Automation

Lit Protocol vs KeeperHub

Keep the job’s rules next to the key.

Compare where workflow code runs, who holds the signing key, and who can change a job after it is live.

By Lit Protocol · Reviewed November 2, 2026

Scope: Lit Triggers running Lit Actions in ChainSecured mode, and KeeperHub’s hosted workflow service, which KeeperHub labels as beta.

Operator authority

Three questions about operator authority.

Operator authority: Lit Triggers and Actions compared with KeeperHub
Control	Lit · Triggers + Actions	KeeperHub
Who can change the permissions?	Your account wallet approves on Base which Actions can use each PKP wallet. Lit’s 2-of-4 Safe can upgrade the account contracts without a timelock. Trigger settings, such as the schedule and whether a trigger is enabled, are changed through your Lit Triggers login.[2][7][8][9]	Workflows are changed through account logins, API keys, the CLI, or MCP, with organization and team roles. KeeperHub stores workflow configurations in its database. The optional Safe and Zodiac Roles setup adds an on-chain allowlist of calls.[10][4]
Who can approve replacement code?	Each Action version is fixed by its code hash. A new version cannot use a PKP wallet until your account authorizes it. Separately, Lit’s 2-of-4 Safe approves runtime releases, with no timelock.[1][2][8]	Organization members can create and edit workflows, including custom JavaScript that runs in a sandbox on KeeperHub’s service. The cited documentation does not describe pinning workflow code by hash.[11][12][10]
Who can stop access?	Lit runs the Triggers service that decides when each job fires, and the operator can pause signing. The service stores your usage key, so it can also run the Actions that key permits. Your permissions stay on-chain, but execution needs the runtime and key-management system. Recovery requires a separate plan.[13][7][14]	KeeperHub runs the scheduler and executes workflows. Its FAQ says scheduled workflows that would have fired during an outage do not run until the platform recovers. Signing also depends on Turnkey’s enclave infrastructure.[10][3]

Who can change the permissions?

Lit · Triggers + Actions: Your account wallet approves on Base which Actions can use each PKP wallet. Lit’s 2-of-4 Safe can upgrade the account contracts without a timelock. Trigger settings, such as the schedule and whether a trigger is enabled, are changed through your Lit Triggers login.[2][7][8][9]
KeeperHub: Workflows are changed through account logins, API keys, the CLI, or MCP, with organization and team roles. KeeperHub stores workflow configurations in its database. The optional Safe and Zodiac Roles setup adds an on-chain allowlist of calls.[10][4]

Who can approve replacement code?

Lit · Triggers + Actions: Each Action version is fixed by its code hash. A new version cannot use a PKP wallet until your account authorizes it. Separately, Lit’s 2-of-4 Safe approves runtime releases, with no timelock.[1][2][8]
KeeperHub: Organization members can create and edit workflows, including custom JavaScript that runs in a sandbox on KeeperHub’s service. The cited documentation does not describe pinning workflow code by hash.[11][12][10]

Who can stop access?

Lit · Triggers + Actions: Lit runs the Triggers service that decides when each job fires, and the operator can pause signing. The service stores your usage key, so it can also run the Actions that key permits. Your permissions stay on-chain, but execution needs the runtime and key-management system. Recovery requires a separate plan.[13][7][14]
KeeperHub: KeeperHub runs the scheduler and executes workflows. Its FAQ says scheduled workflows that would have fired during an outage do not run until the platform recovers. Signing also depends on Turnkey’s enclave infrastructure.[10][3]

The Lit advantage

Your on-chain rules govern what jobs can sign

A Lit Action runs inside the enclave that holds the wallet key, so the limits in its code are checked where the signature happens. Each version of the code is fixed by its hash, and your account approves on-chain which versions can use a PKP wallet.[1][2]

How Lit Triggers works

What control means in practice

KeeperHub states that it can only trigger the transactions your workflows define and that its employees cannot move your funds. Its optional Safe setup checks workflow calls against an on-chain allowlist, which KeeperHub describes as a scoping tool rather than a hard spending limit when the Safe has a single owner. Lit puts the rules in the code that runs with the key, and records on-chain which code can use it. In both, check who can change the schedule and who can stop it.[10][4][7]

Shared protections

Both keep signing keys in secure enclaves and offer schedule, webhook, and on-chain event triggers. KeeperHub provisions a Turnkey wallet for each organization, supports key export, and can put a Safe with an on-chain allowlist in front of that wallet.[3][4][5][6]

Sources and review scope

These comparisons use published documentation and the source code linked below. We have not audited or tested the providers’ live systems. Configurations vary, and source code alone does not establish who currently owns a deployed contract or how it is configured.

Get started with crypto

Explore Lit’s security