privy_ruby 0.0.2

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 51e25ac71d2aa91eb15e1f25786474dab96e24a923c19aba56ddc8e4eafd30aa
+  data.tar.gz: f6adf206cd6d68890b264536771bde67ab3b4e713a7427a69e0ace6c930ce2f9
+SHA512:
+  metadata.gz: 9363c7b9cc66d84ba4daa2060d2316eca42a728f2ebe05b0cae6fc2447d4b8c64e651bc754da42443d161d5007e9a4165445450e527b674d1fd28895351c87d4
+  data.tar.gz: db7de0267ee175d3f5adc0792cd71dbbce20057322b2a695f9f2391ac7fada81817df8ea9cf2b2d59b3e58af96f4a168dbe038edeefb67ba5271440b7df9a044

data/.ignore

@@ -0,0 +1,2 @@
+rbi/*
+sig/*

data/CHANGELOG.md

@@ -0,0 +1,76 @@
+# Changelog
+
+## 0.0.2 (2026-05-21)
+
+Full Changelog: [v0.0.1...v0.0.2](https://github.com/privy-io/ruby-sdk/compare/v0.0.1...v0.0.2)
+
+### Features
+
+* **api:** api update ([20df7d1](https://github.com/privy-io/ruby-sdk/commit/20df7d1b06e7d8ad0b9cd84d003c70b6ce5adf47))
+* **api:** api update ([3cf0d0d](https://github.com/privy-io/ruby-sdk/commit/3cf0d0d638f755de9c31104218bafc3b7d104371))
+* **api:** api update ([5dbb00f](https://github.com/privy-io/ruby-sdk/commit/5dbb00f3cd713febd22d8b6689b91173b01d5632))
+* **api:** api update ([5886a5d](https://github.com/privy-io/ruby-sdk/commit/5886a5df5c82a8ecd96456609fed5d082a3a465b))
+* **api:** api update ([c151a87](https://github.com/privy-io/ruby-sdk/commit/c151a876f350610c3a35ebaabbed054cc2fafee7))
+
+## 0.0.1 (2026-05-15)
+
+Full Changelog: [v0.0.1...v0.0.1](https://github.com/privy-io/ruby-sdk/compare/v0.0.1...v0.0.1)
+
+### Features
+
+* **api:** api update ([8864864](https://github.com/privy-io/ruby-sdk/commit/8864864753502f6c439f556f2d0c600c80b41858))
+* **api:** api update ([b7efbbc](https://github.com/privy-io/ruby-sdk/commit/b7efbbc57f39c88dca2f523a173f7d0afc408842))
+* **api:** api update ([43c983a](https://github.com/privy-io/ruby-sdk/commit/43c983a91a908531b9e28ce35085ccd8115c712c))
+* **api:** manual updates ([cc4c2cd](https://github.com/privy-io/ruby-sdk/commit/cc4c2cdc156e9a175310f0e508fb58073431fce1))
+* **authorization:** add JwtExchangeService with HPKE encryption ([#12](https://github.com/privy-io/ruby-sdk/issues/12)) ([318b652](https://github.com/privy-io/ruby-sdk/commit/318b652dac0bb74028227de5a65086258dc2be9a))
+* **authorization:** add user_jwts support to AuthorizationContext ([#16](https://github.com/privy-io/ruby-sdk/issues/16)) ([dfedc4e](https://github.com/privy-io/ruby-sdk/commit/dfedc4e07e64c92651b0a9a11400d86dd0242d31))
+* **authorization:** P-256 signing, RFC 8785 canonicalization, prepare helper ([#5](https://github.com/privy-io/ruby-sdk/issues/5)) ([8a7255f](https://github.com/privy-io/ruby-sdk/commit/8a7255fdc926592d143e0f6e863901d0d3fcd643))
+* **client:** add authorization_key_cache_max_capacity option ([#45](https://github.com/privy-io/ruby-sdk/issues/45)) ([3369bc7](https://github.com/privy-io/ruby-sdk/commit/3369bc7503f3e50bed56e8d74a034698c4c65671))
+* **client:** Privy::PrivyClient wraps generated Privy::Client ([#4](https://github.com/privy-io/ruby-sdk/issues/4)) ([7ffbbc6](https://github.com/privy-io/ruby-sdk/commit/7ffbbc693f0d04c37dd5e0b046a08492c3617ccc))
+* **key_quorums:** add create convenience wrapper with kwargs interface ([#27](https://github.com/privy-io/ruby-sdk/issues/27)) ([ff985f6](https://github.com/privy-io/ruby-sdk/commit/ff985f62766dbc5b2dcc0b19a76e17bcd9e96752))
+* **key_quorums:** add delete convenience wrapper with authorization support ([#29](https://github.com/privy-io/ruby-sdk/issues/29)) ([cce679b](https://github.com/privy-io/ruby-sdk/commit/cce679b71c0129b1a95f473326634debe22bffb4))
+* **key_quorums:** add update convenience wrapper with authorization support ([#28](https://github.com/privy-io/ruby-sdk/issues/28)) ([4a472e1](https://github.com/privy-io/ruby-sdk/commit/4a472e1650036d6ff57bf52b893c522c2a2f787b))
+* **key_quorums:** request_expiry kwarg on update/delete ([#38](https://github.com/privy-io/ruby-sdk/issues/38)) ([50aebac](https://github.com/privy-io/ruby-sdk/commit/50aebacefbcd992f82d531ac7b033db95e24513a))
+* **policies:** add create convenience wrapper with idempotency support ([#21](https://github.com/privy-io/ruby-sdk/issues/21)) ([4fb79c0](https://github.com/privy-io/ruby-sdk/commit/4fb79c0ec215dd56bcb231375b9917f78f461eef))
+* **policies:** add create_rule convenience wrapper with authorization support ([#24](https://github.com/privy-io/ruby-sdk/issues/24)) ([87d1511](https://github.com/privy-io/ruby-sdk/commit/87d1511493e7ede9ef1e5dcf7494b805bef2c01d))
+* **policies:** add delete convenience wrapper with authorization support ([#23](https://github.com/privy-io/ruby-sdk/issues/23)) ([7cfc41b](https://github.com/privy-io/ruby-sdk/commit/7cfc41b5113fc74db67a435d676d4aee2a5a5076))
+* **policies:** add delete_rule convenience wrapper with authorization support ([#26](https://github.com/privy-io/ruby-sdk/issues/26)) ([88b4f02](https://github.com/privy-io/ruby-sdk/commit/88b4f02d82095558b0cd3a229364657181cce243))
+* **policies:** add update convenience wrapper with authorization support ([#22](https://github.com/privy-io/ruby-sdk/issues/22)) ([94da7b6](https://github.com/privy-io/ruby-sdk/commit/94da7b694a0fcd91c7dfb806ac10962c5b50d20c))
+* **policies:** add update_rule convenience wrapper with authorization support ([#25](https://github.com/privy-io/ruby-sdk/issues/25)) ([39ee81d](https://github.com/privy-io/ruby-sdk/commit/39ee81dc15e0784f04e9b93c801c5de1acc9fb42))
+* **policies:** request_expiry kwarg on update/delete/*_rule ([#37](https://github.com/privy-io/ruby-sdk/issues/37)) ([0966ac3](https://github.com/privy-io/ruby-sdk/commit/0966ac3352bb339d5643264911af3e6c0b85c0bf))
+* **public_api:** add PrivyRequestExpiryOptions config struct ([#34](https://github.com/privy-io/ruby-sdk/issues/34)) ([df65372](https://github.com/privy-io/ruby-sdk/commit/df65372803e9ce8946ed67e3069e7a144059a920))
+* **public_api:** PrivyClient#compute_request_expiry resolver ([#35](https://github.com/privy-io/ruby-sdk/issues/35)) ([19ac733](https://github.com/privy-io/ruby-sdk/commit/19ac733a149a8f08a774c2200a85d214ade2991e))
+* **services:** wallets create/update/rpc auto-inject auth + idempotency headers ([#10](https://github.com/privy-io/ruby-sdk/issues/10)) ([d03a736](https://github.com/privy-io/ruby-sdk/commit/d03a736cb79b638b46bfcade04fa8e97a5d1b19a))
+* **users:** add create convenience wrapper with kwargs interface ([#33](https://github.com/privy-io/ruby-sdk/issues/33)) ([f93e451](https://github.com/privy-io/ruby-sdk/commit/f93e4519775e1cb2c4fbe21e6dad68d63ac30daf))
+* **wallets:** add raw_sign and transfer convenience wrappers ([#18](https://github.com/privy-io/ruby-sdk/issues/18)) ([b4f1d1c](https://github.com/privy-io/ruby-sdk/commit/b4f1d1c4e61a8b101cad35aa108b3a8e267be234))
+* **wallets:** request_expiry kwarg on update/rpc/raw_sign/transfer ([#36](https://github.com/privy-io/ruby-sdk/issues/36)) ([f8e1074](https://github.com/privy-io/ruby-sdk/commit/f8e10746f833fac3bf4e4096d78b05983995e261))
+
+
+### Bug Fixes
+
+* classes resulting from intersections cannot have union parents ([1abe573](https://github.com/privy-io/ruby-sdk/commit/1abe5731705a3db306793be1c6ca374923b8fe10))
+* **client:** elide content type header on requests without body ([6741307](https://github.com/privy-io/ruby-sdk/commit/67413078f14b5dcb0dbca3acd35435765729ab4c))
+* **gen:** resolve lint errors in generated models ([#2](https://github.com/privy-io/ruby-sdk/issues/2)) ([5ed45a4](https://github.com/privy-io/ruby-sdk/commit/5ed45a46a0f1dea5bd413ecc4f0bfdbea8e49139))
+* **integration-tests:** isolate user data per test run ([#41](https://github.com/privy-io/ruby-sdk/issues/41)) ([a6ae14b](https://github.com/privy-io/ruby-sdk/commit/a6ae14b449eefc63cbb141f1840c21f2d545635f))
+* rename gem to privy_ruby ([#44](https://github.com/privy-io/ruby-sdk/issues/44)) ([b27c0dd](https://github.com/privy-io/ruby-sdk/commit/b27c0dd09e1f037375d97c5dbc86ce77c640b3cc))
+
+
+### Chores
+
+* **test:** print test names via TESTOPTS=-v in scripts/test ([#3](https://github.com/privy-io/ruby-sdk/issues/3)) ([6dcc2eb](https://github.com/privy-io/ruby-sdk/commit/6dcc2ebaac142a5e79434f6e7ce7dd38568fae1f))
+
+
+### Documentation
+
+* add CLAUDE.md with repo conventions and pitfalls ([#9](https://github.com/privy-io/ruby-sdk/issues/9)) ([ace5249](https://github.com/privy-io/ruby-sdk/commit/ace52499c509ba468f3c8c0ea7471aaf2bd8f02e))
+* document request-expiry configuration; ([#40](https://github.com/privy-io/ruby-sdk/issues/40)) ([e5b543b](https://github.com/privy-io/ruby-sdk/commit/e5b543bda950ca74fa3fd546544c6d1c11ea2bce))
+
+
+### Refactors
+
+* consolidate Privy::Authorization::Crypto into Privy::Cryptography ([#14](https://github.com/privy-io/ruby-sdk/issues/14)) ([8f096f7](https://github.com/privy-io/ruby-sdk/commit/8f096f7295ad41d7939805bae7d14a2d2dc22f24))
+* move signed_url and merge_prepared_headers to Authorization module ([#20](https://github.com/privy-io/ruby-sdk/issues/20)) ([f789358](https://github.com/privy-io/ruby-sdk/commit/f7893587bbb7926c96305660cd501dacfd602f3a))
+* **public_api:** drop content-type workarounds now obsolete ([#42](https://github.com/privy-io/ruby-sdk/issues/42)) ([afd9886](https://github.com/privy-io/ruby-sdk/commit/afd98860bbb3ceeabc45f07510ccef0ab11b8789))
+* rename authorization methods for cross-SDK consistency ([#15](https://github.com/privy-io/ruby-sdk/issues/15)) ([0ee0513](https://github.com/privy-io/ruby-sdk/commit/0ee05135eaa5e027e0350e9fc48f669549cf6f44))
+* rename prepare → prepare_request, align with Node SDK ([#17](https://github.com/privy-io/ruby-sdk/issues/17)) ([0fef5d2](https://github.com/privy-io/ruby-sdk/commit/0fef5d2b6a54b94fbbde13ec1e0c124382b22b61))
+* **wallets:** convert create/update/rpc to explicit kwargs interface ([#19](https://github.com/privy-io/ruby-sdk/issues/19)) ([575ccf4](https://github.com/privy-io/ruby-sdk/commit/575ccf4d6fe071b55478528ec9aa65efd5a6f2c9))

data/README.md

@@ -0,0 +1,300 @@
+# Privy API Ruby API library
+
+The Privy API Ruby library provides convenient access to the Privy API REST API from any Ruby 3.2.0+ application. It ships with comprehensive types & docstrings in Yard, RBS, and RBI – [see below](https://github.com/privy-io/ruby-sdk#Sorbet) for usage with Sorbet. The standard library's `net/http` is used as the HTTP transport, with connection pooling via the `connection_pool` gem.
+
+It is generated with [Stainless](https://www.stainless.com/).
+
+## Documentation
+
+Documentation for releases of this gem can be found [on RubyDoc](https://gemdocs.org/gems/privy_ruby).
+
+The REST API documentation can be found on [docs.privy.io](https://docs.privy.io).
+
+## Installation
+
+To use this gem, install via Bundler by adding the following to your application's `Gemfile`:
+
+<!-- x-release-please-start-version -->
+
+```ruby
+gem "privy_ruby", "~> 0.0.2"
+```
+
+<!-- x-release-please-end -->
+
+## Usage
+
+```ruby
+require "bundler/setup"
+require "privy"
+
+privy_api = Privy::Client.new(
+  app_id: ENV["PRIVY_APP_ID"], # This is the default and can be omitted
+  app_secret: ENV["PRIVY_APP_SECRET"], # This is the default and can be omitted
+  environment: "staging" # defaults to "production"
+)
+
+wallet = privy_api.wallets.get("wallet_id")
+
+puts(wallet.id)
+```
+
+### Pagination
+
+List methods in the Privy API API are paginated.
+
+This library provides auto-paginating iterators with each list response, so you do not have to request successive pages manually:
+
+```ruby
+page = privy_api.wallets.list
+
+# Fetch single item from page.
+wallet = page.data[0]
+puts(wallet.id)
+
+# Automatically fetches more pages as needed.
+page.auto_paging_each do |wallet|
+  puts(wallet.id)
+end
+```
+
+Alternatively, you can use the `#next_page?` and `#next_page` methods for more granular control working with pages.
+
+```ruby
+if page.next_page?
+  new_page = page.next_page
+  puts(new_page.data[0].id)
+end
+```
+
+### Handling errors
+
+When the library is unable to connect to the API, or if the API returns a non-success status code (i.e., 4xx or 5xx response), a subclass of `Privy::Errors::APIError` will be thrown:
+
+```ruby
+begin
+  wallet = privy_api.wallets.get("wallet_id")
+rescue Privy::Errors::APIConnectionError => e
+  puts("The server could not be reached")
+  puts(e.cause)  # an underlying Exception, likely raised within `net/http`
+rescue Privy::Errors::RateLimitError => e
+  puts("A 429 status code was received; we should back off a bit.")
+rescue Privy::Errors::APIStatusError => e
+  puts("Another non-200-range status code was received")
+  puts(e.status)
+end
+```
+
+Error codes are as follows:
+
+| Cause            | Error Type                 |
+| ---------------- | -------------------------- |
+| HTTP 400         | `BadRequestError`          |
+| HTTP 401         | `AuthenticationError`      |
+| HTTP 403         | `PermissionDeniedError`    |
+| HTTP 404         | `NotFoundError`            |
+| HTTP 409         | `ConflictError`            |
+| HTTP 422         | `UnprocessableEntityError` |
+| HTTP 429         | `RateLimitError`           |
+| HTTP >= 500      | `InternalServerError`      |
+| Other HTTP error | `APIStatusError`           |
+| Timeout          | `APITimeoutError`          |
+| Network error    | `APIConnectionError`       |
+
+### Retries
+
+Certain errors will be automatically retried 2 times by default, with a short exponential backoff.
+
+Connection errors (for example, due to a network connectivity problem), 408 Request Timeout, 409 Conflict, 429 Rate Limit, >=500 Internal errors, and timeouts will all be retried by default.
+
+You can use the `max_retries` option to configure or disable this:
+
+```ruby
+# Configure the default for all requests:
+privy_api = Privy::Client.new(
+  max_retries: 0 # default is 2
+)
+
+# Or, configure per-request:
+privy_api.wallets.get("wallet_id", request_options: {max_retries: 5})
+```
+
+### Timeouts
+
+By default, requests will time out after 60 seconds. You can use the timeout option to configure or disable this:
+
+```ruby
+# Configure the default for all requests:
+privy_api = Privy::Client.new(
+  timeout: nil # default is 60
+)
+
+# Or, configure per-request:
+privy_api.wallets.get("wallet_id", request_options: {timeout: 5})
+```
+
+On timeout, `Privy::Errors::APITimeoutError` is raised.
+
+Note that requests that time out are retried by default.
+
+### Configuring request expiry
+
+Authorized methods on `Privy::PrivyClient` (`wallets.update` / `rpc` / `raw_sign` / `transfer`, `policies.update` / `delete` / `create_rule` / `update_rule` / `delete_rule`, `key_quorums.update` / `delete`) auto-set the `privy-request-expiry` header to 15 minutes from now by default.
+
+Override the default at the client level:
+
+```ruby
+client = Privy::PrivyClient.new(
+  app_id: ENV["PRIVY_APP_ID"],
+  app_secret: ENV["PRIVY_APP_SECRET"],
+  request_expiry: Privy::PrivyRequestExpiryOptions.build(default_ms: 60_000)
+)
+```
+
+Disable the auto-set entirely:
+
+```ruby
+client = Privy::PrivyClient.new(
+  app_id: ENV["PRIVY_APP_ID"],
+  app_secret: ENV["PRIVY_APP_SECRET"],
+  request_expiry: Privy::PrivyRequestExpiryOptions.build(disabled: true)
+)
+```
+
+Override on a single call (absolute Unix-ms timestamp; takes precedence over both `default_ms` and `disabled`):
+
+```ruby
+client.wallets.rpc(
+  wallet.id,
+  wallet_rpc_request_body: {...},
+  authorization_context: ctx,
+  request_expiry: Process.clock_gettime(Process::CLOCK_REALTIME, :millisecond) + 60_000
+)
+```
+
+## Advanced concepts
+
+### BaseModel
+
+All parameter and response objects inherit from `Privy::Internal::Type::BaseModel`, which provides several conveniences, including:
+
+1. All fields, including unknown ones, are accessible with `obj[:prop]` syntax, and can be destructured with `obj => {prop: prop}` or pattern-matching syntax.
+
+2. Structural equivalence for equality; if two API calls return the same values, comparing the responses with == will return true.
+
+3. Both instances and the classes themselves can be pretty-printed.
+
+4. Helpers such as `#to_h`, `#deep_to_h`, `#to_json`, and `#to_yaml`.
+
+### Making custom or undocumented requests
+
+#### Undocumented properties
+
+You can send undocumented parameters to any endpoint, and read undocumented response properties, like so:
+
+Note: the `extra_` parameters of the same name overrides the documented parameters.
+
+```ruby
+wallet =
+  privy_api.wallets.get(
+    "wallet_id",
+    request_options: {
+      extra_query: {my_query_parameter: value},
+      extra_body: {my_body_parameter: value},
+      extra_headers: {"my-header": value}
+    }
+  )
+
+puts(wallet[:my_undocumented_property])
+```
+
+#### Undocumented request params
+
+If you want to explicitly send an extra param, you can do so with the `extra_query`, `extra_body`, and `extra_headers` under the `request_options:` parameter when making a request, as seen in the examples above.
+
+#### Undocumented endpoints
+
+To make requests to undocumented endpoints while retaining the benefit of auth, retries, and so on, you can make requests using `client.request`, like so:
+
+```ruby
+response = client.request(
+  method: :post,
+  path: '/undocumented/endpoint',
+  query: {"dog": "woof"},
+  headers: {"useful-header": "interesting-value"},
+  body: {"hello": "world"}
+)
+```
+
+### Concurrency & connection pooling
+
+The `Privy::Client` instances are threadsafe, but are only are fork-safe when there are no in-flight HTTP requests.
+
+Each instance of `Privy::Client` has its own HTTP connection pool with a default size of 99. As such, we recommend instantiating the client once per application in most settings.
+
+When all available connections from the pool are checked out, requests wait for a new connection to become available, with queue time counting towards the request timeout.
+
+Unless otherwise specified, other classes in the SDK do not have locks protecting their underlying data structure.
+
+## Sorbet
+
+This library provides comprehensive [RBI](https://sorbet.org/docs/rbi) definitions, and has no dependency on sorbet-runtime.
+
+You can provide typesafe request parameters like so:
+
+```ruby
+privy_api.wallets.get("wallet_id")
+```
+
+Or, equivalently:
+
+```ruby
+# Hashes work, but are not typesafe:
+privy_api.wallets.get("wallet_id")
+
+# You can also splat a full Params class:
+params = Privy::WalletGetParams.new
+privy_api.wallets.get("wallet_id", **params)
+```
+
+### Enums
+
+Since this library does not depend on `sorbet-runtime`, it cannot provide [`T::Enum`](https://sorbet.org/docs/tenum) instances. Instead, we provide "tagged symbols" instead, which is always a primitive at runtime:
+
+```ruby
+# :ethereum
+puts(Privy::WalletChainType::ETHEREUM)
+
+# Revealed type: `T.all(Privy::WalletChainType, Symbol)`
+T.reveal_type(Privy::WalletChainType::ETHEREUM)
+```
+
+Enum parameters have a "relaxed" type, so you can either pass in enum constants or their literal value:
+
+```ruby
+# Using the enum constants preserves the tagged type information:
+privy_api.wallets.create(
+  chain_type: Privy::WalletChainType::ETHEREUM,
+  # …
+)
+
+# Literal values are also permissible:
+privy_api.wallets.create(
+  chain_type: :ethereum,
+  # …
+)
+```
+
+## Versioning
+
+This package follows [SemVer](https://semver.org/spec/v2.0.0.html) conventions. As the library is in initial development and has a major version of `0`, APIs may change at any time.
+
+This package considers improvements to the (non-runtime) `*.rbi` and `*.rbs` type definitions to be non-breaking changes.
+
+## Requirements
+
+Ruby 3.2.0 or higher.
+
+## Contributing
+
+See [the contributing documentation](https://github.com/privy-io/ruby-sdk/tree/main/CONTRIBUTING.md).

data/SECURITY.md

@@ -0,0 +1,27 @@
+# Security Policy
+
+## Reporting Security Issues
+
+This SDK is generated by [Stainless Software Inc](http://stainless.com). Stainless takes security seriously, and encourages you to report any security vulnerability promptly so that appropriate action can be taken.
+
+To report a security issue, please contact the Stainless team at security@stainless.com.
+
+## Responsible Disclosure
+
+We appreciate the efforts of security researchers and individuals who help us maintain the security of
+SDKs we generate. If you believe you have found a security vulnerability, please adhere to responsible
+disclosure practices by allowing us a reasonable amount of time to investigate and address the issue
+before making any information public.
+
+## Reporting Non-SDK Related Security Issues
+
+If you encounter security issues that are not directly related to SDKs but pertain to the services
+or products provided by Privy API, please follow the respective company's security reporting guidelines.
+
+### Privy API Terms and Policies
+
+Please contact security@privy.io for any questions or concerns regarding the security of our services.
+
+---
+
+Thank you for helping us keep the SDKs and systems they interact with secure.

data/lib/privy/authorization/authorization.rb

@@ -0,0 +1,124 @@
+# frozen_string_literal: true
+
+require "openssl"
+
+module Privy
+  module Authorization
+    AuthorizationContext = Data.define(:authorization_private_keys, :signatures, :sign_fns, :user_jwts) do
+      def self.build(
+        authorization_private_keys: [],
+        signatures: [],
+        sign_fns: [],
+        user_jwts: []
+      )
+        new(
+          authorization_private_keys: authorization_private_keys,
+          signatures: signatures,
+          sign_fns: sign_fns,
+          user_jwts: user_jwts
+        )
+      end
+    end
+
+    WalletApiRequestSignatureInput = Data.define(:version, :method, :url, :body, :headers) do
+      def self.build(method:, url:, body:, headers:)
+        new(version: 1, method: method.to_s.upcase, url: url, body: body, headers: headers.compact)
+      end
+    end
+
+    PreparedRequest = Data.define(:headers)
+
+    module_function
+
+    def signed_url(privy_client, path)
+      base = privy_client.api.base_url.to_s.chomp("/")
+      "#{base}/#{path}"
+    end
+
+    def merge_prepared_headers!(params, headers)
+      if headers["privy-authorization-signature"]
+        params[:privy_authorization_signature] =
+          headers["privy-authorization-signature"]
+      end
+      params[:privy_idempotency_key] = headers["privy-idempotency-key"] if headers["privy-idempotency-key"]
+      params[:privy_request_expiry] = headers["privy-request-expiry"] if headers["privy-request-expiry"]
+    end
+
+    def format_request_for_authorization_signature(input)
+      payload = {
+        version: input.version,
+        method: input.method,
+        url: input.url,
+        body: input.body.nil? || input.body == {} ? "" : input.body,
+        headers: input.headers
+      }
+      Privy::Authorization::Canonicalization.canonicalize(payload).b
+    end
+
+    def generate_authorization_signature(private_key_base64:, payload:)
+      key = Privy::Cryptography.import_pkcs8_private_key(private_key_base64)
+      digest = OpenSSL::Digest.new("SHA256").digest(payload)
+      der = key.dsa_sign_asn1(digest)
+      [der].pack("m0")
+    end
+
+    # Generates all authorization signatures for a request.
+    #
+    # Signatures come from four sources, combined in this order:
+    # 1. Precomputed signatures passed directly in the context
+    # 2. Explicit private keys provided in authorization_private_keys
+    # 3. Private keys obtained by exchanging user JWTs via HPKE
+    # 4. Sign functions (callbacks that receive the canonicalized payload)
+    def generate_authorization_signatures(privy_client, input:, context:)
+      if context.user_jwts.any? && privy_client.nil?
+        raise ArgumentError,
+              "privy_client is required when user_jwts are provided in the authorization context"
+      end
+
+      # Canonicalize the request into a deterministic byte string for signing
+      payload = format_request_for_authorization_signature(input)
+
+      # Exchange each user JWT for an ephemeral P-256 private key via HPKE.
+      # Results are cached by JwtExchangeService so repeated calls are cheap.
+      jwt_keys = context.user_jwts.map do |jwt|
+        privy_client.jwt_exchange.exchange_jwt_for_authorization_key(jwt)
+      end
+      all_private_keys = context.authorization_private_keys + jwt_keys
+
+      key_sigs = all_private_keys.map do |pk|
+        generate_authorization_signature(private_key_base64: pk, payload: payload)
+      end
+      fn_sigs = context.sign_fns.map { |fn| fn.call(payload) }
+
+      key_sigs + fn_sigs + context.signatures
+    end
+
+    def prepare_request(
+      privy_client,
+      method:,
+      url:,
+      body:,
+      authorization_context: nil,
+      idempotency_key: nil,
+      request_expiry: nil
+    )
+      ctx = authorization_context || AuthorizationContext.build
+
+      headers = {}
+      headers["privy-idempotency-key"] = idempotency_key if idempotency_key
+      headers["privy-request-expiry"] = request_expiry.to_s if request_expiry
+
+      signature_input = WalletApiRequestSignatureInput.build(
+        method: method,
+        url: url,
+        body: body,
+        headers: {"privy-app-id" => privy_client.app_id}.merge(headers)
+      )
+
+      signatures = generate_authorization_signatures(privy_client, input: signature_input, context: ctx)
+      headers["privy-authorization-signature"] = signatures.join(",") unless signatures.empty?
+
+      PreparedRequest.new(headers: headers)
+    end
+  end
+end

data/lib/privy/authorization/canonicalization.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+require "json"
+
+module Privy
+  module Authorization
+    module Canonicalization
+      module_function
+
+      def canonicalize(value)
+        serialize(coerce_keys(value))
+      end
+
+      def coerce_keys(value)
+        case value
+        when Hash
+          value.each_with_object({}) { |(k, v), h| h[k.to_s] = coerce_keys(v) }
+        when Array
+          value.map { |v| coerce_keys(v) }
+        else
+          value
+        end
+      end
+
+      def serialize(value)
+        case value
+        when Hash
+          body = value.keys.sort_by { |k| k.encode("UTF-16BE").bytes }
+                      .map { |k| "#{JSON.generate(k)}:#{serialize(value[k])}" }
+                      .join(",")
+          "{#{body}}"
+        when Array
+          "[#{value.map { |v| serialize(v) }.join(',')}]"
+        when Float
+          raise ArgumentError, "NaN/Infinity not permitted" unless value.finite?
+
+          format_number(value)
+        when Integer
+          value.to_s
+        when String, TrueClass, FalseClass, NilClass
+          JSON.generate(value)
+        else
+          raise ArgumentError, "Cannot canonicalize #{value.class}"
+        end
+      end
+
+      # TODO: port the ES6 ToString algorithm (ecma-262) for full RFC 8785 compliance on arbitrary
+      # floats. MVP payloads only contain integer and simple-decimal values, so the simplified form
+      # below is sufficient for now.
+      def format_number(value)
+        int = value.to_i
+        value == int ? int.to_s : value.to_s
+      end
+    end
+  end
+end

data/lib/privy/authorization/jwt_exchange.rb

@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+
+require "base64"
+
+module Privy
+  class JwtExchangeService
+    DEFAULT_CACHE_MAX_CAPACITY = 1000
+
+    attr_reader :cache_max_capacity
+
+    def initialize(wallets_resource:, cache_max_capacity: DEFAULT_CACHE_MAX_CAPACITY)
+      @wallets = wallets_resource
+      @hpke_recipient = Privy::Cryptography::HpkeRecipient.new
+      @cache = {}
+      @cache_max_capacity = cache_max_capacity
+      @mutex = Mutex.new
+    end
+
+    def exchange_jwt_for_authorization_key(jwt)
+      cached = get_cached(jwt)
+      return cached if cached
+
+      response = @wallets.authenticate_with_jwt(
+        user_jwt: jwt,
+        encryption_type: :HPKE,
+        recipient_public_key: Base64.strict_encode64(@hpke_recipient.public_key_spki)
+      )
+
+      encrypted = response.encrypted_authorization_key
+      unless encrypted && encrypted.encryption_type.to_s == "HPKE"
+        raise Privy::Errors::Error, "JWT exchange failed: unsupported encryption type"
+      end
+
+      decrypted_key = @hpke_recipient.decrypt(
+        Base64.strict_decode64(encrypted.encapsulated_key),
+        Base64.strict_decode64(encrypted.ciphertext)
+      )
+
+      authorization_key = decrypted_key.force_encoding("UTF-8")
+      cache_put(jwt, authorization_key, response.expires_at)
+      authorization_key
+    end
+
+    private
+
+    def get_cached(jwt)
+      @mutex.synchronize do
+        entry = @cache[jwt]
+        return nil unless entry
+
+        if entry[:expires_at] > current_time_ms
+          entry[:key]
+        else
+          @cache.delete(jwt)
+          nil
+        end
+      end
+    end
+
+    def cache_put(jwt, key, expires_at)
+      @mutex.synchronize do
+        evict_if_full
+        @cache[jwt] = {key: key, expires_at: expires_at}
+      end
+    end
+
+    def evict_if_full
+      return unless @cache.size >= @cache_max_capacity
+
+      now_ms = current_time_ms
+      @cache.delete_if { |_, v| v[:expires_at] <= now_ms }
+      @cache.delete(@cache.keys.first) if @cache.size >= @cache_max_capacity
+    end
+
+    def current_time_ms
+      (Time.now.to_f * 1000).to_i
+    end
+  end
+end