Skip to content

MFA and Scoped Sessions for SDK - #1240

Merged
moeodeh3 merged 2 commits into
mainfrom
sdk-mfa-scoped-sessions
Aug 14, 2026
Merged

MFA and Scoped Sessions for SDK#1240
moeodeh3 merged 2 commits into
mainfrom
sdk-mfa-scoped-sessions

Conversation

@amircheikh

@amircheikh amircheikh commented Mar 18, 2026

Copy link
Copy Markdown
Contributor

Summary & Motivation

MFA and scoped sessions SDK integrations

Includes:

  • A way to pause execution and await an MFA approval via onMfaRequired callback in httpClient
  • Configurable MFA handler (changes the onMfaRequired) in @turnkey/react-(native-)wallet-kit
  • Attested stamper in @turnkey/core that gets auto-populated with an attestedIdentity after calling verifyOtp or a handlePROVIDEROauth function
  • Some tests in react-wallet-kit-playground example
  • Started with-mfa-scoped-sessions example

How I Tested These Changes

locally

Did you add a changeset?

noooooooooo

@codesandbox-ci

codesandbox-ci Bot commented Mar 18, 2026

Copy link
Copy Markdown

This pull request is automatically built and testable in CodeSandbox.

To see build info of the built libraries, click here or the icon next to each commit SHA.

Latest deployment of this branch, based on commit e1fdcb1:

Sandbox Source
@turnkey/example-react-components Configuration

@amircheikh
amircheikh force-pushed the sdk-mfa-scoped-sessions branch from 2413c55 to d1e89da Compare March 19, 2026 21:25
@amircheikh
amircheikh force-pushed the sdk-mfa-scoped-sessions branch from d1e89da to 1a37b07 Compare March 30, 2026 18:08
@moeodeh3
moeodeh3 force-pushed the sdk-mfa-scoped-sessions branch from 157308e to 0278097 Compare June 25, 2026 20:43
@socket-security

socket-security Bot commented Jun 25, 2026

Copy link
Copy Markdown

No dependency changes detected. Learn more about Socket for GitHub.

👍 No dependency changes detected in pull request

@amircheikh
amircheikh force-pushed the sdk-mfa-scoped-sessions branch from 2892619 to c91022e Compare July 1, 2026 14:32
@amircheikh
amircheikh force-pushed the sdk-mfa-scoped-sessions branch 3 times, most recently from 6ac34b0 to 9bb8ef7 Compare July 13, 2026 18:49
@amircheikh
amircheikh marked this pull request as ready for review July 13, 2026 21:48
@amircheikh
amircheikh force-pushed the sdk-mfa-scoped-sessions branch from b145273 to 4519b40 Compare July 14, 2026 14:10
@@ -0,0 +1 @@
Hello my name is readme

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

hello readme, my name is updateme!

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ladnon

Comment thread packages/core/scripts/codegen.js Outdated
activityId: activityData.activity.id,
organizationId: activityData.activity.organizationId,
},
stampWith

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

just flagging that this will be a bit awkward for passkeys and wallets because requests will require two stamps whenever MFA or consensus is needed

technically we already have this problem today with polling, it just hasn't really been a problem yet because we almost never have to poll (like 99% of the time)

if you want to stamp the request with a passkey or wallet but handle the MFA step using your session, that's still possible by doing:

stamp<Activity>()
sendSignedRequest()

Comment thread packages/react-wallet-kit/src/providers/client/Provider.tsx Outdated
Comment thread packages/react-wallet-kit/src/providers/client/Provider.tsx Outdated
Comment thread packages/react-wallet-kit/src/providers/client/Provider.tsx Outdated
Comment thread packages/react-wallet-kit/src/types/method-types.ts Outdated
Comment thread packages/sdk-types/src/index.ts Outdated
@amircheikh
amircheikh force-pushed the sdk-mfa-scoped-sessions branch from 4519b40 to bf338cd Compare July 20, 2026 14:45
@moeodeh3
moeodeh3 force-pushed the sdk-mfa-scoped-sessions branch 5 times, most recently from f49af3d to d6c9783 Compare August 14, 2026 15:05
@moeodeh3
moeodeh3 force-pushed the sdk-mfa-scoped-sessions branch from d6c9783 to fd88b78 Compare August 14, 2026 16:37
sessionKey?: string;
expirationSeconds?: string;
organizationId?: string;
sessionProfileId?: string;

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

github diff tricked me

@hadrelandon hadrelandon left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@moeodeh3
moeodeh3 merged commit 488d5d5 into main Aug 14, 2026
7 checks passed
@moeodeh3
moeodeh3 deleted the sdk-mfa-scoped-sessions branch August 14, 2026 19:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants