feat(core): GET-with-stamp auth endpoints + project-config OTP/magic-link#271
Merged
Conversation
Two backend changes on doorway-kms main require SDK adaptation. GET-behind-StampCheckUser (/authenticators, /user-wallet): - transport: add `stampPostion: 'timestamp'` — signs the unix-millis string, sends it as the X-Timestamp header plus the stamp header, and sends no body (matches the backend's FormatTimestamp contract). - getAuthenticators / getUserWallet: switch to GET + timestamp stamp. OTP / magic-link customization is now project-config-driven (wallet.otp_configs); the backend ignores client-supplied customization, so drop it: - remove otpCodeCustomization and emailCustomization from registerWithOTP, authenticateWithEmail, the core wallet wrapper, and the react sendOTP / sendMagicLink actions (plus their exported types). - magic-link URL template now comes from project config; remove redirectURL from sendMagicLink and magicLinkBaseUrl from react-kit's AuthConfig + UI. Verified: typecheck + build (core/react/react-kit/demo), 741 unit tests, and a live OTP register/login + getUserWallet round-trip against a local main backend.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Also remove stale redirectURL / magicLinkBaseUrl / otpCodeCustomization examples from the core/react/react-kit READMEs to match the API changes.
The SDK no longer sends otpCodeCustomization, so OTP length is the backend default (6) rather than the 7 the tests used to force. Parse accordingly.
brtkx
approved these changes
Jun 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adapts the SDK to two auth changes already on
doorway-kmsmain.1. GET-behind-
StampCheckUser(/authenticators,/user-wallet)These endpoints moved from POST-with-body to GET behind
StampCheckUser, which requires anX-Timestampheader plus a stamp whose signed body is that timestamp value (FormatTimestamp(t) = strconv.FormatInt(t.UnixMilli(), 10)).resttransport: newstampPostion: 'timestamp'— signsDate.now()(unix-millis string), sends it asX-Timestamp+ the stamp header, no request body.getAuthenticators/getUserWallet: switched toGET+stampPostion: 'timestamp'.2. OTP / magic-link customization is now project-config-driven
The backend now sources OTP length/format and the magic-link URL template from the project's
wallet.otp_configsrow, and the request DTOs (InitOtpRequest={ contact }) no longer accept client customization — it's silently ignored. So this drops the dead params:otpCodeCustomizationandemailCustomizationfromregisterWithOTP,authenticateWithEmail, the core wallet wrapper, and the reactsendOTP/sendMagicLinkactions (and their exported types).redirectURLfromsendMagicLinkandmagicLinkBaseUrlfrom react-kit'sAuthConfig+ auth UI (+ docs).Verification
wallet-core,wallet-react,wallet-react-kit, and the demo — all clean.rest.test.tslocking the timestamp-stamp wire contract).mainbackend: OTP register/login (no customization sent) →getUserWallet(GET) →signMessage/whoami, and the full browser flow (login → dashboard → gasless tx) — all green.Notes
pnpm changeset.auth.test.tsis touched by both and can't be cleanly hunk-split; happy to split into two PRs if preferred.