Don't trust our website.
Verify it.
A single file you download and open. It authenticates with a read-only credential that you generate in your own browser, talks straight to the enclave, and prints what is actually there.
reading https://api.turnkey.com directly · read-only credential
who_am_iConfirm which vault we are readinglist_usersCheck for credential driftget_authenticatorsCheck registered authenticatorslist_policiesRead the raw policy conditionslist_activitiesDecode the pending transaction locallyThis is a demonstration running against sample data. The real verifier is a single file you download and open yourself, and it authenticates with a credential you generate that we never see.
what it checks
The four things worth checking.
Credential drift
Root credentials bypass every policy, so a rogue root user would make every other check meaningless. This is the most important thing the verifier does, and the first thing it reports.
The raw policy
The enclave returns policy conditions verbatim, unparsed. The destination, the exact amount, and the pinned blockhash are all right there in plain text to compare against what the panel told you.
The pending transaction
Decoded locally from raw bytes in the tab you are looking at. This is what catches a panel that displays one transaction while submitting another.
Which vault you are reading
The verifier prints the sub-organisation id it authenticated against, so nobody can point you at a decoy vault that looks healthy.
what a mismatch looks like
Get the verifier
Hosted on GitHub, not on our infrastructure. Every release is published with a signed hash so a copy you already have cannot be swapped out from under you.
npx @vault/verify --org b4c2f8a1
✓ who_am_i sub-org matches
✓ list_users 3 root · no drift
✓ get_authenticators 3 registered
✓ list_policies 6 · conditions match
✓ list_activities 1 pending · decoded
PANEL MATCHES ENCLAVE