Choose a path
Quickstart
Create an account, connect a key, and sign a message.
Widget
Embed OpenKey connect and sign flows in your app.
OAuth
Use OpenKey as an OAuth 2.1 provider.
TinyCloud integration
Use OpenKey as the signer for TinyCloud sign-in.
Local development
Run OpenKey and Secret Manager locally and verify the browser flow.
Relationship to TinyCloud
TinyCloud signs users in with SIWE. OpenKey supplies the signer for that flow, so users can authenticate to TinyCloud with passkeys instead of a browser wallet extension. OpenKey OAuth is separate from TinyCloud sign-in:- Use TinyCloud integration when you need OpenKey to sign TinyCloud’s SIWE flow
- Use OAuth when you need tokens for your own application
Keys and the primary key
An OpenKey account can hold several keys. Each key is a separate TinyCloud owner with its own spaces and data. One key is primary: OpenKey preselects it on/delegate approvals (the CLI, agents, and MCP connect), and apps that
request tinycloud:manage-key use it. Widget sign-in still asks the user to
pick when the account has several keys. To change it, open a key from Your
Keys on the dashboard with Manage and choose Make primary; only
OpenKey-managed keys can be primary. Switching the primary key does not move any
data between owners.
Approving CLI and agent requests
The TinyCloud CLI and agents ask the owner for scoped access through two OpenKey pages:
Device approvals are limited to KV access in one space and expire after 30
days at most. Ordinary
/delegate links only return to the local machine or a
registered TinyCloud callback such as the hosted MCP service. See
CLI authentication for the commands.