Module auth 

Tempo wallet device-code authorization flow.

Implements the CLI side of the tempoxyz/accounts cli-auth device-code protocol: generates a local secp256k1 access key, creates a PKCE-protected device code, opens wallet.tempo.xyz/cli-auth?code=<CODE> in the browser, polls until the user authorizes the key on their passkey wallet, and writes the resulting keyAuthorization to ~/.tempo/wallet/keys.toml.

Structs

AccessKeyOutcome

Result of ensure_access_key.

CreateCodeRequest 🔒

CreateCodeResponse 🔒

EnsureAccessKeyConfig

Configuration for ensure_access_key.

PollRequest 🔒

Enums

PollResponse 🔒

Matches tempoxyz/wallet poll response shape.

Constants

DEFAULT_CLI_AUTH_URL 🔒

Default device-code service URL (production wallet.tempo.xyz).

DEFAULT_POLL_INTERVAL 🔒

DEFAULT_TIMEOUT 🔒

TEMPO_CLI_AUTH_URL_ENV 🔒

Env var to override the device-code service URL (for tests / staging).

Statics

AUTH_LOCK 🔒

Per-process serialization of concurrent ensure_access_key calls.

Functions

create_code_with_retry 🔒

POST /code with exponential backoff on transient errors, bounded by timeout.

ensure_access_key

Run the device-code flow, persist the resulting key to keys.toml, and return the new entry’s identifying fields.

is_known_tempo_endpoint 🔒

Returns true if url’s host is tempo.xyz or a subdomain of it.

is_transient_error 🔒

is_transient_status 🔒

open_browser 🔒

Open url via the OS default browser handler. On platforms without a known opener, this is a no-op (the URL is still printed by ensure_access_key).

random_code_verifier 🔒

serialize_u64_hex 🔒

sha256_b64url 🔒