Privacy and security are still a major concern in crypto, and TEEs offer a solution to some of the UX and security issues prevalent today.

But what exactly is a TEE, and what are its trade offs? What roles can TEEs play in the industry? Let’s take a look.

What is a TEE?

A TEE is typically a region of a computer processor (and memory) which can execute a piece of code in isolation. This means that any program which runs inside of it is:

• Confidential: The code inside cannot be accessed from the main operating system/outside of the environment.

• Tamper-resistant: The code inside an enclave cannot be directly modified or tampered with from outside the environment.

• Verifiable: TEEs use cryptographic attestation to prove the authenticity and integrity of the code within.

You can think of a TEE like a secret vault on your computer. Access is restricted and no one can modify its contents from the outside, but third parties can verify that the code running inside of the vault is legitimate.

TEEs are built with these properties in mind, however, not all TEEs are created equal. Let’s take a look at the different implementations and pros and cons of some of the most common types: Intel SGX, ARM TrustZone, and AWS Nitro Enclaves.

Different Types of TEEs

TEEs are typically implemented at the hardware-level, or have some kind of hardware to create a secure region of a processor. However, they can also be implemented via software (e.g. virtualization) or use a hybrid approach, such as using a chip with support for code isolation in combination with a secure operating system.

Below are some of the popular implementations of TEEs:

Intel SGX

Intel Software Guard Extensions (SGX) are a way to create secure enclaves on certain types of Intel processors.

The architecture of SGX means the enclave exists within a specific portion of the processor, rather than in a separate core or piece of hardware. This means that the entire application running on an Intel processor is not encrypted; just the specific portion that needs to be private runs inside of the enclave.

Pros

• Support across different programming environments

• Ships with most modern Intel CPUs

• Extensive documentation and resources online

Cons

• Not easily portable

• Deprecated for some processors (although still supported for enterprise)

• Highly susceptible to supply chain and side-channel attacks

• Not supported on platforms where Intel ME can be disabled

ARM TrustZone

ARM TrustZone separates a computer system into a "secure world" and "normal world". These two worlds run simultaneously, and no code from the “normal” world can directly access any code or data in the “secure” world.

ARM TrustZone was designed primarily for IoT (Internet of Things) and embedded devices.

Pros

• Enforced at a hardware-level (although worlds can run on the same core)

• PSA compliant for IoT devices

• Includes security architecture for other parts of the device (e.g. memory, peripherals)

Cons

• Can be complex to configure and isn’t necessarily a “does it all” solution

• IoT/embedded-first approach may be less suitable for high-performance cloud settings

AWS Nitro Enclaves

AWS Nitro Enclaves use their own secure hardware implementation and are completely virtualized; they run separately from the "main" OS, are not connected to any external networks directly, and have no persistent storage.

On the software-side, the enclave can run a small, specialized OS to reduce attack vectors. They may also be immutable and/or have a secure boot process, such as in the case of our own QuorumOS at Turnkey.

Pros

• Can scale easily as opposed to provisioning and managing physical chips

• Lack of persistence is a feature, not a bug

• Built-in attestation features works well with other AWS services

Cons

• Still proprietary, although attestations provide guarantees of integrity

• Reliant on the security of EC2 to prevent side-channel attacks

Use Cases of TEEs in Crypto

As TEEs can run code which remains isolated, they have a lot of applicability in crypto, as keeping private keys or other sensitive data secure remains a top priority.

Use cases such as MEV infrastructure (e.g. Flashbots) and hardware wallets have had varying degrees of success, with the most useful outcomes centering around protocol and wallet infrastructure.

Here are some of the ways TEEs and secure enclaves are being implemented in crypto today.

Private Networks and Smart Contracts

Private networks such as Secret use Intel SGX to execute smart contracts within enclaves. This allows smart contracts to execute on private data, and also compute on it.

Secret has run into some problems previously related to Intel SGX, most notably the xAPIC/ÆPIC leak in 2022.  Secret has worked to patch any known vulnerabilities related to the enclaves since (you can learn more about it on sgx.fail).

While Intel SGX has its downsides due to these potential vulnerabilities, it’s still a strong infrastructure choice for orchestrating private DeFi and computing because SGX is widely adopted and security exploits are often taken seriously and addressed quickly.

Although hardware exploits do appear, most of the FUD around Intel SGX is unwarranted. Flashbots have an excellent post debunking the most common concerns, such as deprecation, manufacturer tampering, feasibility of exploits, and more.

Flashbots

Miners or validators of blockchain networks like Ethereum are able to see, reorder, and include/exclude pending transactions in the mempool. Users can utilize this information to benefit themselves through MEV (Maximal Extractable Value) bots.

These benefit validators, because MEV extracting strategies typically rely on paying higher gas fees (which validators are incentivized to include).

Flashbots is an organization "formed to mitigate the negative externalities posed by Maximal Extractable Value (MEV)".

In addition to offering frontrunning solutions, Flashbots has made several inroads into researching MEV infrastructure and how TEEs (more specifically, Intel SGX enclaves) can be used with Ethereum. For example, Flashbots have built an implementation for running an Ethereum client on Gramine, an operating system with support for Intel SGX.

This could open up opportunities for keeping sensitive operations private on Ethereum.

Private Key Management and Wallet Infrastructure

Secure enclaves can be used in both hardware and software wallet infrastructure.

Ledger has made use of TEEs as early as 2016 in android phones. Ledger has previously used ARM TrustZone to build wallet interfaces which allow users to load their Bitcoin wallet into the secure region of an ARM processor on their mobile device.

All key generation and transaction signing takes place in the “secure” world of ARM TrustZone, while running a minimal, immutable custom OS called BOLOS (Blockchain Open Ledger Operating System) on the software side.

TEEs at Turnkey

TEEs for key generation and signing aren’t just limited to end-user physical devices.

Turnkey is an enterprise-grade operating system for wallets: powerful, modular, and built to adapt to any use case. Founded by the team that built Coinbase Custody from 0 to $100B+ in assets, we offer low-level cryptographic signing primitives, giving you full control over your implementation and product experience without the limitations of one-user, one-wallet models or rigid MPC pathways.

As part of our novel security architecture, we also utilize AWS Nitro Enclaves, a type of TEE, to run all security-critical operations. This includes features like wallet and private key generation, transaction signing, and our Policy Engine.

AWS Nitro Enclaves operate in hardware-enforced isolation –– they have no persistent storage, no interactive access, and no external networking. To reduce attack vectors, we’ve also built our own operating system (QuorumOS) from the ground up.

In this setup, no raw private keys are ever exposed to Turnkey, and any wallets you set up will be fully non-custodial. Encrypted private keys are used to run workloads inside of the enclave, and as mentioned, Turnkey cannot access your private key within the enclave, and it cannot tamper with the code.

Teams like Moonshot, Azura, Polymarket, Alchemy, and Mysten Labs are already making use of our wallet infrastructure built with secure enclaves.

If you're looking to integrate embedded wallets into your applications, want a more flexible security setup for your organization, or need lower-latency than competing MPC solutions - check out what we're building!

That’s why at Turnkey, we’ve leaned heavily into building not just another developer tool, but an  open-source and composable set of cryptographic primitives that offer unparalleled flexibility. When you’re using Turnkey to create embedded wallets on behalf of users or to automate complex onchain actions, you’re building with verifiable infrastructure that can be integrated into every imaginable product experience.

Our approach at Turnkey has always been to build flexible foundations that can be adapted to any use case in crypto, but we also recognize the value of building abstractions for some of our regularly used primitives. As part of our efforts to make this infrastructure more accessible and easier for developers to integrate, we’re launching our Embedded Wallet Kit!

Embedded Wallet Kit

Turnkey’s Embedded Wallet Kit is a starting point for anyone wanting to integrate embedded wallets into their product, providing pre-generated authentication UI components for a silky-smooth integration. These UI components are customizable and act as your end users’ initial authentication modal when they first enter your application.

Now it’s even easier for you to embed non-custodial end-user wallets into your application.

Main features:

• Customizable auth components: Pre-generated UIs for user login and signup, supporting passkeys, socials, SMS and email.

• Built-in EVM & SVM wallets: Automatically create wallets for users upon authentication. Supports EVM and SVM by default, with the flexibility to add wallets for any chain supported by Turnkey.

• Theme customization and whitelabeling: Easily change your component theme and do easy whitelabeling via CSS.

• Easy code export: Once you've imported your Auth component, you can pass a configuration to toggle features on or off, and order the rendering of authentication methods.

Crypto moves fast — new chains, use cases, and metas launch almost daily. Developers need tools that can keep up if they want to bring new products to market quickly enough to compete.

That’s why we built our Embedded Wallet Kit as an open component library, grounded in our existing infrastructure. Developers get the best of both worlds: ready-to-use tools for rapid deployment and the ability to customize their product beyond more opinionated paths when needed. As a result, developers can comfortably rely on a product that scales and grows with their organization, no matter how much crypto changes.

And with Turnkey’s Embedded Wallet Kit, it only takes minutes to get started in building better UX across the board, while ensuring end-to-end security for end users. Get started on building non-custodial or custodial wallet configurations by checking out our Wallet Kit demo or by viewing our docs.

Solana has also built their own novel architecture aiming to solve the speed and scalability aspects of the blockchain trilemma. Due to its new architecture, the way accounts and transactions work on Solana is different from more traditional blockchains such as Bitcoin and Ethereum.

In this article we'll explore Solana accounts, how Solana transactions are structured, and how they differ from EVM transactions.

What are Solana Accounts?

The first key abstraction to understand is Solana Accounts.

On Solana, Accounts keep a balance of lamports as fractions of Solana’s native token ($SOL), and facilitate transactions on the network. But Accounts on Solana can include any kind of data — this means it can be a smart contract, or it can just hold wallet balances. This is different from Ethereum where there is a clear distinction between Externally Owned Accounts (EOAs) and smart contract accounts. On Solana, everything is built on Accounts.

Accounts are structured as a key-value pair, with an address as the “key”, and an account information (AccountInfo) object as the “value”. The Address is a public address similar to most blockchains. AccountInfo contains information about the account, like whether or not it is executable (i.e. a smart contract), its balance, and owner.

Owner is different from “holder”, which is the actual user of the account. Every Solana account is “owned” by a program, which is what Solana calls smart contracts. When a Solana account is first created,  it is owned by the System Program, a built-in smart contract which performs key actions on Solana.

The basics of Solana transactions

As we just learned, Solana accounts have an owner, or the System Program by default. This plays an important role in a typical Solana transaction.

Let’s say Bob is sending 1 $SOL to Alice. Bob’s account has a balance of 1 $SOL (or 1,000,000,000 Lamports), and he signs a transaction with his private key with the instruction to send this to Alice.

The “instruction” Bob sent is a basic building block of Solana, and is the way the state is changed. Instructions request the account’s owner to make these changes. In this case, the owner of the account (the System Program) checks that Bob has a valid signature, and sends the balance of $SOL in Lamports to Alice.

A transaction consists of a signature(s) and a message which contains these instructions.

Let’s take a look at the structure of the message itself in more detail:

• Header - Metadata about the number of message signers (Bob’s transaction only has one).

• Account Addresses - All addresses relevant to the transaction (e.g. Bob’s address, and Alice’s address). This is split into those requiring signatures, and those that don’t.

• Blockhash - A recent blockhash from within the last 150 blocks as a rough timestamp for the transaction.

• Instructions - A list of instructions to be executed — in this case, a SOL Transfer Instruction sent to the System Program).

Similar to Ethereum transactions, Solana transactions are atomic. This means if any of the instructions in the transaction fails to execute, the entire transaction fails.

In general, Solana transactions contain a lot of similar information to Ethereum transactions, but there are some major differences at the protocol level.

Key differences between Solana and Ethereum transactions

EVM transactions contain a lot of the same information that Solana transactions do, such as a transaction hash, any relevant addresses, as well as value (wallet-to-wallet transfers) and data (for smart contracts).

Solana and Ethereum also have similar approaches to fee structure. A base fee is included at the protocol level in both Solana and Ethereum, and both have an optional priority fee. There are differences such as the fee being more implicit with Solana, but generally, the structure contains similar information.

Multiple Signers

One of the main differences between Solana and Ethereum transactions is that Solana transactions can have multiple signers at the protocol level.

Users can partially sign transactions, which allows for different entities signing different parts of a transaction (e.g. fees or transfers), or creating offline transactions with signers before propagating to the network.

This allows for more complex actions to occur at the protocol level, whereas on Ethereum you would need to make use of smart contracts or other infrastructure which could introduce a large transaction overhead.

Transaction Actions

One of the more complex actions Solana can perform at the base level is Cross-Program Invocations (CPI).

Solana transactions can call different smart contracts within a single transaction, and contain instructions to execute the calls in order (e.g. swapping for a token and staking it within the same transaction). These are baked into the protocol and are called directly, where Ethereum requires intermediate transactions.

Another example would be Solana’s Proof-of-History (PoH) consensus mechanism, which allows for transaction scheduling and time-based execution logic.

How Turnkey policies can be used for Solana transactions

Although Solana can handle some complex interactions on the base layer, using dedicated wallet infrastructure tools like Turnkey can drastically improve the level of flexibility developers have. Turnkey is an enterprise-grade operating system for wallets that provides programmatic authentication for a variety of use cases across DeFi, developer tools, protocols, and more.

Allowing only Solana transactions that include a transfer from one specific sender or denying all Solana transactions transferring to a specific address are just a couple of ways that developers can make use of Turnkey's Solana Policy Engine. This also includes our open-source parser for Solana-specific transaction parsing.

By writing granular policies around transaction amounts, addresses, and program interactions using Turnkey’s API, developers can make their Solana implementations even more powerful and secure, and provide a more polished user experience for a wide range of users and customers.

Here's how they did it with Turnkey:

The problem: Building secure session key management for modular chain abstraction

OneBalance's vision for chain abstraction required a sophisticated session key management system that could work within their modular framework. The challenge was twofold: they needed to protect user session keys with user-controlled passkeys while ensuring their chain abstraction layer could seamlessly handle cross-chain transactions. Traditional client-side browser storage solutions lacked the security guarantees needed for this architecture.

The solution: Turnkey's WaaS platform as a modular session key provider

OneBalance integrated Turnkey's wallet infrastructure as a core component of their modular chain abstraction framework. This implementation showcases how Turnkey's session key infrastructure can power sophisticated cross-chain applications:

• Modular session key architecture: Turnkey serves as a dedicated session key provider within OneBalance's framework, managing sub-organizations and wallets for each user

• Secure key management: Session keys are protected within Turnkey's trusted execution environment (TEE)

• Recovery system: A separate recovery key infrastructure enables account recovery without compromising security

• Framework integration: Turnkey's session key management seamlessly interfaces with OneBalance's Credible Commitment Machine (CCM)

The technical implementation demonstrates the power of modular wallet infrastructure:

1. Users interact with OneBalance's unified interface, abstracting away chain complexity

2. Their session key (secured by Turnkey) signs each UserOp

3. OneBalance's CCM validates operations against internal rules

4. The CCM applies its co-signer signature to complete the dual-signature requirement

5. Transactions execute across relevant chains through the abstraction layer

OneBalance’s results

• Successfully deployed a modular chain abstraction framework using Turnkey as a core session key provider

• Created a chain-free user experience that showcases the potential of modular web3 infrastructure

• Enabled users to interact with any dApp on any chain through a unified balance system

About OneBalance

OneBalance is evolving the web3 experience, allowing users to hold a single balance across all chains and interact with any dApp, on any chain, seamlessly. With OneBalance, users can combine token balances from multiple chains, pay gas fees using any token, and perform cross-chain swaps and transactions in an instant. We're eliminating the complexities of chains, gas fees, and bridges, simplifying the future of DeFi. One Click, One Integration, One Balance, All Chains. Join us as we build a Chain-Free Web3.

About Turnkey

Turnkey is secure, flexible, and scalable wallet infrastructure offering low-level primitives for teams building onchain applications and infrastructure. Founded by the team that built Coinbase Custody, Turnkey is powering serious applications across a wide range of use cases, from wallets-as-service to programmatic backend crypto automation. By leveraging a novel security framework, Turnkey achieves 50-100ms signing latency for millions of wallets, all with affordable transaction-based pricing that's designed for scale.

In this post we'll explore how Bitcoin addresses work, different types of addresses (including legacy, SegWit, and Taproot addresses), and their technical aspects.

How do you generate a Bitcoin public key?

Bitcoin keypairs are formed of a public key and private key.

The private key is put through elliptic curve multiplication to generate a public key. The same private key will always generate the same public key through the process of key derivation. The public key is then hashed and encoded for readability, creating an address.

What are Deterministic Wallets?

A Bitcoin wallet is typically a collection of private keys (or these keypairs).

Traditionally, wallets generated a new private key (and therefore a new public address) after each transaction to reduce address re-use and exposure of private keys. Nowadays, this approach of generating a new random private key after each transaction has been replaced by deterministic wallets. The most common type of deterministic wallet is a hierarchical deterministic wallet. A root seed is used to derive a "master" private key, and this private key is then used to derive further private keys, and so on.

Deterministic wallets mean that if you have the seed, you can always generate the master private key and its child keys.

This differs from the traditional approach and leads to better security for Bitcoin wallets. In the traditional method, a new private key is generated each time. If certain private keys are lost, then funds are lost. Even if you lose a certain private key with a deterministic wallet, as long as you have the seed, you will be able to re-generate all of the private keys used in the wallet.

Mnemonics and BIP 39

Most cryptocurrency wallets  today have a "seed phrase". Seed phrases are typically 12-24 words, and are another format of the randomly generated "seed" number from deterministic wallets. Seed phrases are easier to remember, so they should be kept private and stored securely.

Most modern Bitcoin wallets are hierarchical deterministic wallets, and use mnemonics for the root seed. Some popular examples of (HD) wallets include Trezor, Ledger, Mycelium and Electrum.

As Bitcoin wallets have evolved, address types used inside wallets and transaction types have evolved too. Let’s take a look at this evolution by diving into Bitcoin’s legacy addresses and transaction types.

Legacy addresses

Legacy addresses were the original address types for Bitcoin transactions - most recognizably prefixed with “1”.

Bitcoin transactions are sent with a “locking” script - a way to “lock” funds so that only someone with the correct private key(s) and signature(s) can spend them. These are referred to as “pay-to” transaction types on Bitcoin, with the original pay-to types being P2PKH and P2SH.

P2PKH (Pay-To-Public-Key-Hash)

P2PKH is for sending BTC to the hash of a user's public key.

In a P2PKH transaction, when Bob sends $BTC to Alice, the output $BTC is “locked” to the hash of Alice's public key.

Alice can unlock these funds and spend them by providing a signature to prove they are the owner of the private key.

The public key is only hashed to shorten the length of it and make it a shareable address.

P2SH (Pay-To-Script-Hash)

P2SH allows $BTC to be transferred to the hash of a Bitcoin script.

Like P2PKH, it is also a locking script. The tokens can be unlocked or spent based on the rules of the custom locking script - such as requiring multiple signers.

Segwit Addresses

The Segregated Witness (SegWit) upgrade to Bitcoin, activated in 2017, introduced a new way of structuring transactions, distinct from the method used for legacy addresses.

By introducing new address types and transaction formats (P2WPKH and P2WSH), Bitcoin transactions became cheaper, with lower transaction fees than ever before.

P2WPKH (Pay-to-Witness-Public-Key-Hash)

P2WPKH works almost identically to P2PKH, but instead of using the legacy locking script (ScriptSig), it uses Witness fields to unlock unspent funds instead.

As SegWit transactions (and their accompanying addresses) are cheaper than using legacy address types, it is effectively a drop in replacement (with some nuances).

P2WSH (Pay-to-Witness-Script-Hash)

P2WSH also functions similarly to the original P2SH, but instead uses the Witness field to unlock funds. The applications are still the same, but come with the lower transaction fees from the SegWit upgrade.

Some of the older types such as P2SH are still in use, and as Segwit is not directly backwards compatible with these types, there are wrappers in place to ease the transition to Segwit.

It’s generally recommended to create new wallets and addresses which support Segwit (or the newer Taproot) though, to make use of the advantages.

Taproot Upgrade

The Taproot upgrade was activated in 2021 and enhances privacy, scalability, and smart contract functionality for Bitcoin by making complex transactions appear simpler and more efficient. Taproot implemented BIP 340 (Schnorr Signatures), BIP 341 (Taproot), and BIP 342 (Tapscript).

P2TR (Pay-to-Taproot)

P2TR addresses are the most recent address type added to Bitcoin, and utilize Taproot upgrades to lower transaction costs. Multi-sigs are also indistinguishable from single addresses with Taproot, increasing privacy.

Schnorr Signatures

Schnorr Signatures are a signing mechanism responsible for lower transaction costs, increasing privacy for Taproot addresses.

Individual digital signatures can be "batched" together into one valid signature, which reduces the size of a transaction, and in turn, reduces fees. Aggregating signatures is particularly useful for multi-sigs, as it makes them indistinguishable from single addresses.

Schnorr signatures are also smaller, more secure, and have faster verification times than the traditional ECDSA signatures used in Bitcoin.

How does Turnkey support Bitcoin?

Turnkey is an enterprise-grade operating system for wallets: powerful, modular, and built to adapt to any use case. With Turnkey, it’s possible to programmatically create thousands of embedded wallets at once for any applications built on Bitcoin.

On top of our initial Bitcoin support for transaction signing, we now support address derivations for all Bitcoin address types, which means that you can automatically generate private/public key pairs with Turnkey’s API. This is all done while achieving 50-100ms signing latency for millions of wallets, all with affordable transaction-based pricing that’s designed for scale.

If you'd like to learn more about how you can use Turnkey in your own Bitcoin applications, get started with our docs here.

While our architecture has always supported Solana, through our chain-agnostic infrastructure design, we’re excited to announce deeper protocol support that makes building on Solana even easier.

Now, with the launch of our Solana Policy Engine, you can write granular policies around transaction amounts, addresses, and program interactions using Turnkey’s API – making your Solana wallet implementation even more powerful and secure.

What’s a policy?

Turnkey’s policy engine is the foundation for flexible controls and permissions within every organization. Anyone using Turnkey can create a policy to allow or deny specific onchain transactions in combination, making it perfect for teams building consumer applications or infrastructure that handle sensitive transactions or transactions of size. Read on below to learn more about what you can build with policies and how they can serve your integration.

What can I do with policies?

Policies are inherently flexible and can be used for a wide variety of use cases. The following types of policies are just some examples for policies that you can create with both our Ethereum and Solana policy engines:

• Allow Solana transactions that include a transfer from one specific sender: Want users to only send funds from their hot wallet and not their cold wallet? Specify and allow transactions from only a single sender with a policy.

• Allow Solana transactions that include a transfer to only one specific recipient: Set up an “allowlist” to ensure funds are only able to be sent to known recipients.

• Allow Solana transactions that have exactly one transfer, to one specific recipient: Only allow one specific transaction to be sent to a specific recipient, enabling automated processing of specific one-time transactions without requiring broader permissions to be shared.

• Deny all Solana transactions transferring to an undesired address: Say you don’t want funds sent to a non-wallet contract address. Deny all transactions going to a specific address with ease.

You can take a look at the links above to access specific code examples for those policies (and more!).

Let’s get technical: How does the Turnkey Solana policy engine work?

Previously, all transaction types for Solana on Turnkey were signed using the SIGN_RAW_PAYLOAD  type in our API. With the Solana Policy Engine, you can now use the SIGN_TRANSACTION type, which gives you the ability to parse basic transaction metadata such as the following:

• All Accounts included

• All programs invoked

• All SOL Transfers in the Transaction, with Sender, Recipient Amounts

• All instruction call data within the transaction

As part of our commitment to open source and supporting the Solana ecosystem, we’ve also open-sourced our Solana transaction parser. This library contains tools to parse and inspect Solana transactions at the most primitive level, supporting both message-only and full transaction parsing. It’s designed to be a foundational tool for the Solana ecosystem, allowing developers to inspect transaction metadata, account interactions, and transfer details with precision.

This parser is an example of Turnkey’s infrastructure-first approach: we built robust, low-level tools that can be used by anyone in the ecosystem. By expanding parser support to include Solana and SVM transactions, we’re laying the groundwork for similar support across other chains, such as Cosmos and Bitcoin. To read more about additional chain support, you can check out our documentation here.

Build innovative experiences with policies

We’d love to see you build new onchain experiences with Solana policies. From DeFi, to payments, to in-app quests, policies can help you craft a better user experience by ensuring that user and team funds are safe with simple onchain logic.

If you’re a builder on Solana, you’re already eligible for $400 off the first month of your Pro Tier. Just shoot us an email at hello@turnkey.com with the email you used to sign up for Turnkey, and retweet this tweet to be eligible.

Managing wallets is one of the biggest challenges in onboarding new users into crypto and delivering a seamless experience for both beginners and seasoned traders.

Developers often have to ask themselves the best way to manage the wallet infrastructure for their application. The obvious solution might be letting users  bring their own wallet, either by directly connecting via an in-browser wallet or leveraging a tool like WalletConnect to establish a connection to a cold or mobile wallet.

But these options can be confusing and clunky, which increases the friction of onboarding. Embedded wallets, on the other hand, offer a better path. They are built directly into Web3 applications, have a familiar login experience, and they don't require a seed phrase to be memorized and kept. Turnkey and other embedded wallet providers are enabling this new user experience — simple, easy, and still non-custodial.

Let's take a look at what embedded wallets are, how they work, and how to integrate them into your project as a crypto app developer.

What is an embedded wallet?

Embedded wallets are "embedded" directly into an application, allowing users to create and use a wallet without needing a browser extension or separate app — or even knowing what a wallet is!

Instead of switching between apps to manage transactions, users can create a wallet directly inside of a crypto application, reducing user friction and streamlining the product experience. There’s no need to exit the app and open up another browser window in order to sign and approve transactions.

Embedded wallets can be generated (and authenticated) using familiar methods like biometrics or physical devices, making the process both user-friendly and more secure.

Who is using embedded wallets?

Embedded wallets can fit anywhere into the crypto stack. Some examples of applications utilizing embedded wallets include:

Moonshot

Moonshot is a mobile-native app focused on trading memecoins and for getting non-web3 users into the ecosystem with as little friction as possible. They use Turnkey, an embedded wallet solution, to create non-custodial wallets for users in the background when signing up for Moonshot.

The sign up process involves no lengthy seed phrases or crypto jargon. Instead, it has a familiar login experience using email or biometric passkeys like Face ID/Touch ID, and by combining embedded wallets with MoonPay’s onramping solution, it makes buying memecoins possible within just a few minutes.

BullpenFi

Bullpen is a Telegram bot built on Solana. Users sign up with their biometrics, generate a self-custodial wallet, and can immediately start trading crypto through the familiar UX of a Telegram chat. Bullpen uses Turnkey for account generation, transaction signing, and more.

Alchemy

Alchemy is building onboarding infrastructure for crypto apps, of which one product is their “Smart Accounts” embedded wallet feature suite. Developers can create apps where end users generate passkeys with their biometrics, and this passkey is used to generate passwordless, self-custodial wallets via Turnkey. Users stay in control of their private keys, and Turnkey acts as an Externally-Owned Account (EOA) signer for Alchemy to create flexible embedded wallets.

Embedded Wallet Providers

Providers may have different embedded wallets solutions. Most apps or institutions offload wallet generation, transaction signing, and other aspects of wallet infrastructure to a dedicated third-party.

One common approach in wallet-as-a-service products is MPC (multi-party computation), used by providers like Fireblocks and Dfns. MPC’s security model is based on splitting cryptographic keys across multiple parties, reducing reliance on a single key.

However, MPC can slow down performance due to higher communication costs. This may not be a problem for institutions, but for apps it can lead to a clunky UX with increased friction.

Another alternative is using providers like Dynamic, Alchemy Embedded Accounts, or Privy, which offer higher-level abstractions for onboarding users and creating wallets. These solutions allow developers to quickly implement one-user, one-wallet setups. By wrapping wallet creation and management into easy-to-use SDKs, they streamline the developer experience and remove the need for a complex understanding of cryptography.

The Turnkey difference: Secure, flexible, fast

Turnkey is like an enterprise-grade operating system for wallets: powerful, modular, and built to adapt to any use case. We offer low-level primitives that developers can mix and match, giving you full control over your implementation and product experience without the limitations of one-user, one-wallet models or rigid MPC pathways.

With Turnkey you can:

• Create thousands of non-custodial embedded wallets at once

• Configure multi-sig wallets requiring m-of-n signatures

• Set advanced policies, like allowlists or transaction limits

• Automate signers with custom permissions for offline signing

• Create wallets that are multi-chain or multi-user

• Seamlessly incorporate account abstraction

• Set up session keys with configurable limits and permissions

• …And more

Turnkey combines this unmatched flexibility with an ironclad approach to security. As part of our novel security architecture, we utilize a type of tamper-proof Trusted Execution Environment (TEE).

This technology provides high levels of security for apps and their end users, ensuring raw private keys are never exposed to Turnkey or the app itself. With Turnkey, you get the power to build exactly what you need, backed by the highest levels of security.

How to integrate embedded wallets into your app

If you’re interested in integrating embedded wallets into your own app, check out our documentation available here. We also have a guide on the different ways you can set up embedded wallets (including non-custodial wallets) here.

Want to learn more? Get in touch with us, or join our Slack for additional developer support.

What is Turnkey?

Turnkey is secure, flexible, and scalable wallet infrastructure offering composable primitives for teams building unique crypto products. Founded by the team that built Coinbase Custody, Turnkey is powering serious applications across a wide range of use cases, from  wallets-as-a-service to programmatic backend crypto automation. By leveraging a novel security framework, Turnkey achieves 50-100ms signing latency for millions of wallets, all with affordable transaction-based pricing that’s designed for scale.

That’s why Faraway set out to create a new, seamless user experience for its interoperable gaming system, powered by web3 and crypto under the hood. With a mix of crypto-native users and newcomers, Faraway needed to offer one-click access to a multichain crypto wallet, reducing the friction of onboarding into a web3 game and getting started with gameplay.

Here’s how they did it with Turnkey:

The problem: Fragmented accounts and lack of interoperability

Web3 gaming has long struggled with fragmented account systems and lack of interoperability. Faraway wanted a way for users to easily view their assets and manage their accounts for a smooth gaming experience. Already, they were competing with web2 games that had smooth login flows and easy account management — just without the interoperable in-game assets and unique gaming experiences that Faraway’s web3 games could provide. So, they turned to Turnkey.

The solution: A new login and account solution powered by Turnkey

To create a brand new login and account solution for their end users, Faraway integrated Turnkey embedded wallets into its user login system known as Faraway Connect. This connects users across all products in the ecosystem, including games, marketplaces, and user profiles.

The main purpose of this login system is not only to connect the users’ data across experiences, but also to link multiple wallets on different chains to a single profile in order to manage that user’s on-chain gaming inventory. This is a key puzzle piece in making Faraway’s games interoperable with each other, and also a key benefit of web3 games over traditional games.

Turnkey’s flexible and secure wallet infrastructure ensures that Faraway can programmatically create wallets and accounts while maintaining the flexibility needed to operate a web3 gaming system at scale. To create the user experience they were after, Faraway implemented several key features using Turnkey:

• Segregated, non-custodial wallets: Faraway used Turnkey to create individual wallets for each player in the login process that were compatible across games

• Seamless login with email: Users can easily sign up and log in using their email, without the need for complicated crypto wallet setups

• Multichain support: Each wallet supports both Solana and EVM accounts, allowing users to view and manage their assets across chains

“We decided to go with Turnkey because of the team’s industry-leading experience in building custody architecture that has secured over a hundred billion dollars in crypto assets. Their ability to transform this experience into a secure and flexible non-custodial service, with scalable pricing that makes sense for nimble teams like Faraway, were key factors in our decision to choose Turnkey as our main embedded wallet provider.”

- Alex Paley, Co-Founder of Faraway

Faraway results

• By integrating Turnkey embedded wallets, Faraway created a simple, streamlined user experience by allowing users to create a multichain wallet with just one click (using their email address)

• Faraway saw an increased number of users who had successfully set up a Faraway Connect account and a Faraway wallet with no complaints or bugs so far

• With embedded wallets and web3-powered in-game assets, Faraway x BAYC game Dookey Dash jumped to become the number-one racing game on the App Store, and a top 5 free game in the US

About Faraway

Faraway is a game studio that builds and publishes open economy games including Legends of the Mara, Dookey Dash: Unclogged, Serum City, Mini Royale: Nations, Shatterline, Villains: Robot Battle Royale, Rebel Skies, HV-MTL, and more. With a focus on supporting interoperability and user-generated content powered by web3, Faraway also provides a suite of platform tools for other studios to leverage to integrate blockchain technology in their own games.

About Turnkey

Turnkey is secure, flexible, and scalable wallet infrastructure offering low-level primitives for teams building onchain applications and infrastructure. Founded by the team that built Coinbase Custody, Turnkey is powering serious applications across a wide range of use cases, from  wallets-as-a-service to programmatic backend crypto automation. By leveraging a novel security framework, Turnkey achieves 50-100ms signing latency for millions of wallets, all with affordable transaction-based pricing that’s designed for scale.

So, when the team behind Moonshot set out to create a game-changing onchain trading app, they knew the key to success was making the process as simple as possible for everyday users while maintaining a high bar for security.

Here’s how they did it with Turnkey:

The problem: Simplifying user onboarding while ensuring security

Moonshot’s vision was to create a mobile app that rivaled web2 applications in usability. Their goal: To make onchain trading as easy as buying stocks, without users needing to understand anything about crypto. To do so, they needed to find a partner that allowed them to embed wallets deeply into the product experience, while including web2 friendly authentication methods.

However, compromising on security was a non-starter. It was critical that the embedded wallets set up for users were secure, non-custodial, and built on a paranoid security framework minimizing risk of funds lost both by theft and user error.

The solution: Turnkey’s flexible, secure embedded wallet infrastructure

Moonshot partnered with Turnkey to build a seamless and secure onboarding process that simplifies wallet creation and funding. Key elements of the solution include:

• Zero-touch onboarding: Non-custodial wallets are created fully in the background as a user onboards.

• Easy web2 authentication: No seed phrases required. Users simply register with email or biometrics, like Face ID, to easily authenticate transactions.

• Simple funding options: Moonshot combined Turnkey’s invisible, embedded wallets with a MoonPay integration, enabling users to easily buy and sell crypto with Apple Pay.

Moonshot’s results

• With an embedded wallet creation flow that felt like “magic”, Moonshot was able to onboard tens of thousands of mass-market users to Turnkey-powered non-custodial wallets

• Using Turnkey wallets with passkey and email authentication, coupled with MoonPay, Moonshot users are able to sign up, fund a wallet with Apple Pay, and start trading memes within minutes, without ever opening a wallet pop-up modal

• The Moonshot app has received 4.9 and 4.8-star reviews on Google Play and the App Store, respectively

alexjm

@alexjmingolla

Gotta give props to @usemoonshot for a crazy smooth onboarding experience

Just made a homie who’s never touched crypto before buy $100 of his first memecoin

2 mins later he says “yo look it’s going up!” and shows me a $2 gain

retail is here

80

4:41 PM • Aug 9, 2024

About Moonshot

Moonshot is the first app on the App Store that lets you buy & sell memes with Apple Pay. Sign up with email + FaceID, and you’re in. No seed phrases, no mention of the blockchain, no esoteric concepts. Send your friends coins via username. No need for a wallet address. Make money when your friends trade. Send your friend a unique link, and get 50% of the fees they incur on the platform.

About Turnkey

Turnkey is secure, flexible, and scalable wallet infrastructure offering low-level primitives for teams building onchain applications and infrastructure. Founded by the team that built Coinbase Custody, Turnkey is powering serious applications across a wide range of use cases, from  wallets-as-a-service to programmatic backend crypto automation. By leveraging a novel security framework, Turnkey achieves 50-100ms signing latency for millions of wallets, all with affordable transaction-based pricing that’s designed for scale.

Turnkey enables dramatically better crypto UX by allowing innovative teams like Infinex, Bullpen, Utopia, Alchemy, and Thunder Terminal to create secure non-custodial wallets for their users.

Previously, end users could authenticate with biometric passkeys, API keys, and email.  With OAuth, Turnkey customers and their users can now sign in with popular providers such as Google, Apple, and Facebook and approve transactions directly in-app — providing a seamless way to use web2 identity providers to authenticate into non-custodial wallets.

With this launch, Turnkey is taking one more step towards making wallets truly invisible. Your users don’t need to know they’re using crypto, even if they’re signing transactions onchain.

How OAuth works

We’ve added OAuth to the set of trusted authenticators that developers can add to sub-organizations, on top of API keys, email, and passkeys. As a result, your end user can just log in with Oauth, and take actions directly onchain from within your app.

You can check out an example of OAuth in our demo wallet, or check out our docs for how to configure OAuth for your own organization.

For a more detailed overview of how OAuth works and the challenges in building it securely, read on below, or take a technical deep dive in our first engineering blog post, coming tomorrow!

OAuth under the hood

Turnkey’s OAuth feature is built on OIDC (OpenID Connect). OIDC extends OAuth 2.0, which focuses on resource sharing, by providing user authentication through the following process: Users are redirected to their provider for login, then returned to the original website with a JWT containing authentication information.

We’ve taken a security-conscious approach to OAuth that utilizes TEEs, so that we can verify OIDC (OAuth) tokens in a fraud-proof way. Building on our existing TEE-based verifiable wallet infrastructure stack, we built a new secure enclave application to fetch content over TLS—known as our "TLS fetcher".

So, how does the TLS fetcher work? We’ve developed a way for enclaves to establish TLS connections, make requests, and cryptographically sign responses. Enclaves can contact remote hosts via a TCP (layer 4) proxy running outside of the trusted boundary. The secure enclave code asks the proxy to establish TCP-level connections, but remains in control of the TLS session (layer 7). The TLS session keys live in the secure enclave, on the target host, and nowhere else.

For a more technical perspective on TLS sessions within TEEs and the novel use cases it unlocks, read our Founding Engineer’s blog post with a deep dive on how we built the TLS fetcher enclave.

Stay tuned, or subscribe to our engineering blog ahead of time to get it when it drops.

As crypto continues to evolve, AI agents will play an increasingly important role. However, we and Spectral Labs believe that crypto is still massively constrained by UX limitations, including those stemming from a subpar wallet experience. By deploying AI agents such as their SYNTAX AI, Spectral Labs recognizes the potential for agents to fundamentally transform how users interact onchain and redefine the industry’s current UX paradigm.

Here’s how they’re doing it with Turnkey:

The problem: Limitations of existing crypto UX

Wallet UX in crypto is still largely a limiting factor in how humans currently interact with onchain applications and protocols. Manually managing wallet addresses and seed phrases can be a pain for new entrants, and even experienced users are often forced to navigate fluctuating transaction fees, sandwich attacks, and gas volatility across multiple chains and assets.

Spectral Labs is building its SYNTAX platform, which allows users to create their own onchain AI agents, to address these onchain UX challenges. However, agents require an even higher level of trust and security to execute on behalf of the user, so that a user’s intent is aligned with the actions of the AI agent. How can you create an agentic wallet that is capable of executing complex financial transactions, without compromising on security or performance?

The solution: Creating non-custodial, secure wallets for AI Agents

In order for SYNTAX’s agents to autonomously and trustlessly deploy and run smart contracts, Spectral Labs integrated Turnkey to create Smart Wallets for each agent. As a result, an AI agent can send any arbitrary smart contract action to a paymaster via the Agent Wallet, without manual verification from a third party. Here’s how that works:

• Once users are signed into the SYNTAX platform, they are prompted to create a Gas Tank and an Agent Wallet

• Agent Wallets are set up as a 1:2 multisignature contract where both AI agents and Spectral Labs SYNTAX users can broadcast transactions from a single wallet

• Users can then request the Agent to perform onchain transactions via Spectral Labs’s Execution Engine, and deposit funds into the wallet for said transactions

• Turnkey signs transactions on behalf of the Agent wallet without triggering a third-party verification flow

• Only AI agents and their respective users have access to their private keys

• Turnkey’s flexible policy engine provides fine-grained controls for how Agents use their private keys, including platform-wide limits for transaction amounts and signature patterns

Turnkey is excited to collaborate with Spectral Labs to create autonomous AI Agents frictionless onchain interactions. By utilizing Turnkey’s secure embedded wallets, scalable signing primitives, and flexible policy engine, Agent Wallets within Spectral SYNTAX are an exciting step forward for the intersection of crypto and AI.

About Spectral Labs

Spectral Labs is pioneering the machine intelligence network for the Onchain Agent Economy. The company's flagship product, Spectral Labs Syntax, enables users to create Onchain Agents by translating natural language intents into executable code. These Agents seamlessly interact via the Inferchain, a dedicated chain for agent engagement, ownership, and communications, allowing users to handle complex onchain operations autonomously and transparently. With over 60,000 users, Syntax has generated more than 1 million smart contracts and engaged agents in complex onchain tasks, such as launching over 4,700 memecoin projects. By enabling users to build and utilize AI Agents that can autonomously perform sophisticated tasks, Spectral Labs is committed to transforming how users interact in Web3, empowering them to create exponential value onchain. For more information, [visit their website](https://Spectral Labslabs.xyz/), or follow Spectral Labs on Twitter and Discord.

About Turnkey

Turnkey is secure, flexible, and scalable wallet infrastructure offering low-level primitives for teams building onchain applications and infrastructure. Founded by the team that built Coinbase Custody, Turnkey is powering serious applications across a wide range of use cases, from  wallets-as-a-service to programmatic backend crypto automation. By leveraging a novel security framework, Turnkey achieves 50-100ms signing latency for millions of wallets, all with affordable transaction-based pricing that’s designed for scale.

Infinex is aiming to solve this problem by building an aggregated UX layer for any onchain protocol. By offering the most secure and reliable tools to interface with an unpredictable and unforgiving crypto ecosystem, Infinex is revolutionizing the DeFi experience by providing a simple way to access all that crypto has to offer, without compromising on user safety and experience.

Here’s how they did it with Turnkey:

The problem: Securely managing private keys for user-operated Infinex accounts

Before Turnkey, Infinex’s security architecture relied on other providers to manage the Browser, Device, MFA, and Recovery Keys used to operate the Infinex account. As outlined in Infinex’s XIP-2 Security Proposal, this was implemented in order to “emulate the structural interface of the CeFi solution in a trustless and decentralized fashion,” or in other words, to make the DeFi experience as smooth and painless as possible.

However, these solutions created a vector for potential compromised user safety due to a divergence of security logic from the Ethereum smart contract logic, leading Infinex to seek out alternative, more secure solutions.

The solution: Building secure wallet architecture with Turnkey

To address their needs for secure key management, user account creation and authentication, and account operation, Infinex turned to Turnkey. Using Turnkey’s API, Infinex is generating private keys for signing onchain transactions on behalf of users, which are neither accessible to Infinex nor Turnkey.

Johnny_TVL

@john_tv_locke

I cannot believe this onboarding experience @infinex_app

Infinex.xyz/speedrun

Coinbase paid for transfers bc I sent from CB wallet.

Now farming Infinex on @base, and I can’t wait to have a good perp DEX on my phone.

I did the whole thing on my phone. 3 minutes. Magic.

10

9:28 AM • May 14, 2024

Take a look at Infinex’s onboarding flow for new users, powered by Turnkey:

Infinex’s results

• With an embedded wallet creation flow that felt like “magic”, Infinex was able to secure $95m in TVL via Turnkey-powered non-custodial wallets (source)

• Using passkey-powered authentication, Infinex users are able to deposit and stake without opening a wallet pop-up modal

• Infinex users were able to set up multiple recovery mechanisms for their account, secured via passkeys

About Infinex

Infinex is an onchain UX layer that provides secure, direct access to decentralized protocols for a web2 audience. The platform aims to accelerate onchain adoption and by offering a seamless user experience while upholding principles of decentralization – transparency, self-custody, and composability.

About Turnkey

Turnkey is secure, flexible, and scalable wallet infrastructure offering low-level primitives for teams building onchain applications and infrastructure. Founded by the team that built Coinbase Custody, Turnkey is powering serious applications across a wide range of use cases, from  wallets-as-a-service to programmatic backend crypto automation. By leveraging a novel security framework, Turnkey achieves 50-100ms signing latency for millions of wallets, all with affordable transaction-based pricing that’s designed for scale.

Part of making the Turnkey product suite more developer-friendly includes leveling up our client SDKs. Over the past couple of weeks, we’ve repackaged our existing client libraries into a few simple, consolidated SDKs, and introduced support for React Native and Swift: you can now use these new libraries to integrate a number of Turnkey’s composable primitives in an intuitive way!

React SDK

Turnkey’s revamped React SDK makes it much simpler for developers to build embedded wallet flows with Turnkey. We’ve added powerful abstractions so that it’s easier to integrate wallets for your end users.

For example, here’s how you would create a non-custodial wallet on behalf of a user with a passkey credential:

1. Initialize the passkey client by importing @turnkey/sdk-browser

2. Create a local passkey credential, which will prompt a user natively in their browser to create a passkey

3. Pass the credentials to the backend, where you can call createSubOrganization

For more details, you can check out our Quickstart guide.

Browser + Server

Our new sdk-browser and sdk-server libraries abstract away low level details, to reduce the lines of code you need to interact with Turnkey. We’ve also included convenience methods that encapsulate common actions such as creating a new passkey, initiating a read-only session, and working with Email Auth, Import, and Export. Implementation details can be found here - we’ve also set up an updated demo embedded wallet for your convenience.

These improvements are further built upon in our new React library, which offers further abstractions. Here’s an example where we create a new embedded wallet for a user:

Before:

After:

React Native

We’ve also added a brand new React Native passkey stamper. This enables developers to authenticate Turnkey requests using passkeys within React Native applications. You can find an example React Native application that uses this new package here!

Additionally, we’ve added support for email authentication in React Native without having to rely on an iframe. You can check out an example here. And for the curious, we’ve published a library that includes cryptographic primitives for HPKE decryption, all without relying on WebCrypto.

Swift SDK

Our brand new Swift SDK provides a robust set of functionalities to interact with the Turnkey API, and is also currently live here. The SDK makes it seamless for any iOS developers wanting to build applications with Turnkey.

After installation, developers can utilize the Swift SDK to initialize the TurnkeyClient with API keys or passkeys. You can find an example iOS application built with the Turnkey Swift SDK here.

Start building on Turnkey

Ready to get started with Turnkey, or have feedback on any of our new SDKs? Check out our integration guide (it’s free to start), join our community support Slack, or reach out to hello@turnkey.com to chat with us directly!

Website | Twitter | LinkedIn | Farcaster

Before a user can do anything onchain, they have to jump through a series of hoops: download a browser extension, write down their seed phrase, and figure out how to approve a transaction for the first time. And because this happens before users even touch your product, it’s nearly impossible to get them to stay if something goes wrong.

Today, there is still a lack of proper infrastructure to address the crypto UX problem. But instead of approaching this problem from first principles, others are remedying it by creating shinier wallets and slicker UI components. None of this will onboard the next billion users when crypto’s fundamental UX issues stem from the inherent challenges of self-custody and securing wallets behind the scenes.

Turnkey is addressing the crypto UX problem from the ground up. We believe that developers shouldn’t sacrifice security and scalability for convenience, and that most infrastructure providers on the market today are too opinionated for developers to build seamless onchain experiences for their users.

Today, we’re thrilled to announce that we’ve raised a $15M Series A co-led by Lightspeed Faction and Galaxy Ventures, with participation from Sequoia, Coinbase Ventures, Alchemy, Figment Capital, Mirana Ventures, and more, to accelerate innovation in crypto. Our co-founders Bryce and Jack met while building Coinbase Custody into the largest crypto custodian in the world, taking it from 0 to $100B+ in assets. Jack then went on to become the CTO of Polychain where he led infrastructure for the $10B fund, and Bryce launched Trade Republic’s crypto product to millions across Europe. Our world-class team currently includes exceptional senior talent from Coinbase, Polychain, Parity, BitGo, and other top crypto companies.

Turnkey offers secure, flexible, and scalable wallet infrastructure for developers to build anything that involves a wallet or cryptographic transaction. This is the infrastructure necessary for crypto developers to bring more users and institutions onchain.

Most importantly, our infrastructure already powers some of the best developer tools and applications in crypto:

• Alchemy has integrated Turnkey to provide embedded and smart wallet services as part of Account Kit

• Dynamic offers mobile-first passkey embedded wallets to developers, powered by Turnkey

• Thunder Terminal is embedding wallets directly with Turnkey-enabled biometric passkey logins, so that users no longer have to manually approve transactions for onchain trades

• Kinto, a DeFi-focused L2 rollup, has built their onboarding experience entirely on Turnkey, so that users can take their first action onchain without ever touching a seed phrase

This isn’t coincidental—our focus on bespoke tooling and verifiable security is what enables companies like Halliday, Goldfinch, Squads, Terrace, Mural, and others to build web2-like experiences for their crypto product.

Turnkey believes that a true upgrade for web3 users doesn’t just entail making wallets more beautiful or simpler to use; it requires that we challenge preexisting notions of how we interact onchain entirely. It’s on us to build a decentralized future, and we’re excited to power the next wave of crypto products to accelerate this vision.

About Turnkey

Ready to get started with Turnkey? Check out our quickstart guide (it’s free to start), join our community support Slack, or contact us to tell us what you’re building!

P.S. We’re hiring.

Website | Twitter | LinkedIn | Farcaster

In addition to our Export feature, you can now import wallets into the Turnkey infrastructure, which can take the form of either a 12-24 word seed phrase or a private key in hexadecimal (Ethereum-compatible) or Solana format. This makes it easier for your team or your users to securely transfer existing private keys to Turnkey. This powerful functionality is not only great for end users bringing their wallets to a Turnkey-powered app, but also for developers wishing to import existing private keys that they use for their own operations.

Secure private key import

One of our biggest priorities was making sure that Import is secure from top to bottom, ensuring that neither Turnkey nor any intermediaries ever have access to the wallet’s seed phrase or private key.

Here’s how that works:

• User initiates the import process through a designated page in your app, establishing a secure channel between the client and Turnkey’s secure enclaves.

• User enters their wallet seed phrase or raw private key via an iframe containing encryption credentials that only they have access to.

• The iframe encrypts the wallet seed phrase and transmits the resulting ciphertext over the secure channel to the Turnkey enclave.

This encryption protocol is unique to Turnkey, ensuring that only the end user ever has access to the wallet’s seed phrase — neither Turnkey nor developers in between are able to access it in plaintext. To accomplish this, both the user’s client and secure enclave generate ephemeral public keys and initiate a key exchange to compute a shared secret. This shared secret is used to encrypt private keys and wallets that can only be decrypted in the secure enclave. It is also scoped to the specific user performing import, guaranteeing that no one else can intercept the import process.

Customers like TokenSight are already utilizing our Import functionality to improve the user experience on their self-custodial trading platform. Users can easily import their Ethereum or Solana wallets into TokenSight to take advantage of their advanced trading features. Once imported, only the user can authorize TokenSight to perform actions using their passkey, which ensures that the end user is always in control of their wallet.

With the ability to both import and export private keys, Turnkey now offers more interoperability and security than ever for serious teams wanting to build web2-like experiences for their crypto application, and for teams needing to manage existing wallets internally to upgrade their background automation capabilities.

Start building on Turnkey

Ready to get started with Turnkey? Check out our integration guide (it’s free to start), join our community support Slack, or reach out to hello@turnkey.com to chat with us directly!

Website | Twitter | LinkedIn | Farcaster

While building Heron Finance on the Goldfinch protocol provides major advantages in terms of cost, transparency, and interoperability, Heron set out to make sure this product was accessible to more people — even investors that had no exposure or interest in blockchain. That’s when they turned to Turnkey.

The problem: Making onchain private credit work for everyone

Heron’s main goal is to make private credit widely accessible. That meant building a user experience which would abstract away the pains and challenges of self-custody, such as writing down a seed phrase or using a pop-up modal to approve transactions.

To do so, they set out to implement a user experience that combined ease of use and familiarity with high security, without relying on traditional usernames and passwords. Furthermore, the solution needed to be scalable, secure, and keep investors in control of their assets.

The solution: AA wallets powered by a Turnkey signer

To streamline the user journey, Heron Finance built an implementation of AA wallets, powered by a Turnkey signer. When a user is onboarded to Heron Finance, they are individually provisioned with a private key unique to them and controlled via passkey, ensuring that only the end user can authorize transactions. Leveraging Turnkey’s passkey authentication feature not only enhanced security, but also maintained the non-custodial essence of crypto while making the platform accessible and user-friendly for most investors.

In short, Heron Finance managed to create a platform that’s easy for a mainstream audience to use, combining the best of crypto with a smooth, web2-like user experience. We’re proud to support them in making finance more accessible, by using onchain technologies to bridge the gap between traditional and decentralized finance.

Heron’s results

• Invisible wallets built right into the Heron Finance app for a web2-like user experience

• Transactions which are secured and authenticated with Turnkey-enabled passkeys

About Heron Finance

As the first robo-advisor for private credit, Heron Finance invests in loans to small and medium sized businesses in the US and globally, then allows accredited investors to participate in those deals. Investors receive steady monthly payments of interest, which they can choose to reinvest on the platform or transfer to another institution. Heron Finance automatically allocates and rebalances investor portfolios, depending on their risk preferences. Their experienced in-house credit team sources and monitors the risk of all deals to maximize returns and reduce risks. Only the most qualified businesses are approved by its credit team. Heron Finance was built by the a16z-backed Warbler Labs team, which also supports the development of the Goldfinch protocol.

About Turnkey

Turnkey is secure, flexible, and scalable wallet infrastructure offering low-level primitives for teams building onchain applications and infrastructure. Founded by the team that built Coinbase Custody, Turnkey is powering serious applications across a wide range of use cases, from  wallets-as-a-service to programmatic backend crypto automation. By leveraging a novel security framework, Turnkey achieves 50-100ms signing latency for millions of wallets, all with affordable transaction-based pricing that’s designed for scale.

Website | Twitter | LinkedIn | Farcaster

In that world, web3 becomes more fragmented in terms of user onboarding, liquidity, and overall user experience. How do you buy an NFT with 5 balances across 5 chains? Or onramp funds directly to a L2?

Turnkey is excited to partner with Halliday to address the chain fragmentation problem and help create a unified layer for appchains.

Halliday saw firsthand the challenge of onboarding users and getting them to spend their first dollar onchain in a multichain world. The complexity of crypto has been fully pushed to users — they’re forced to navigate disparate onramps, use fragmented wallets, and operate complex bridging protocols just to use new crypto products. They realized that by creating appchain infrastructure, they could unify this experience and keep the messiness of crypto behind the scenes.

Halliday’s infrastructure aggregates balances across chains for purchases, swaps, and bridging, all in a single, one-click transaction. Alongside this, Turnkey powers authentication and signing via an underlying multi-chain EOA signer. Together, Halliday and Turnkey result in a seamless multichain experience.

“Web3 apps need a wallet infrastructure solution that’s performant at scale and can accommodate the complexity of a multichain ecosystem. In that world, security of wallets becomes even more complex. We’re excited to work alongside Turnkey to streamline how users transact across appchains.” – Griffin Dunaif, CEO @ Halliday

By abstracting away the challenges of managing assets across multiple appchains, Halliday and Turnkey are creating delightful new experiences across the user lifecycle for the crypto applications of the future.

About Halliday

Halliday is the first Intent Orchestration Protocol, solving the problem of first dollar spent and asset management across many rollups. Our proprietary Orchestration Protocol enables seamless onboarding, one-click acquisition, and seamless many-rollup balance abstraction.

About Turnkey

Turnkey is secure, flexible, and scalable wallet infrastructure offering low-level primitives for teams building onchain applications and infrastructure. Founded by the team that built Coinbase Custody, Turnkey is powering serious applications across a wide range of use cases, from  wallets-as-a-service to programmatic backend crypto automation. By leveraging a novel security framework, Turnkey achieves 50-100ms signing latency for millions of wallets, all with affordable transaction-based pricing that’s designed for scale.

As a result, teams are now working towards a safer vision of DeFi that everyone can use. When Kinto approached Turnkey, safety and usability were an integral part of their vision to build a DeFi-focused L2 rollup. But their goal of creating a safe and KYC-ready L2 that bridges TradFi and DeFi wouldn’t be possible without their relentless focus on improving the crypto user experience.

Here’s how they did it with Turnkey:

The problem: Bootstrapping a safe & user-friendly DeFi network

In order to onboard and reward valuable participants to the network as early as possible, Kinto launched Engen, a sybil-resistant program to maximize value creation and distribution for their protocol. Users are able to participate in the program to earn future rewards such as priority access to products on Kinto, reduced fees, and gas rebates.

But sybil behavior is often a core challenge in implementing incentive programs like Engen. Kinto saw the need to build a KYC flow that stayed true to permissionless and decentralized principles while keeping sybils at bay, so that users could have a safe and seamless experience once onboarded to Kinto.

The solution: Building a custom KYC authentication flow with Turnkey

This is where Turnkey comes in. In order for users to sign transactions and create contracts onchain, Kinto users must go through a custom third-party KYC flow, with KYC providers selected via governance. Kinto approached Turnkey to make this onboarding flow as smooth as possible.

After the initial KYC process, users receive a soulbound NFT minted by Kinto verifying their KYC status, which then enables them to create a non-custodial smart account wallet using a Turnkey-managed externally-owned account (EOA) as the core signer. Users are able to create these Kinto-embedded wallets with a few clicks. Each Kinto smart account wallet has signers managed by Turnkey, allowing users to use passkey-enabled signatures and set up user-friendly recovery methods, should they ever lose their private keys. Sending transactions can be done with a single finger tap.

Because of this user-owned KYC and authentication system, Kinto is sybil-resistant by design, and users can experience the full range of Dapps on Kinto via a seamless, web2-like user experience.

Kinto’s results

• Leveraging Turnkey’s web2 authentication methods make wallet UI/UX invisible to the point that multiple new users asked, “Is that it?” at the end of the onboarding process.

• With this easy onboarding, Kinto was able to onboard 25K new users so far during its Engen launch program

• Turnkey’s flexibility enabled Kinto to build fully automated user recovery flows, backed by a decentralized KYC process

• Kinto’s Engen Phase 4 is now open, and has raised $4.61M in TVL - making them the #34th top L2 (source)

About Kinto

Kinto is the safety-first L2 designed to accelerate the transition to an on-chain financial system. It features user-owned KYC and native account abstraction to solve the biggest blockers to mainstream adoption: security and user experience. Kinto offers safety assurances and compliance tooling to facilitate the interactions between institutional capital and Ethereum on-chain opportunities. If you believe in this on-chain financial system, join Kinto's launch program (Engen) and become a founding member at https://engen.kinto.xyz

About Turnkey

Turnkey is secure, flexible, and scalable wallet infrastructure offering low-level primitives for teams building onchain applications and infrastructure. Founded by the team that built Coinbase Custody, Turnkey is powering serious applications across a wide range of use cases, from  wallets-as-a-service to programmatic backend crypto automation. By leveraging a novel security framework, Turnkey achieves 50-100ms signing latency for millions of wallets, all with affordable transaction-based pricing that’s designed for scale.

The problem: Onboarding non-crypto native businesses

In building a stablecoin payments app that would have broad appeal and usability, Mural faced a significant challenge: integrating a user-friendly, secure, and seamless onboarding and authentication process that didn’t necessitate prior crypto knowledge or ownership of a pre-existing crypto wallet. The team wanted the experience of using Mural to feel like using any other conventional web application. Plus, security of funds on Mural shouldn’t be contingent on meticulous management of a seed phrase but rather intuitive logical permissions workflows and familiar biometric authentications, and funds should be recoverable even if users lost a device or forgot a password.

In addition to all of the above, it was important to Mural that user funds remained non-custodial.

Addressing all of these simultaneous ambitions led Mural to Turnkey.

The solution: Invisible Turnkey wallets with passkey authentication

To create the user experience they wanted, Mural collaborated with Turnkey to build a solution redefining user interactions with crypto payments.

Using Turnkey, Mural set up an implementation where for each new user, a wallet is created invisibly in the background which functions as an Externally Owned Account (EOA) signer for smart contract accounts. With this implementation, users can engage with the Mural platform as simply as they would with any traditional web application, complemented by the security and convenience of biometric authentication for transaction approvals.

Mural’s implementation also took advantage of Turnkey’s policy engine, enabling customizable permissions workflows for teams managing stablecoin payouts on Mural. Finally, building these invisible wallets on Turnkey meant that Mural is able to offer email recovery as a default, giving users a safety net against loss of funds due to device loss or forgotten passwords.

Mural’s latest feature continues to push the boundaries of crypto UX; now on Mural, users have the ability to pay anyone with stablecoin using just an email address. This new feature launch was made possible by the flexibility of Turnkey’s infrastructure, making it possible for Mural to keep innovating on their product without needing to constantly seek out new vendors.

Mural’s results

• By allowing users without a pre-existing crypto wallet to sign up, Mural saw an immediate increase in the number of individuals and businesses onboarding

• Robust, multi-layered security protections including multiple approval workflows, backed by digital signatures

• Successfully launched Mural Connections, enabling teams on Mural to pay anyone with just an email address

About Mural

Mural is an instant global payments and invoicing platform. Move beyond slow international wires, costly transaction fees, and lack of transaction visibility with Mural.  More than just a payment method, Mural is designed to empower your business with an all-in-one platform combining global payments, automated invoicing, flexible account payable flows, and the latest in blockchain technology. Our mission is to make every international transaction fast, scalable, and secure.

About Turnkey

Turnkey is secure, flexible, and scalable wallet infrastructure offering low-level primitives for teams building onchain applications and infrastructure. Founded by the team that built Coinbase Custody, Turnkey is powering serious applications across a wide range of use cases, from wallets-as-a-service to programmatic backend crypto automation. By leveraging a novel security framework, Turnkey achieves 50-100ms signing latency for millions of wallets, all with affordable transaction-based pricing that’s designed for scale.

We’re excited to work with Alchemy on their latest release, Embedded Accounts. Embedded Accounts is the easiest way to onboard users to web3, with invisible authentication and transaction flows made possible by Turnkey.

Developers can now take advantage of Embedded Accounts to generate powerful smart accounts (ERC-4337) or simple EOAs to build the ideal UX for any use case.

Our partnership with Alchemy brings us one step closer to our mission to rebuild crypto UX from the ground up, empowering developers to build serious infrastructure and applications without sacrificing security or performance.

How it works

Turnkey is secure, flexible, and scalable wallet infrastructure. Founded by the team that built Coinbase Custody, Turnkey leverages a novel security model to power a wide range of use cases, from wallets-as-a-service to programmatic crypto signing.

With Embedded Accounts powered by Turnkey, developers can implement email, passkey, and social login (coming soon) authentication flows for non-custodial wallets they deploy on behalf of end users. Developers can also deploy smart accounts to enable gas sponsorship, batch transactions, and session keys. Further, Turnkey is extremely flexible when it comes to wallet authentication, offering a variety of options for customers to create custom authentication flows for their tool or application.

We can’t wait to help Alchemy reach the next wave of developers in crypto. Starting today, you can start building with Turnkey-enabled wallets via Alchemy’s Embedded Accounts. For more details, read Alchemy’s announcement here.

Why Turnkey

Alchemy chose Turnkey because we don’t take shortcuts with performance or security — and when millions of users depend on you, you need infrastructure that just works.

“Developers rely on Alchemy every day to build innovative applications in crypto. At our scale, security and reliability are paramount. We chose Turnkey because they’re one of the most secure wallet infrastructure solutions on the market. Their novel approach to security ensures end users remain in control of their private keys, while allowing us to create dramatically better UX.   —Will Hennessy, Product Lead

Experience Turnkey x Alchemy at ETHDenver

Exciting on-chain experiences are already being built with Embedded Accounts.

At ETHDenver, Alchemy, Base, and Royal will be hosting an IRL night of music at RIOT House with performances by 3LAU, Coopahtroopa, and more. Attendees will be able to scan their wristband to claim an NFT using only their Face ID or fingerprint — no need to create a wallet or write down your seed phrase.

Here’s how this will work:

1. The Royal app generates a passkey on-device

2. A crypto private key is generated inside Turnkey’s secure enclaves

3. A counterfactual smart account address is generated

4. Royal airdrops an NFT to the smart account

5. Later when the user sends their first on-chain operation, the smart account is silently deployed in a single batched transaction

See you in Denver!