KeyAuthorization

Tempo key authorization utilities for provisioning and signing access keys.

Access keys allow a root key (e.g., a passkey) to delegate transaction signing to secondary keys with customizable permissions including expiry timestamps and per-TIP-20 token spending limits. This enables a user to sign transactions without repeated passkey prompts.

Access Keys Specification

Examples

import { KeyAuthorization, SignatureEnvelope } from 'ox/tempo'
import { Address, Secp256k1, WebCryptoP256, Value } from 'ox'
 
const keyPair = await WebCryptoP256.createKeyPair()
const address = Address.fromPublicKey(keyPair.publicKey)
 
const authorization = KeyAuthorization.from({
  address,
  chainId: 4217n,
  expiry: 1234567890,
  type: 'p256',
  limits: [{
    token: 'tempox0x20c0000000000000000000000000000000000001',
    limit: Value.from('10', 6),
  }],
})
 
const privateKey = '0x...'
const payload = KeyAuthorization.getSignPayload(authorization)
const signature = SignatureEnvelope.from(
  Secp256k1.sign({ payload, privateKey }),
)
 
KeyAuthorization.from(authorization, { signature })

Functions

Name	Description
`KeyAuthorization.deserialize`	Deserializes an RLP-encoded `KeyAuthorization.KeyAuthorization`.
`KeyAuthorization.from`	Converts a Key Authorization object into a typed `KeyAuthorization.KeyAuthorization`.
`KeyAuthorization.fromRpc`	Converts an `AuthorizationTempo.Rpc` to an `AuthorizationTempo.AuthorizationTempo`.
`KeyAuthorization.fromRpcUnsigned`	Converts unsigned RPC fields before owner signing.
`KeyAuthorization.fromTuple`	Converts an `KeyAuthorization.Tuple` to an `KeyAuthorization.KeyAuthorization`.
`KeyAuthorization.getSignPayload`	Computes the sign payload for an `KeyAuthorization.KeyAuthorization`.
`KeyAuthorization.hash`	Computes the hash for an `KeyAuthorization.KeyAuthorization`.
`KeyAuthorization.serialize`	Serializes a `KeyAuthorization.KeyAuthorization` to RLP-encoded hex.
`KeyAuthorization.toRpc`	Converts an `KeyAuthorization.KeyAuthorization` to an `KeyAuthorization.Rpc`.
`KeyAuthorization.toRpcUnsigned`	Converts unsigned authorization fields to RPC before owner signing.
`KeyAuthorization.toTuple`	Converts an `KeyAuthorization.KeyAuthorization` to an `KeyAuthorization.Tuple`.

Errors

Name	Description
`KeyAuthorization.InvalidAdminMarkerError`	Thrown when a TIP-1049 admin marker has any value other than `0x01`.
`KeyAuthorization.InvalidSignatureTypeError`	Thrown when a key authorization contains a keychain signature.
`KeyAuthorization.InvalidWitnessSizeError`	Thrown when a `witness` field is not exactly 32 bytes.
`KeyAuthorization.MissingAccountError`	Thrown when a multisig key grant omits its parent account binding.

Types

Name	Description
`KeyAuthorization.Input`	Input type for a Key Authorization.
`KeyAuthorization.KeyAuthorization`	Key authorization for provisioning access keys.
`KeyAuthorization.Rpc`	RPC representation matching the node's wire format.
`KeyAuthorization.RpcCallScope`	RPC representation of a call scope (matches node's `CallScope` serde).
`KeyAuthorization.RpcSelectorRule`	RPC representation of a selector rule (matches node's `SelectorRule` serde).
`KeyAuthorization.RpcTokenLimit`	RPC representation of a token limit (matches node's `TokenLimit` serde).
`KeyAuthorization.Scope`	Call scope entry restricting which contract, selector, and recipients an access key can use.
`KeyAuthorization.Signature`	Signature that can authorize an access key.
`KeyAuthorization.SignatureRpc`	RPC-formatted signature that can authorize an access key.
`KeyAuthorization.Signed`	Signed representation of a Key Authorization.
`KeyAuthorization.TokenLimit`	Token spending limit for access keys.
`KeyAuthorization.Tuple`	Tuple representation of a Key Authorization.
`KeyAuthorization.Unsigned`	Authorization fields before owner signing.
`KeyAuthorization.UnsignedRpc`	Unsigned RPC authorization used before owner signing.