Turnkey compatibility

Kryard exposes the exact Turnkey API surface for secp256k1 EVM signing — same endpoint paths, same activity envelope, same X-Stamp auth — over a KMS-encrypted key store and an isolated signer.

Cutover

If you already speak Turnkey, cutover is a single environment swap:

- TURNKEY_BASE_URL=https://api.turnkey.com
+ TURNKEY_BASE_URL=https://api.kryard.com

No client code changes. The public API is Turnkey-shaped; the signer is isolated and exposes only an internal interface, never the Turnkey surface.

Shapes to expect

Query endpoints use POST. The activity response is nested (activity.result.<type>Result) with { seconds, nanos } timestamps — match it; compatibility beats REST aesthetics at the boundary.

What's covered

• Private key + wallet/account creation (secp256k1 / Ethereum).
• Raw-payload and EVM transaction signing (EIP-1559 + legacy), Keccak-256.
• Activities with SHA-256(canonical_json(body)) idempotency, scoped per org.
• Deterministic, fail-closed policy; raw-payload signing off by default outside dev.

What's deferred

WebAuthn / passkeys / OAuth / OTP auth, raw key export, MPC, and full Turnkey feature parity are out of scope for the compatibility layer. The embedded-wallet platform (sub-orgs, auth, sessions, self-custodial MPC) is built on top and under active development.