Store and control secrets without exposing plaintext
Build programmatic access to secrets into applications & agentic workflows with enclave-backed policies and encryption at every step.
Store secrets in isolated, controlled environments
Secure Enclaves
Import and store secrets in AWS Nitro Enclaves, never exposed in plaintext to Turnkey, ordinary server infrastructure or anyone not granted direct access.
Programmable Policies
Gate usage through enclave-enforced rules that control who can retrieve each secret, under what conditions, and with whose approval.
Cryptographic Audit Trail
Every export request, approver, and recipient is recorded as a signed Turnkey activity, ensuring full auditability.
Store and use secrets without plaintext exposure at any point
Secret Import
Import passwords, API keys and other sensitive credentials into Turnkey’s infrastructure, encrypted at the moment of import.
Secret Usage
Retrieve secrets from secure enclaves for encrypted use.
Transport Encryption
Encrypted secrets are exported only to be decrypted by the intended recipient.
Enforce when and how secrets are used
Flexible Authentication
Gate secrets usage via API keys, passkeys, or OAuth to align with your existing stack.
Granular Policies
Set rules that restrict secrets to authorized usage only, ensuring specific conditions are met for access.
Programmatic Access
Build automated credential access into applications and agentic workflows while keeping secrets protected from the agents or applications using them.
How Turnkey Managed Secrets are used
Frequently asked questions
Got any other questions?
Email — [email protected]
Managed Secrets extends Turnkey’s enclave-backed security foundation from private-key management to the secure storage and use of arbitrary secrets. Enclave-enforced authentication and policies let you control which people, applications, and agents can use each secret, under what conditions, and with whose approval, without revealing the secret in the process.
Managed Secrets allow you to securely import, store and use any arbitrary secret, including API secrets, private keys, payment information, recovery bundles and other sensitive credentials used across your organization. Whether you're building automated credential access for agents, enabling policy-gated use for members of your organization, or setting up recovery workflows, Turnkey provides a secure, auditable system for managing your secrets without exposing sensitive material to any unintended recipient.
No. Secrets are encrypted at the moment of import and stored for long-term use inside isolated, secure enclaves. Secrets are never exposed to Turnkey, or any unintended recipient.
Managed Secrets combines hardware-isolated enclave processing with encryption during import, storage, and export. Secrets are encrypted on your client before import, protected at rest with per-secret AES-256-GCM encryption keys, and re-encrypted for the intended recipient on export.
Authentication and enclave-enforced policies control release, including scoped permissions and multi-party approvals. Imports, exports, and approvals are recorded as attributable activities for auditing.
Managed Secrets supports storing arbitrary sensitive data such as API keys, passwords, payment details, encryption keys, and MPC keyshare or recovery bundles. Secrets are encrypted at the moment of import, so neither Turnkey nor unintended recipients can view or use the secrets.
Managed Secrets supports API keys, passkeys, OAuth, and OTP. Authentication establishes who is making the request; your policies determine which secrets they can retrieve and what additional approvals are required.
Customers use Managed Secrets to:
- Protect API secrets and sensitive data
- Enable approval-gated usage of credentials
- Grant access to secrets without revealing plaintext to the user
- Build automated agentic workflows for accessing sensitive material
- Implement enterprise-grade backup and recovery flows