Skip to main content

​
Some secrets can’t be rotated away

If an exchange API key with withdrawal rights leaks, the withdrawals it signed are final. If a code-signing or token-signing key leaks, its signatures stay valid. Rotation stops the next attack, but it doesn’t undo the last one. These keys usually sit in a secrets manager that hands plaintext to any caller with the right role. From there they end up in a trading bot, a CI runner, or a laptop. With Turnkey Verifiable Cloud (TVC), once you import the key, it is only in plaintext inside an attested app that you control.

​
How it works

  1. Your system sends a request, such as a withdrawal, to the TVC app.
  2. The app loads the key from Managed Secrets. Policy lets only this app export it, and the key is encrypted to the app’s enclave.
  3. The app checks the request against your rules, such as an address allowlist or an amount limit.
  4. If the checks pass, the app signs the request and sends it to the exchange, or returns it to your proxy.
What you get:
  • Plaintext only in enclaves. Your engineers, your cloud provider, and Turnkey see ciphertext.
  • No one acts alone. A quorum of your administrators, such as 3 of 5, approves policy changes and every new version of the app.
  • Rules you can verify. Your security team can confirm exactly which code holds the key, using Boot Proofs.
  • Fast. The app can be configured to load the key once and keep it in memory, so signing needs no extra network call.

​
Policy or app code?

Only the TVC app can export venue keys:

​
Networking

  • Direct. The app calls the exchange itself, so the whole path stays in the enclave. Many exchanges require an IP allowlist for withdrawal keys, so ask us about egress IPs.
  • Your proxy. The app returns the signed request, and your existing proxy and IP allowlists send it. The proxy never holds the key.

​
Getting set up

1

Create your organization

Create a Turnkey organization and enroll your administrators with security keys. While you build, keep the root quorum at 1 so you can iterate quickly.
2

Deploy the app

Deploy your signing app on TVC with your administrators as approvers, also with a threshold of 1 for now. Register the app’s credential as a Turnkey user. See the quickstart.
3

Import the key

Import the venue key into Managed Secrets with properties such as kind: exchangeApiKey. Then delete every other copy. Start with a testnet or low-limit key.
4

Scope export to the app

Add the policy above. No other user can export the key.
5

Raise the quorum for production

Before the key can move real funds, raise the root quorum and the app’s approval threshold, such as to 3 of 5.

​
Authorize calls to the app

Require every call to the app to carry a Turnkey-minted JWT, so Turnkey policy and your approvers decide who can use the key. See JWT auth for TVC apps.

​
Non-custodial trading on behalf of customers

Order and execution management platforms hold one key per client and per venue. Each client gets their own sub-organization and imports their keys there, so the keys never pass through your systems. Clients can verify the code that uses their keys before they import them.

​
Get started

Bring the key you can least afford to lose, and we will design the app and policies with you. Contact us to book an architecture session.