Authorizations
API Key
WebAuthn (Passkey)
Cryptographically signed (stamped) request to be passed in as a header. For more info, see
here.
Cryptographically signed (stamped) request to be passed in as a header. For more info, see
here.
Body
Enum options: ACTIVITY_TYPE_OAUTH
Timestamp (in milliseconds) of the request, used to verify liveness of user requests.
Unique identifier for a given Organization.
The parameters object containing the specific intent data for this activity.
Base64 encoded OIDC token
parameters.targetPublicKey
Client-side public key generated by the user, to which the oauth bundle (credentials) will be encrypted.
Optional human-readable name for an API Key. If none provided, default to Oauth - <Timestamp>
parameters.expirationSeconds
Expiration window (in seconds) indicating how long the API key is valid for. If not provided, a default of 15 minutes will be used.
parameters.invalidateExisting
Invalidate all other previously generated Oauth API keys
Enable to have your activity generate and return App Proofs, enabling verifiability.
Response
A successful response returns the following fields:
The activity object containing type, intent, and result
Unique identifier for a given Activity object.
Unique identifier for a given Organization.
The intent of the activity
activity.intent.oauthIntent
The oauthIntent object
activity.intent.oauthIntent.oidcToken
Base64 encoded OIDC token
activity.intent.oauthIntent.targetPublicKey
Client-side public key generated by the user, to which the oauth bundle (credentials) will be encrypted.
activity.intent.oauthIntent.apiKeyName
Optional human-readable name for an API Key. If none provided, default to Oauth - <Timestamp>
activity.intent.oauthIntent.expirationSeconds
Expiration window (in seconds) indicating how long the API key is valid for. If not provided, a default of 15 minutes will be used.
activity.intent.oauthIntent.invalidateExisting
Invalidate all other previously generated Oauth API keys
The result of the activity
activity.result.oauthResult
The oauthResult object
activity.result.oauthResult.userId
Unique identifier for the authenticating User.
activity.result.oauthResult.apiKeyId
Unique identifier for the created API key.
activity.result.oauthResult.credentialBundle
HPKE encrypted credential bundle
A list of objects representing a particular User’s approval or rejection of a Consensus request, including all relevant metadata.
An artifact verifying a User’s action.
Whether the activity can be approved.
Whether the activity can be rejected.
The last update timestamp.
curl --request POST \
--url https://api.turnkey.com/public/v1/submit/oauth \
--header 'Accept: application/json' \
--header 'Content-Type: application/json' \
--header "X-Stamp: <string> (see Authorizations)" \
--data '{
"type": "ACTIVITY_TYPE_OAUTH",
"timestampMs": "<string> (e.g. 1746736509954)",
"organizationId": "<string> (Your Organization ID)",
"parameters": {
"oidcToken": "<string>",
"targetPublicKey": "<string>",
"apiKeyName": "<string>",
"expirationSeconds": "<string>",
"invalidateExisting": "<boolean>"
}
}'
{
"activity": {
"id": "<activity-id>",
"status": "ACTIVITY_STATUS_COMPLETED",
"type": "ACTIVITY_TYPE_OAUTH",
"organizationId": "<organization-id>",
"timestampMs": "<timestamp> (e.g. 1746736509954)",
"result": {
"activity": {
"id": "<string>",
"organizationId": "<string>",
"status": "<string>",
"type": "<string>",
"intent": {
"oauthIntent": {
"oidcToken": "<string>",
"targetPublicKey": "<string>",
"apiKeyName": "<string>",
"expirationSeconds": "<string>",
"invalidateExisting": "<boolean>"
}
},
"result": {
"oauthResult": {
"userId": "<string>",
"apiKeyId": "<string>",
"credentialBundle": "<string>"
}
},
"votes": "<array>",
"fingerprint": "<string>",
"canApprove": "<boolean>",
"canReject": "<boolean>",
"createdAt": "<string>",
"updatedAt": "<string>"
}
}
}
}