JWT Auth for TVC Apps

​

Who can call your app?

​

Who approves

​

Trading firm: administrator quorum

{
  "policyName": "Withdrawal tokens need two administrators",
  "effect": "EFFECT_ALLOW",
  "consensus": "approvers.any(u, u.id == '<TRADING_SERVICE_USER_ID>') &&
    approvers.filter(u, u.tags.contains('<ADMIN_TAG_ID>')).count() >= 2",
  "condition": "activity.type == 'ACTIVITY_TYPE_MINT_JWT' &&
    jwt.profile.httpz.audience == 'https://app.example.com' &&
    jwt.profile.httpz.method == 'POST' &&
    jwt.profile.httpz.path == '/withdrawals'"
}

​

Consumer trading platform: the customer approves

1. Each customer gets a sub-organization and is its root user. They import their exchange API key there, so it never passes through your systems.
2. Your TVC app has a delegated access user in the sub-organization. Policy lets only that user export the key, encrypted to the app’s enclave.
3. The customer writes a policy that lets your strategy user mint order tokens for their account:
   {
     "policyName": "My strategy can place orders for me",
     "effect": "EFFECT_ALLOW",
     "consensus": "approvers.any(u, u.id == '<STRATEGY_USER_ID>')",
     "condition": "activity.type == 'ACTIVITY_TYPE_MINT_JWT' &&
       jwt.profile.httpz.audience == 'https://app.example.com' &&
       jwt.profile.httpz.method == 'POST' &&
       jwt.profile.httpz.path == '/orders'"
   }
   
4. No policy allows withdrawal tokens, so only the customer can mint one, with their passkey.
5. The app checks that the token’s org is the customer’s sub-organization, and that sub may call that route: the strategy user for orders, the customer for withdrawals.

​

What the app checks

• The signature, against Turnkey’s published keys for the issuer.
• The audience is the app’s own origin, and the token hasn’t expired.
• The token’s method, path, query, and body digest match this request.
• The subject and organization may make this request.

​

Getting set up

​

Get started