Skip to main content

​
Some secrets can’t be rotated away

If an exchange API key with withdrawal rights leaks, the withdrawals it signed are final. If a code-signing or token-signing key leaks, its signatures stay valid. Rotation stops the next attack, but it doesn’t undo the last one. These keys usually sit in a secrets manager that hands plaintext to any caller with the right role. From there they end up in a trading bot, a CI runner, or a laptop. With Turnkey Verifiable Cloud (TVC), once you import the key, it is only in plaintext inside an attested app that you control.

​
How it works

  1. Your system sends a request, such as a withdrawal, to the TVC app.
  2. The app loads the key from Managed Secrets. Policy lets only this app export it, and the key is encrypted to the app’s enclave.
  3. The app checks the request against your rules, such as an address allowlist or an amount limit.
  4. If the checks pass, the app signs the request and sends it to the exchange, or returns it to your proxy.
What you get:
  • Plaintext only in enclaves. Your engineers, your cloud provider, and Turnkey see ciphertext.
  • No one acts alone. A quorum of your administrators, such as 3 of 5, approves policy changes and every new version of the app.
  • Rules you can verify. Your security team can confirm exactly which code holds the key, using Boot Proofs.
  • Fast. The app can be configured to load the key once and keep it in memory, so signing needs no extra network call.

​
Policy or app code?

Only the TVC app can export venue keys:

​
Networking

  • Direct. The app calls the exchange itself, so the whole path stays in the enclave. Many exchanges require an IP allowlist for withdrawal keys, so ask us about egress IPs.
  • Your proxy. The app returns the signed request, and your existing proxy and IP allowlists send it. The proxy never holds the key.

​
Getting set up

1

Create your organization

Create a Turnkey organization and enroll your administrators with security keys.
2

Create the production app

Create a separate production app with a fresh Quorum Key and a custom share set. Set the manifest approvers and threshold at creation, such as 3 of 5. Follow the worked example to create the key, deploy the app, and provision its shares.The quickstart uses a well-known development Quorum Key. Do not use it for secrets. TVC does not support changing an app’s manifest set or threshold after creation.
3

Register the app credential

Derive a dedicated P-256 API credential from the app’s Quorum Key inside the enclave. Use the same derivation across replicas and approved deployments. Register only its public key on a non-root Turnkey user. Use that user’s ID as <TVC_APP_USER_ID>. Keep the private key inside the enclave. Generate each export target key pair inside the enclave too.
4

Set the root quorum

Before importing production secrets, set the root quorum to your production threshold, such as 3 of 5. This controls policy changes and break-glass access. The manifest threshold set at app creation controls deployment approvals.
5

Import the key

Import the venue key into Managed Secrets with properties such as kind: exchangeApiKey. Then delete every other copy. Start with a testnet or low-limit key.
6

Scope export to the app

Add the policy above, using the dedicated app user’s ID.

​
Authorize calls to the app

Require every call to the app to carry a Turnkey-minted JWT, so Turnkey policy and your approvers decide who can use the key. See JWT auth for TVC apps.

​
Non-custodial trading on behalf of customers

Order and execution management platforms hold one key per client and per venue. Each client gets their own sub-organization and imports their keys there, so the keys never pass through your systems. Clients can verify the code that uses their keys before they import them.

​
Get started

Bring the key you can least afford to lose, and we will design the app and policies with you. Contact us to book an architecture session.