Create Tenant KV Maps - Terminal 3 Documentation

Documentation Index

Fetch the complete documentation index at: /llms.txt

Use this file to discover all available pages before exploring further.

A TEE contract needs one map before it can run: secrets, holding the API key. Create it with the TenantClient. The tail is the per-map local name; the host stores it as z:<tid>:<tail>.

await tenant.maps.create({
  tail: "secrets",
  visibility: "private",
  writers: { only: [contractId] },
  readers: { only: [contractId] },  // REQUIRED — the kv-governor denies reads when omitted
});

readers must be set explicitly — the KV governor defaults to deny, so leaving it off makes the contract’s own secret read fail with AccessDenied. MapAlreadyExists is idempotent — safe to re-run when re-deploying.Map visibility quick reference:

• "private" — only your contracts can access this map (default, use it for everything sensitive).
• "public" — world-readable via /api/dev/public-kv/<tid>/<tail>. Map tail must start with public:. Never put PII in a public map.

writers/readers restrict your contracts, not you. As the map’s owner you can always write its entries directly via the control plane (tenant.executeControl("map-entry-set", …)), even on a writers: { only: [contractId] } map — that’s how seeding the API key works. A contract-only map is not tamper-proof against its owner; see Storage Namespaces → Access model.