Module auth 

Tempo wallet device-code authorization flow.

Implements the CLI side of the tempoxyz/accounts cli-auth device-code protocol: generates a local secp256k1 access key, creates a PKCE-protected device code, opens wallet.tempo.xyz/cli-auth?code=<CODE> in the browser, polls until the user authorizes the key on their passkey wallet, and writes the resulting access key to the Tempo Accounts store.json.

Re-exports

use crate::tempo::decode_key_authorization; 🔒

use alloy_primitives::Address; 🔒

use alloy_primitives::B256; 🔒

use alloy_primitives::hex; 🔒

use alloy_primitives::hex; 🔒

use alloy_signer_local::PrivateKeySigner; 🔒

use base64::Engine; 🔒

use base64::engine::general_purpose::URL_SAFE_NO_PAD; 🔒

use eyre::Result; 🔒

use serde::Deserialize; 🔒

use serde::Deserialize; 🔒

use serde::Serialize; 🔒

use serde::Serialize; 🔒

use sha2::Digest; 🔒

use sha2::Sha256; 🔒

use std::env; 🔒

use std::env; 🔒

use std::sync::LazyLock; 🔒

use std::time::Duration; 🔒

use std::time::Instant; 🔒

use tempo_alloy::accounts::TempoAccountsKeyAuthorization; 🔒

use tempo_alloy::accounts::TempoAccountsStore; 🔒

use tempo_primitives::transaction::SignatureType; 🔒

use tempo_primitives::transaction::SignedKeyAuthorization; 🔒

use tokio::sync::Mutex; 🔒

use std::process::Command; 🔒 Unix or Windows

Structs

AccessKeyOutcome

Result of ensure_access_key.

CreateCodeRequest 🔒

CreateCodeResponse 🔒

EnsureAccessKeyConfig

Configuration for ensure_access_key.

PollRequest 🔒

Enums

PollKeyAuthorization 🔒

PollResponse 🔒

Matches tempoxyz/wallet poll response shape.

Constants

DEFAULT_CLI_AUTH_URL 🔒

Default device-code service URL (production wallet.tempo.xyz).

DEFAULT_POLL_INTERVAL 🔒

DEFAULT_TIMEOUT 🔒

TEMPO_CLI_AUTH_URL_ENV 🔒

Env var to override the device-code service URL (for tests / staging).

Statics

AUTH_LOCK 🔒

Per-process serialization of concurrent ensure_access_key calls.

Functions

create_code_with_retry 🔒

POST /code with exponential backoff on transient errors, bounded by timeout.

ensure_access_key

Run the device-code flow, persist the resulting key to store.json, and return the new entry’s identifying fields.

is_known_tempo_endpoint 🔒

Returns true if url’s host is tempo.xyz or a subdomain of it.

is_transient_error 🔒

is_transient_status 🔒

open_browser 🔒

Open url via the OS default browser handler. On platforms without a known opener, this is a no-op (the URL is still printed by ensure_access_key).

random_code_verifier 🔒

serialize_u64_hex 🔒

sha256_b64url 🔒