Get started — what you can build, and the shortest path to each

TEE Docker is one HTTP API for managed wallet workspaces. This page shows the common things you can build and the shortest path to each — new to the model first? Read the Overview.

You need a tenant API key and secret from your operator for everything but self-hosting. If you are the operator, Deploy issues them.

Examples on this page use $API_URL. Set it once, with the /v1 prefix included — every route lives under it:

export API_URL=https://<your-api-host>/v1

Sign your first message in six calls

The hello-world: create a workspace, mint a token to open it, create an account, and sign — about five minutes end to end.

curl -X POST "$API_URL/auth/token" \
  -H "X-Api-Key: $API_KEY" -H "X-Api-Secret: $API_SECRET" \
  -H "content-type: application/json" \
  -d "{\"workspace\":\"demo\",\"password\":\"$PASSWORD\"}"
# → { "token": "eyJ…", "scopes": ["read","write","sign"] }

Minting the token is the unlock — its lifetime is your session. → Quickstart walks all six calls.

Hand an end user a key their browser can hold

An end user should never see your workspace password. Mint them a durable, account-scoped API key — one opaque string they keep (say, in localStorage) that keeps working until the service restarts.

curl -X POST "$API_URL/auth/api-key" \
  -H "X-Api-Key: $API_KEY" -H "X-Api-Secret: $API_SECRET" \
  -H "content-type: application/json" \
  -d '{"workspace":"demo","password":"…","account":"trading-desk","tier":"basic"}'

A scoped key reads its bound account; unlimited adds sealed export. Signing and account management stay with a workspace token. → API keys and the scoped-key model.

Let a user export their private key — sealed to them

Recover a key to the end user, with the server never able to read it. The user generates an X25519 keypair, hands you the public inquiry key at mint, and the export comes back encrypted to it — only their private half opens it.

curl -X POST "$API_URL/accounts/treasury/wallets/1/export?vm=evm" \
  -H "Authorization: Bearer $SCOPED_KEY"
# → { "sealed": { "alg": "x25519-hkdf-sha256-aes256gcm", … } }

Export needs an Unlimited key with a live inquiry key. → Export key material for the client-side unseal.

Run the whole thing yourself

Stand up your own instance on Docker or Dokploy — you become the operator and issue the credentials the cases above assume. The runbook hands the work to an agent, or walks it by hand, and names the environment traps that stop boot.

→ Deploy, then Safe usage for the credentials you now hold.

Where to go next