diff --git a/rtc_auth_enclave/src/ecalls/save_access_key_impl.rs b/rtc_auth_enclave/src/ecalls/save_access_key_impl.rs
index ed6773e3..ec4de111 100644
--- a/rtc_auth_enclave/src/ecalls/save_access_key_impl.rs
+++ b/rtc_auth_enclave/src/ecalls/save_access_key_impl.rs
@@ -3,8 +3,23 @@
 use std::println;
 
 use rtc_types::enclave_messages::set_access_key;
+use uuid::Uuid;
 
-pub(crate) fn save_access_key_impl(request: set_access_key::Request) -> set_access_key::Response {
-    println!("TODO: save_access_key_impl({:?})", request);
-    set_access_key::Response { success: false }
+use crate::token_store;
+
+pub(crate) fn save_access_key_impl(
+    set_access_key::Request {
+        uuid,
+        access_key,
+        unsealed_size,
+    }: set_access_key::Request,
+) -> set_access_key::Response {
+    // TODO: Pass dataset size
+    let success = token_store::save_access_key(Uuid::from_bytes(uuid), access_key, unsealed_size)
+        .map_err(|err| {
+            println!("token_store::save_access_key failed: {}", err);
+            err
+        })
+        .is_ok();
+    set_access_key::Response { success }
 }
diff --git a/rtc_auth_enclave/src/token_store.rs b/rtc_auth_enclave/src/token_store.rs
index 2923ddf0..68eaecae 100644
--- a/rtc_auth_enclave/src/token_store.rs
+++ b/rtc_auth_enclave/src/token_store.rs
@@ -71,7 +71,6 @@ fn kv_store<'a>() -> MutexGuard<'a, impl KvStore<ExecutionTokenSet, Error = io::
 /// # Panics
 ///
 /// If `dataset_uuid` already exists in the store. (This should not happen.)
-#[allow(dead_code)] // TODO
 pub(crate) fn save_access_key(
     dataset_uuid: Uuid,
     access_key: [u8; 24],