A promise resolving to the `sendTransactionStatusId`. This ID must be passed to `pollTransactionStatus`. # storeSession() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-store-session

Package: react-wallet-kit

Stores a session token and updates the session associated with the specified session key, or by default the active session.
  • This function parses and stores a signed JWT session token in local storage, associating it with the given session key.
  • If a sessionKey is provided, the session will be stored under that key; otherwise, it will use the default session key.
  • If a session already exists for the session key, its associated key pair will be deleted before storing the new session.
  • After storing the session, any unused key pairs are automatically cleared from storage.
  • Ensures that session management is consistent and prevents orphaned key pairs.
session key to store the session under (defaults to the default session key). JWT session token to store. A successful response returns the following fields: A promise that resolves when the session is successfully stored. # switchWalletAccountChain() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-switch-wallet-account-chain

Package: react-wallet-kit

Switches the wallet provider associated with a given wallet account to a different chain.
  • Requires the wallet manager and its connector to be initialized
  • Only works for connected wallet accounts
  • Looks up the provider for the given account address
  • Does nothing if the provider is already on the desired chain.
The target chain, specified as a chain ID string or a SwitchableChain object. The wallet account whose provider should be switched. Optional list of wallet providers to search; falls back to `fetchWalletProviders()` if omitted. A successful response returns the following fields: A promise that resolves once the chain switch is complete. # updateUserEmail() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-update-user-email

Package: react-wallet-kit

Updates the user's email address.
  • This function updates the user's email address and, if provided, verifies it using a verification token (typically from an OTP flow).
  • If a userId is provided, it updates the email for that specific user; otherwise, it uses the current session's userId.
  • If a verificationToken is not provided, the email will be updated but will not be marked as verified.
  • Automatically ensures an active session exists before making the request.
  • Handles session management and error reporting for both update and verification flows.
new email address to set for the user. organization ID to specify the sub-organization (defaults to the current session's organizationId). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). user ID to update a specific user's email (defaults to the current session's userId). verification token from OTP email verification (required if verifying the email). A successful response returns the following fields: A promise that resolves to the userId of the updated user. # updateUserName() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-update-user-name

Package: react-wallet-kit

Updates the user's name.
  • This function updates the user's display name.
  • If a userId is provided, it updates the name for that specific user; otherwise, it uses the current session's userId.
  • Automatically ensures an active session exists before making the request.
  • Optionally allows stamping the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet).
  • Handles session management and error reporting for the update flow.
organization ID to specify the sub-organization (defaults to the current session's organizationId). parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). user ID to update a specific user's name (defaults to the current session's userId). new name to set for the user. A successful response returns the following fields: A promise that resolves to the userId of the updated user. # updateUserPhoneNumber() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-update-user-phone-number

Package: react-wallet-kit

Updates the user's phone number.
  • This function updates the user's phone number and, if provided, verifies it using a verification token (from an OTP flow).
  • If a userId is provided, it updates the phone number for that specific user; otherwise, it uses the current session's userId.
  • If a verificationToken is not provided, the phone number will be updated but will not be marked as verified.
  • Automatically ensures an active session exists before making the request.
  • Handles session management and error reporting for both update and verification flows.
organization ID to specify the sub-organization (defaults to the current session's organizationId). new phone number to set for the user. parameter to stamp the request with a specific stamper (StamperType.Passkey, StamperType.ApiKey, or StamperType.Wallet). user ID to update a specific user's phone number (defaults to the current session's userId). verification token from OTP phone verification (required if verifying the phone number). A successful response returns the following fields: A promise that resolves to the userId of the updated user. # verifyAppProofs() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-verify-app-proofs

Package: react-wallet-kit

Verifies a list of app proofs against their corresponding boot proofs.
  • This function iterates through each provided app proof, fetches the corresponding boot proof, and verifies the app proof against the boot proof.
  • If any app proof fails verification, an error is thrown.
A successful response returns the following fields: A promise that resolves when all app proofs have been successfully verified. # verifyOtp() Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/client-context-type-verify-otp

Package: react-wallet-kit

Verifies the OTP code sent to the user.
  • This function verifies the OTP code entered by the user against the OTP sent to their contact information (email or phone) using the auth proxy.
  • If verification is successful, it returns the sub-organization ID associated with the contact (if it exists) and a verification token.
  • The verification token can be used for subsequent login or sign-up flows.
  • Handles both email and SMS OTP types.
contact information for the user (e.g., email address or phone number). OTP code entered by the user. ID of the OTP to verify (returned from `initOtp`). type of OTP being verified (OtpType.Email or OtpType.Sms). public key the verification token is bound to for ownership verification (client signature verification during login/signup). This public key is optional; if not provided, a new key pair will be generated. A successful response returns the following fields: A promise that resolves to an object containing: * subOrganizationId: sub-organization ID if the contact is already associated with a sub-organization, or an empty string if not. * verificationToken: verification token to be used for login or sign-up. # TurnkeyProviderConfig Source: https://docs.turnkey.com/generated-docs/react-wallet-kit/turnkey-provider-config Configuration for the TurnkeyProvider. This interface extends the TurnkeySDKClientConfig to include additional UI and auth configurations. It is used to initialize the TurnkeyProvider with various options such as colors, dark mode, auth methods, and more. TurnkeyProviderConfig

Package: react-wallet-kit

Defined in: react-wallet-kit/src/types/base.ts:40

base URL for the Turnkey API. configuration for authentication methods. whether to automatically refresh the session. parameters for creating a sub-organization for each authentication method. parameters for email OTP authentication. parameters for OAuth authentication. parameters for passkey authentication. parameters for SMS OTP authentication. parameters for wallet authentication. order of authentication methods. enables or disables specific authentication methods. configuration for OAuth authentication. client ID for Apple OAuth. client ID for Discord OAuth. client ID for Facebook OAuth. client ID for Google OAuth. redirect URI for OAuth. whether to open OAuth in the same page. Always true on mobile. client ID for X (formerly Twitter) OAuth. order of OAuth authentication methods. If otp sent will be alphanumeric. If using the auth proxy, you must configure this setting through the dashboard. Changing this through the TurnkeyProvider will have no effect. length of the OTP. If using the auth proxy, you must configure this setting through the dashboard. Changing this through the TurnkeyProvider will have no effect. session expiration time in seconds. If using the auth proxy, you must configure this setting through the dashboard. Changing this through the TurnkeyProvider will have no effect. whether to verify the app proof generated by a proxySignup request if the request includes wallet account creation. The end user will see a modal during this process. ID for the auth proxy configuration. URL for the auth proxy. whether to automatically fetch the wallet kit config on initialization. whether to automatically refresh managed state variables default stamper type to use for requests that require stamping. URL for the export iframe. URL for the import iframe. ID of the organization. configuration for the passkey stamper. UI configuration. background blur for UI elements. border radius for UI elements. color scheme configuration. dark color scheme overrides. light color scheme overrides. enables or disables dark mode. logo for the auth component whether to use large action buttons. whether to render the modal in the provider. whether to suppress missing styles error. configuration for the wallet manager. # About Turnkey Source: https://docs.turnkey.com/get-started/about-turnkey Turnkey is wallet infrastructure for developers — secure key management, transaction signing, and programmable access controls built on hardware-backed secure enclaves. Turnkey provides the infrastructure to create and manage wallets, sign transactions, and secure cryptographic keys at scale. Every signing operation happens inside hardware-backed secure enclaves — private keys are never exposed to Turnkey, your application, or your team. ## How Turnkey works Instead of managing private keys directly, Turnkey abstracts key management into a layered system. Your application is a parent organization, and sub-organizations are available to fully isolate wallets, users, and policies per end user or tenant. Every action — signing, creating wallets, updating permissions — is evaluated by a policy engine running inside a hardware-backed secure enclave before anything executes. Keys never leave the enclave. Turnkey returns signed payloads and supports transaction broadcasting directly to the network. Turnkey operates based on a [shared responsibility model](/security/shared-responsibility-model). Turnkey is responsible for the security of the platform itself, including enclave infrastructure, policy engine correctness, key confidentiality, and service availability. You are responsible for securing your integration: configuring your root quorum, scoping user permissions, authoring policies, and managing credentials. See the [full model](/security/shared-responsibility-model) for details. Turnkey architecture: organizations, sub-organizations, users, authenticators, policies, and wallets ## Core concepts * **Organization** — Top-level entity representing your application. Contains users, wallets, and policies. * **Sub-organization** — Fully isolated organization nested under the parent, typically representing an end user or business customer. Parent orgs have read-only access and cannot modify sub-org contents. * **User** — A resource within an org or sub-org that submits activities via a valid credential. Users can have tags, which policies reference for role-based controls. * **Root user / root quorum** — Root users can bypass the policy engine. A root quorum sets the approval threshold required to exercise root permissions. * **Authenticator** — A credential used to stamp API requests: passkeys, API keys, email OTP, or OAuth. * **Activity** — Any action submitted to Turnkey (sign transaction, create user, update policy). All activities are evaluated by the policy engine. * **Policy** — A logical rule that evaluates to ALLOW, DENY, or REQUIRES\_CONSENSUS. Controls who can sign what, under what conditions. * **Wallet** — An HD wallet (seed phrase) that generates multiple accounts across chains. Lives inside the enclave; only addresses and signatures are returned. ## Where to start * **Explore by use case** — [Embedded Wallets](/solutions/embedded-wallets/overview), [Company Wallets](/solutions/company-wallets/overview), [Key Management](/solutions/key-management/overview) * **Account setup** — [create your org and API key](/get-started/quickstart) * **SDKs** — [client libraries](/sdks/introduction) for React, React Native, Swift, Kotlin, Flutter, and more * **Security** — [how the enclave model works](/security/our-approach) and what Turnkey's security guarantees are * **AI-ready docs** — [use Turnkey docs](/get-started/using-llms) with Cursor, ChatGPT, or your own LLM tooling # Agent Skills Source: https://docs.turnkey.com/get-started/ai-skills Opinionated instructions that tell AI agents how to interact with Turnkey through conversation, not code. Each agent skill is a `SKILL.md` file with opinionated, step-by-step instructions for a specific Turnkey operation. Instead of an agent reasoning about API docs, parameter formatting, and chain-specific details on its own, skills give it exactly what it needs to execute correctly. Skills work with Claude Code, OpenAI, and other third-party agent frameworks. Skills are for interacting with Turnkey directly through an AI assistant, not for building the application layer on top of Turnkey. If you're using a coding agent to develop a Turnkey integration, connect it to the [Docs MCP server](/get-started/using-llms) instead. Skills are open source at [**tkhq/turnkey-agent-skills**](https://github.com/tkhq/turnkey-agent-skills) on GitHub. ## Use cases Skills are composable. Each skill handles a single domain (wallets, signing, policies, etc.) and can be combined for any workflow. Common starting points: | Use case | What you can do | Start with | | :------------------------------ | :------------------------------------------------------------------------------------------------- | :------------------------------------ | | **Explore and test** | Create wallets, sign transactions, and set policies without writing integration code | `getting-started` | | **Administer your org** | Manage users, rotate API keys, configure policies, and monitor activities conversationally | `managing-users`, `managing-policies` | | **Provision autonomous agents** | Set up a scoped wallet with constrained credentials and governance policies for onchain automation | `provisioning-agent` | ## Credentials and security Read the following carefully before giving any AI agent access to your Turnkey organization. * **LLMs can misinterpret instructions or execute unintended actions.** Scoped credentials ensure mistakes are bounded. Turnkey policies are the technical enforcement mechanism. * **Root credentials are dangerous to give to an AI agent.** A root API key bypasses all policies and has full access to your organization. Root credentials may be acceptable for testing — evaluate the risk before using them in production. * For best security, create a non-root user with specifically scoped permissions and approval flows. When testing against a non-production organization, root credentials may be more acceptable. * **Never test against wallets holding real funds** unless you have appropriate safeguards in place (scoped credentials, spending caps, destination allowlists). * **Turnkey operates based on a [shared responsibility model](/security/shared-responsibility-model).** Turnkey secures the platform, including enclaves, the policy engine, and key confidentiality. You are responsible for how you configure your organization, scope credentials, and author policies. This applies doubly when delegating actions to an AI agent. All skills require an API key pair and organization ID from the [Turnkey Dashboard](https://app.turnkey.com) (**Settings > API Keys**). Which credentials you use depends on your setup: | Setup | Credential type | When to use | | :----------------------------------------------------- | :---------------------------------------------------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Interactive assistant** (human approves each action) | Root API key (with extreme caution) or a scoped, non-root API key | Organization administration, testing, and exploration. Human should review every action before it executes. | | **Autonomous agent** (acts without human review) | Scoped, non-root API key | Production automation. **Never use root credentials for autonomous agents.** Root keys bypass all policies. Create a non-root user with scoped policies instead. See [Agentic Wallets](/solutions/company-wallets/agentic-wallets) and the `provisioning-agent` skill. | ## Available skills Skills are organized into **workflows** (guided multi-step procedures) and **primitives** (individual operations). ### Workflows | Skill | Description | | :--------------------- | :-------------------------------------------------------------- | | **Getting Started** | Day-0 onboarding: verify credentials, create your first wallet | | **Provisioning Agent** | Create a scoped agent with constrained credentials and policies | | **Managing Agent** | Debug denied transactions, rotate keys, update agent policies | ### Primitives | Skill | Description | | :------------------------ | :------------------------------------------------------------------------- | | **Managing Wallets** | Create wallets, derive addresses, add chains, import/export | | **Signing Transactions** | Sign and broadcast on any supported chain (EVM, Solana, Bitcoin, and more) | | **Managing Users** | Create users, rotate API keys, manage user tags | | **Managing Policies** | Access control, spending limits, allowlists, multi-party approval | | **Monitoring Activities** | Activity status, consensus approvals, audit logs | ## Getting started Clone the repo and point your AI assistant at the skill files: ```bash theme={"system"} git clone https://github.com/tkhq/turnkey-agent-skills.git cd turnkey-agent-skills ``` ## Next steps
# Backup and recovery Source: https://docs.turnkey.com/get-started/backup-recovery In line with responsible practices, backup and recovery of Turnkey accounts and/or wallets is an important consideration when designing any production system. The specific mechanisms (such as [wallet exports](/features/wallets/export-wallets)) are outlined in greater detail elsewhere - the purpose of this document is to inform and guide how to use the mechanisms available. It is Turnkey's approach that the safest place for key material is within the hardened [secure enclaves](/security/secure-enclaves), and within these enclaves alone. Our model guides using authenticators (or combinations thereof) of increasing sophistication, relating to the importance or consequences of a given action. For example, a full recovery of an organization may require multiple break-glass hardware authenticators, where a routine low-stakes action might only rely on an API key. The below options all involve some combination of authentication methods and policies. Both of these can be difficult to change later, so consider configuring your backup and recovery methods as early as possible. ## Root user recovery Touched on in the [production checklist](/get-started/production-checklist#security), the **native** method of organization recovery in Turnkey is to configure multiple root users (recommended at least 3), who each have hardware authenticators such as biometric auth (TouchID on a MacBook) or a YubiKey physical passkey. With at least 3 root users, it is possible to set up a 2 of 3 [root quorum](/features/users/root-quorum) which can bypass the policy engine and assert maximum authority in the case of disaster recovery - even when one root user may have lost their authenticator. ### Sub-organizations In a typical non-custodial/embedded wallet configuration, the same root user recovery approach can be effectively used. One could decide on a single ultimate recovery method, such as a passkey or [email-based recovery](/features/authentication/email), or a combination of multiple methods mirroring the previously outlined *n* of *m*. ### Account based authenticators An additional consideration for account-based authenticators (such as email or social login) is that these identity providers typically provide some form of account recovery as well. This can both work to help remove a single point of failure, but also introduce a risk of compromise were an attacker to gain access using this mechanism. Decide appropriately how account based authenticators fit your cybersecurity model. ## User wallet backup Using additional authenticators for recovery is preferred since it ensures wallets never leave the enclave. However, it is also possible for the user to backup their key material outside of Turnkey. Wallets, wallet accounts, and raw private keys can all be exported securely using an [embedded iframe](/solutions/embedded-wallets/integration-guide/react/using-embedded-wallets#embedded-iframe) which ensures the key material remains encrypted while being sent from Turnkey’s enclave to the user’s device. image.png With this process, users have two main options: 1. Expose the seed phrase to the user in plaintext clientside so they can record it manually. See [wallet exports](/features/wallets/export-wallets) for more detail. 2. Encrypt the seed phrase to a user defined passphrase (using [PBKDF2](https://en.wikipedia.org/wiki/PBKDF2)). Contact Turnkey support if you’re interested in this implementation. For non-embedded wallets, [scripted exports](/solutions/embedded-wallets/integration-guide/react/using-embedded-wallets#nodejs) are also possible. # Code examples Source: https://docs.turnkey.com/get-started/examples Turnkey infrastructure is flexible by default. We intentionally prioritize low-level primitives in our product to avoid creating blockers for developers building new kinds of applications on Turnkey. That said, we have built out several example services and applications to help illustrate the types of functionality that Turnkey can enable. ## Demos Full end-to-end applications to see everything working together. | Example | Description | | ------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [`react-wallet-kit`](https://github.com/tkhq/sdk/tree/main/examples/demos/with-react-wallet-kit) | Comprehensive demo of embedded wallet kit with auth, wallet management, signing, import/export | | [`demo-embedded-wallet`](https://github.com/tkhq/demo-embedded-wallet) | A minimal consumer wallet app powered by Turnkey and passkeys, with transaction sending | | [`demo-consumer-wallet`](https://github.com/tkhq/demo-consumer-wallet) | A minimal consumer wallet app powered by Turnkey and WalletConnect | | [`with-react-native-wallet-kit`](https://github.com/tkhq/sdk/tree/main/examples/demos/with-react-native-wallet-kit) | A React Native app demonstrating how to use `@turnkey/react-native-wallet-kit` to authenticate users, create wallets, export wallets, sign messages, and more | | [`flutter-demo-app`](https://github.com/tkhq/dart-sdk/tree/main/examples/flutter-demo-app) | A Flutter app that demonstrates how to use the Turnkey's Flutter packages to authenticate users, create wallets, export wallets, sign messages, and more | | [`swift-sdk/Examples`](https://github.com/tkhq/swift-sdk/tree/main/Examples) | Native iOS wallet app with OTP, OAuth, and passkey auth, wallet creation, message signing, and transaction sending | ## Authentication | Example | Description | | ---------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- | | [`oauth`](https://github.com/tkhq/sdk/tree/main/examples/authentication/oauth) | OAuth login (Google) integration with Turnkey via backend server actions | | [`otp-auth`](https://github.com/tkhq/sdk/tree/main/examples/authentication/otp-auth) | Email OTP authentication with Auth Proxy and a custom backend | | [`magic-link-auth`](https://github.com/tkhq/sdk/tree/main/examples/authentication/magic-link-auth) | Magic link login/signup flow using Turnkey's email OTP system | | [`wallet-auth`](https://github.com/tkhq/sdk/tree/main/examples/authentication/wallet-auth) | External wallet authentication (MetaMask, Phantom, etc.) with Auth Proxy and custom backend | | [`with-wallet-stamper`](https://github.com/tkhq/sdk/tree/main/examples/authentication/with-wallet-stamper) | Demonstrates `@turnkey/wallet-stamper` for signing Turnkey requests with an external wallet | ## Key & Wallet Management | Example | Description | | -------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------- | | [`import-export-with-rwk`](https://github.com/tkhq/sdk/tree/main/examples/key-management/import-export-with-rwk) | Wallet import and export using React Wallet Kit and Auth Proxy | | [`import-export-with-iframe-stamper`](https://github.com/tkhq/sdk/tree/main/examples/key-management/import-export-with-iframe-stamper) | Wallet import/export via `@turnkey/iframe-stamper` | | [`wallet-export-sign`](https://github.com/tkhq/sdk/tree/main/examples/key-management/wallet-export-sign) | Wallet export and signing operations via Turnkey iframe | | [`export-in-node`](https://github.com/tkhq/sdk/tree/main/examples/key-management/export-in-node) | Wallet export performed on the backend | | [`import-in-node`](https://github.com/tkhq/sdk/tree/main/examples/key-management/import-in-node) | Wallet import performed on the backend | | [`disaster-recovery`](https://github.com/tkhq/sdk/tree/main/examples/key-management/disaster-recovery) | Wallet disaster recovery with direct import or encryption key escrow | | [`encryption-key-escrow`](https://github.com/tkhq/sdk/tree/main/examples/key-management/encryption-key-escrow) | Use Turnkey to store encryption keys for external recovery bundles | ## Signing Signers and chain-specific transaction examples. | Example | Description | | --------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [`with-ethers`](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-ethers/) | Sign messages, send EIP-1559 and legacy transactions, interact with contracts (WETH), and sign EIP-712 typed data (ERC-2612 permit, ERC-3009, Hyperliquid) using `@turnkey/ethers` | | [`with-viem`](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-viem/) | Sign messages, send transactions, sign EIP-712 typed data, and sign EIP-4844 and EIP-7702 transactions using `@turnkey/viem` | | [`with-eip-1193-provider`](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-eip-1193-provider/) | Turnkey-compatible Ethereum provider adhering to the EIP-1193 standard | | [`with-nonce-manager`](https://github.com/tkhq/sdk/tree/main/examples/transaction-management/with-nonce-manager/) | Sign and broadcast multiple Ethereum transactions sequentially or optimistically | | [`with-cosmjs`](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-cosmjs/) | Sign and broadcast a Cosmos transaction on Celestia testnet using `@turnkey/cosmjs` | | [`with-solana`](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-solana/) | Sign and broadcast Solana transactions using `@turnkey/solana`, including SPL token creation + transfer | | [`with-bitcoin`](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-bitcoin) | Construct, sign, and broadcast a Bitcoin transaction using bitcoinjs-lib | | [`with-doge`](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-doge) | Dogecoin testnet transaction signing using bitcoinjs-lib | | [`with-aptos`](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-aptos) | Aptos transaction construction and mainnet fund transfer | | [`with-ton`](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-ton) | TON transaction construction and mainnet fund transfer | | [`with-tron`](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-tron) | Tron wallet creation, signing, testnet funding, and policy guards | | [`tron-gasless-transactions`](/solutions/cookbooks/tron-gasless-transactions) | Gasless Tron transactions using delegated bandwidth via the DelegateResource contract function | | [`with-stacks`](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-stacks) | Stacks transaction signing with secp256k1 | | [`with-movement`](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-movement) | Movement transaction construction and mainnet fund transfer | | [`with-arc`](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-arc) | Arc testnet transaction construction and broadcast | | [`with-tempo`](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-tempo) | Tempo testnet transaction construction and broadcast | | [`with-sui`](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-sui) | Construct, sign, and broadcast a Sui transaction using Turnkey | | [`with-iota`](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-iota) | Build, sign, and broadcast IOTA transactions using Turnkey | | [`with-canton`](https://github.com/tkhq/sdk/tree/main/examples/chain-integrations/with-canton) | Construct, sign, and broadcast a Canton transaction against a local or live Canton network | ## Turnkey Transaction Management | Example | Description | | ---------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | | [`tk-gas-station`](https://github.com/tkhq/sdk/tree/main/examples/transaction-management/tk-gas-station) | Gasless transactions using Gas Station SDK with EIP-7702 authorization | | [`with-paymaster`](https://github.com/tkhq/sdk/tree/main/examples/transaction-management/with-paymaster) | ERC-20 token transfer on EVM with Turnkey paymaster gas sponsorship | | [`with-solana-paymaster`](https://github.com/tkhq/sdk/tree/main/examples/transaction-management/with-solana-paymaster) | SPL token transfer on Solana with Turnkey fee sponsorship | | [`with-balances`](https://github.com/tkhq/sdk/tree/main/examples/transaction-management/with-balances) | Fetch token balances and list supported assets using Turnkey APIs | | [`with-tx-webhooks`](https://github.com/tkhq/sdk/tree/main/examples/transaction-management/with-tx-webhooks) | Receive real-time transaction status and balance change updates via webhooks | | [`solana-sweeper`](https://github.com/tkhq/sdk/tree/main/examples/transaction-management/solana-sweeper) | Solana token sweeper utility | | [`solana-usdc-swap`](https://github.com/tkhq/sdk/tree/main/examples/defi/solana-usdc-swap) | SOL to USDC swap on Solana mainnet via Jupiter | | [`sweeper`](https://github.com/tkhq/sdk/tree/main/examples/transaction-management/sweeper/) | Sweep funds from one address to a different address | | [`rebalancer`](https://github.com/tkhq/sdk/tree/main/examples/transaction-management/rebalancer/) | Manage and rebalance funds across multiple wallets and key types | ## Account Abstraction | Example | Description | | --------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- | | [`with-zerodev-aa`](https://github.com/tkhq/sdk/tree/main/examples/account-abstraction/with-zerodev-aa) | Transaction construction and broadcast with Turnkey, Viem, and ZeroDev account abstraction | | [`with-biconomy-aa`](https://github.com/tkhq/sdk/tree/main/examples/account-abstraction/with-biconomy-aa) | Transaction construction and broadcast with Turnkey, Viem, and Biconomy account abstraction | ## DeFi & Protocol Integrations | Example | Description | | ------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------- | | [`with-uniswap`](https://github.com/tkhq/sdk/tree/main/examples/defi/with-uniswap/) | Sign and broadcast a Uniswap v3 trade using the Ethers signer | | [`eth-usdc-swap`](https://github.com/tkhq/sdk/tree/main/examples/defi/eth-usdc-swap) | ETH to USDC swap on Base mainnet via Uniswap Universal Router | | [`with-0x`](/solutions/cookbooks/0x) | EVM swapping ETH for USDC using 0x Swap API | | [`with-lifi`](/solutions/cookbooks/lifi) | EVM and SVM bridging between ETH and SOL using Li.Fi | | [`with-aave`](/solutions/cookbooks/aave) | Aave v3 USDC deposit/withdraw with Turnkey policy engine controls | | [`with-morpho`](/solutions/cookbooks/morpho) | Morpho Vaults USDC deposit/withdraw on Base Mainnet | | [`with-yield-xyz`](/solutions/cookbooks/yieldxyz) | Yield.xyz vaults deposit/withdraw across 75+ networks | | [`with-porto`](https://github.com/tkhq/sdk/tree/main/examples/account-abstraction/with-porto) | Porto wallet upgrade and operations using API keys | | [`with-x402`](https://github.com/tkhq/sdk/tree/main/examples/defi/with-x402) | Coinbase x402 payment protocol with embedded wallets | | [`with-jupiter`](/solutions/cookbooks/jupiter) | Solana token swaps using Jupiter Ultra Swap API | | [`with-breeze`](/solutions/cookbooks/breeze) | Solana USDC staking and yield management via Breeze API | | [`trading-runner`](https://github.com/tkhq/sdk/tree/main/examples/defi/trading-runner/) | Multi-user Uniswap v3 trading demo with private key tags, user tags, and policies | | [`with-gnosis`](https://github.com/tkhq/sdk/tree/main/examples/account-abstraction/with-gnosis/) | Create new Ethereum addresses, configure a 3/3 Gnosis safe, and create + execute a transaction from it | | [`with-walletconnect-pay`](/solutions/cookbooks/wallet-connect-pay-integration) | React Native wallet that authenticates users via email OTP and signs EIP-712 payment authorizations for WalletConnect Pay | | [`brale`](/solutions/cookbooks/brale) | Stablecoin issuance and transfers with Turnkey wallets and the Brale API | | [`relay`](/solutions/cookbooks/relay) | Cross-chain bridging and same-chain token swaps via the Relay protocol | | [`polymarket-builders`](/solutions/cookbooks/polymarket-builders) | Polymarket prediction market trading with builder attribution, Gnosis Safe, and CLOB order placement | | [`base-builder-codes`](/solutions/cookbooks/base-builder-codes) | ERC-8021 Base Builder Code attribution appended to Turnkey-signed transactions | ## Policies & Access Control | Example | Description | | ------------------------------------------------------------------------------------------------- | ------------------------------- | | [`with-delegated`](https://github.com/tkhq/sdk/tree/main/examples/access-control/with-delegated/) | Delegated access setup examples | ## Smart Contracts & Automation | Example | Description | | ------------------------------------------------------------------------------- | ---------------------------------------------------------------------- | | [`deployer`](https://github.com/tkhq/sdk/tree/main/examples/advanced/deployer/) | Compile and deploy a smart contract | | [`foundry`](https://github.com/tkhq/sdk/tree/main/examples/advanced/foundry) | Smart contract setup and broadcast from a Turnkey wallet using Foundry | ## Advanced & Utilities | Example | Description | | ------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------ | | [`with-offline`](https://github.com/tkhq/sdk/tree/main/examples/advanced/with-offline/) | Stamp a Turnkey request and produce a signed URL to send it later | | [`kitchen-sink`](https://github.com/tkhq/sdk/tree/main/examples/demos/kitchen-sink) | Playground scripts for common Turnkey requests via HTTP, sdk-server, and sdk-browser | | [`with-sdk-js`](https://github.com/tkhq/sdk/tree/main/examples/demos/react-wallet-kit-playground) | Integration test suite for `@turnkey/core` and `@turnkey/react-wallet-kit` | ## Demos built with Turnkey ### Embedded Wallet Kit ([live link](https://wallets.turnkey.com/)) A full-featured embedded wallet demo built with [`@turnkey/react-wallet-kit`](https://www.npmjs.com/package/@turnkey/react-wallet-kit), showcasing the latest Turnkey SDK. Includes passkey, email, and OAuth authentication, wallet creation, and more. ### Demo Embedded Wallet ([code](https://github.com/tkhq/demo-embedded-wallet), [live link](https://wallet.tx.xyz)) A wallet application showing how users can register and authenticate using passkeys. Includes features such as: * User authentication with passkeys, email auth, and OAuth * Creating new wallets and wallet accounts * Sending and receiving funds * Importing/Exporting a wallet * Adding a credential to the wallet demo embedded wallet login view demo embedded wallet dashboard view See [https://github.com/tkhq/demo-embedded-wallet](https://github.com/tkhq/demo-embedded-wallet) for the code. ### React Native Wallet Kit ([code](https://github.com/tkhq/sdk/tree/main/examples/demos/with-react-native-wallet-kit)) A React Native app demonstrating how to use [`@turnkey/react-native-wallet-kit`](https://www.npmjs.com/package/@turnkey/react-native-wallet-kit) to authenticate users, create wallets, export wallets, sign messages, and more. ### Flutter demo app ([code](https://github.com/tkhq/dart-sdk/tree/main/examples/flutter-demo-app)) A Flutter app that demonstrates how to use the Turnkey's Flutter packages to authenticate users, create wallets, export wallets, sign messages, and more