@turnkey/core 1.10.0 → 1.11.1

package/dist/__clients__/core.mjs

@@ -1,8 +1,8 @@
 import { TurnkeySDKClientBase } from '../__generated__/sdk-client-base.mjs';
 import { TurnkeyErrorCodes, TurnkeyError, AuthAction } from '@turnkey/sdk-types';
 import { DEFAULT_SESSION_EXPIRATION_IN_SECONDS } from '../__types__/auth.mjs';
-import { SessionKey, StamperType, WalletSource, Chain, FilterType, OtpTypeToFilterTypeMap, OtpType, Curve, SignIntent } from '../__types__/enums.mjs';
-import { withTurnkeyErrorHandling, isValidPasskeyName, isWeb, isReactNative, buildSignUpBody, findWalletProviderFromAddress, getPublicKeyFromStampHeader, addressFromPublicKey, getCurveTypeFromProvider, sendSignedRequest, getAuthenticatorAddresses, fetchAllWalletAccountsWithCursor, mapAccountsToWallet, toExternalTimestamp, isEthereumProvider, isSolanaProvider, getActiveSessionOrThrowIfRequired, getHashFunction, getEncodingType, getEncodedMessage, splitSignature, broadcastTransaction, getPolicySignature, googleISS, isWalletAccountArray, generateWalletAccountsFromAddressFormat } from '../utils.mjs';
+import { SessionKey, StamperType, WalletSource, FilterType, OtpTypeToFilterTypeMap, OtpType, Curve, Chain, SignIntent } from '../__types__/enums.mjs';
+import { withTurnkeyErrorHandling, isValidPasskeyName, isWeb, isReactNative, buildSignUpBody, findWalletProviderFromAddress, getPublicKeyFromStampHeader, addressFromPublicKey, getCurveTypeFromProvider, getClientSignatureMessageForLogin, getClientSignatureMessageForSignup, getAuthenticatorAddresses, fetchAllWalletAccountsWithCursor, mapAccountsToWallet, toExternalTimestamp, isEthereumProvider, isSolanaProvider, getActiveSessionOrThrowIfRequired, getHashFunction, getEncodingType, getEncodedMessage, splitSignature, broadcastTransaction, getPolicySignature, googleISS, isWalletAccountArray, generateWalletAccountsFromAddressFormat } from '../utils.mjs';
 import { createStorageManager } from '../__storage__/base.mjs';
 import { CrossPlatformApiKeyStamper } from '../__stampers__/api/base.mjs';
 import { CrossPlatformPasskeyStamper } from '../__stampers__/passkey/base.mjs';
@@ -11,6 +11,7 @@ import { jwtDecode } from 'jwt-decode';
 import { createWalletManager } from '../__wallet__/base.mjs';
 import { toUtf8Bytes } from 'ethers';
 import { verify } from '@turnkey/crypto';
+import { SignatureFormat } from '@turnkey/api-key-stamper';
 
 class TurnkeyClient {
     constructor(config, 
@@ -487,28 +488,12 @@ class TurnkeyClient {
                 if (!signedRequest) {
                     throw new TurnkeyError("Failed to create stamped request for wallet login", TurnkeyErrorCodes.BAD_RESPONSE);
                 }
-                let publicKey;
-                switch (walletProvider.chainInfo.namespace) {
-                    case Chain.Ethereum: {
-                        // for Ethereum, there is no way to get the public key from the wallet address
-                        // so we derive it from the signed request
-                        publicKey = getPublicKeyFromStampHeader(signedRequest.stamp.stampHeaderValue);
-                        break;
-                    }
-                    case Chain.Solana: {
-                        // for Solana, we can get the public key from the wallet address
-                        // since the wallet address is the public key
-                        // this doesn't require any action from the user as long as the wallet is connected
-                        // which it has to be since they just called stampStampLogin()
-                        publicKey = await this.walletManager.stamper.getPublicKey(walletProvider.interfaceType, walletProvider);
-                        break;
-                    }
-                    default:
-                        throw new TurnkeyError(`Unsupported interface type: ${walletProvider.interfaceType}`, TurnkeyErrorCodes.INVALID_REQUEST);
-                }
+                // the wallet's public key is embedded in the stamp header by the wallet stamper
+                // so we extract it from there
+                const publicKey = getPublicKeyFromStampHeader(signedRequest.stamp.stampHeaderValue);
                 return {
                     signedRequest,
-                    publicKey: publicKey,
+                    publicKey,
                 };
             }, {
                 errorCode: TurnkeyErrorCodes.WALLET_BUILD_LOGIN_REQUEST_ERROR,
@@ -545,49 +530,25 @@ class TurnkeyClient {
          * @throws {TurnkeyError} If the wallet stamper is uninitialized, a public key cannot be found or generated, or login fails.
          */
         this.loginWithWallet = async (params) => {
-            let generatedPublicKey = params.publicKey || (await this.apiKeyStamper?.createKeyPair());
+            const { walletProvider, sessionKey = SessionKey.DefaultSessionkey } = params;
             return withTurnkeyErrorHandling(async () => {
-                if (!this.walletManager?.stamper) {
-                    throw new TurnkeyError("Wallet stamper is not initialized", TurnkeyErrorCodes.WALLET_MANAGER_COMPONENT_NOT_INITIALIZED);
-                }
-                const sessionKey = params.sessionKey || SessionKey.DefaultSessionkey;
-                const walletProvider = params.walletProvider;
-                const expirationSeconds = params?.expirationSeconds || DEFAULT_SESSION_EXPIRATION_IN_SECONDS;
-                if (!generatedPublicKey) {
-                    throw new TurnkeyError("A publickey could not be found or generated.", TurnkeyErrorCodes.INTERNAL_ERROR);
+                const { signedRequest, publicKey } = await this.buildWalletLoginRequest(params);
+                const sessionResponse = await this.httpClient.sendSignedRequest(signedRequest);
+                const sessionToken = sessionResponse.session;
+                if (!sessionToken) {
+                    throw new TurnkeyError("Session token not found in the response", TurnkeyErrorCodes.BAD_RESPONSE);
                 }
-                this.walletManager.stamper.setProvider(walletProvider.interfaceType, walletProvider);
-                const sessionResponse = await this.httpClient.stampLogin({
-                    publicKey: generatedPublicKey,
-                    organizationId: params?.organizationId ?? this.config.organizationId,
-                    expirationSeconds,
-                }, StamperType.Wallet);
                 await this.storeSession({
                     sessionToken: sessionResponse.session,
                     sessionKey,
                 });
-                // TODO (Moe): What happens if a user connects to MetaMask on Ethereum,
-                // then switches to a Solana account within MetaMask? Will this flow break?
-                const address = addressFromPublicKey(walletProvider.chainInfo.namespace, generatedPublicKey);
-                generatedPublicKey = undefined; // Key pair was successfully used, set to null to prevent cleanup
                 return {
                     sessionToken: sessionResponse.session,
-                    address,
+                    address: addressFromPublicKey(walletProvider.chainInfo.namespace, publicKey),
                 };
             }, {
                 errorMessage: "Unable to log in with the provided wallet",
                 errorCode: TurnkeyErrorCodes.WALLET_LOGIN_AUTH_ERROR,
-            }, {
-                finallyFn: async () => {
-                    if (generatedPublicKey) {
-                        try {
-                            await this.apiKeyStamper?.deleteKeyPair(generatedPublicKey);
-                        }
-                        catch (cleanupError) {
-                            throw new TurnkeyError("Failed to clean up generated key pair", TurnkeyErrorCodes.KEY_PAIR_CLEANUP_ERROR, cleanupError);
-                        }
-                    }
-                },
             });
         };
         /**
@@ -610,18 +571,9 @@ class TurnkeyClient {
          * @throws {TurnkeyError} If there is an error during wallet authentication, sub-organization creation, session storage, or cleanup.
          */
         this.signUpWithWallet = async (params) => {
-            const { walletProvider, createSubOrgParams, sessionKey = SessionKey.DefaultSessionkey, expirationSeconds = DEFAULT_SESSION_EXPIRATION_IN_SECONDS, } = params;
-            let generatedPublicKey = undefined;
+            const { walletProvider, createSubOrgParams, sessionKey = SessionKey.DefaultSessionkey, } = params;
             return withTurnkeyErrorHandling(async () => {
-                if (!this.walletManager?.stamper) {
-                    throw new TurnkeyError("Wallet stamper is not initialized", TurnkeyErrorCodes.WALLET_MANAGER_COMPONENT_NOT_INITIALIZED);
-                }
-                generatedPublicKey = await this.apiKeyStamper?.createKeyPair();
-                this.walletManager.stamper.setProvider(walletProvider.interfaceType, walletProvider);
-                const publicKey = await this.walletManager.stamper.getPublicKey(walletProvider.interfaceType, walletProvider);
-                if (!publicKey) {
-                    throw new TurnkeyError("Failed to get public key from wallet", TurnkeyErrorCodes.WALLET_SIGNUP_AUTH_ERROR);
-                }
+                const { signedRequest, publicKey } = await this.buildWalletLoginRequest(params);
                 const signUpBody = buildSignUpBody({
                     createSubOrgParams: {
                         ...createSubOrgParams,
@@ -631,12 +583,6 @@ class TurnkeyClient {
                                 publicKey: publicKey,
                                 curveType: getCurveTypeFromProvider(walletProvider),
                             },
-                            {
-                                apiKeyName: `wallet-auth-${generatedPublicKey}`,
-                                publicKey: generatedPublicKey,
-                                curveType: "API_KEY_CURVE_P256",
-                                expirationSeconds: "60",
-                            },
                         ],
                     },
                 });
@@ -644,43 +590,24 @@ class TurnkeyClient {
                 if (!res) {
                     throw new TurnkeyError(`Sign up failed`, TurnkeyErrorCodes.WALLET_SIGNUP_AUTH_ERROR);
                 }
-                const newGeneratedKeyPair = await this.apiKeyStamper?.createKeyPair();
-                this.apiKeyStamper?.setTemporaryPublicKey(generatedPublicKey);
-                const sessionResponse = await this.httpClient.stampLogin({
-                    publicKey: newGeneratedKeyPair,
-                    organizationId: this.config.organizationId,
-                    expirationSeconds,
+                // now we can send the stamped request to Turnkey
+                const sessionResponse = await this.httpClient.sendSignedRequest(signedRequest);
+                const sessionToken = sessionResponse.session;
+                if (!sessionToken) {
+                    throw new TurnkeyError("Session token not found in the response", TurnkeyErrorCodes.BAD_RESPONSE);
+                }
+                await this.storeSession({
+                    sessionToken: sessionToken,
+                    sessionKey,
                 });
-                await Promise.all([
-                    this.apiKeyStamper?.deleteKeyPair(generatedPublicKey),
-                    this.storeSession({
-                        sessionToken: sessionResponse.session,
-                        sessionKey,
-                    }),
-                ]);
-                generatedPublicKey = undefined; // Key pair was successfully used, set to null to prevent cleanup
-                // TODO (Moe): What happens if a user connects to MetaMask on Ethereum,
-                // then switches to a Solana account within MetaMask? Will this flow break?
                 return {
-                    sessionToken: sessionResponse.session,
+                    sessionToken: sessionToken,
                     appProofs: res.appProofs,
                     address: addressFromPublicKey(walletProvider.chainInfo.namespace, publicKey),
                 };
             }, {
                 errorMessage: "Failed to sign up with wallet",
                 errorCode: TurnkeyErrorCodes.WALLET_SIGNUP_AUTH_ERROR,
-            }, {
-                finallyFn: async () => {
-                    this.apiKeyStamper?.clearTemporaryPublicKey();
-                    if (generatedPublicKey) {
-                        try {
-                            await this.apiKeyStamper?.deleteKeyPair(generatedPublicKey);
-                        }
-                        catch (cleanupError) {
-                            throw new TurnkeyError("Failed to clean up generated key pair", TurnkeyErrorCodes.KEY_PAIR_CLEANUP_ERROR, cleanupError);
-                        }
-                    }
-                },
             });
         };
         /**
@@ -706,9 +633,7 @@ class TurnkeyClient {
          * @throws {TurnkeyError} If there is an error during wallet authentication, sub-organization creation, or session storage.
          */
         this.loginOrSignupWithWallet = async (params) => {
-            const createSubOrgParams = params.createSubOrgParams;
-            const sessionKey = params.sessionKey || SessionKey.DefaultSessionkey;
-            const walletProvider = params.walletProvider;
+            const { walletProvider, createSubOrgParams, sessionKey = SessionKey.DefaultSessionkey, } = params;
             return withTurnkeyErrorHandling(async () => {
                 const { signedRequest, publicKey } = await this.buildWalletLoginRequest(params);
                 // here we check if the subOrg exists and create one
@@ -742,8 +667,8 @@ class TurnkeyClient {
                     }
                 }
                 // now we can send the stamped request to Turnkey
-                const sessionResponse = await sendSignedRequest(signedRequest);
-                const sessionToken = sessionResponse.activity.result.stampLoginResult?.session;
+                const sessionResponse = await this.httpClient.sendSignedRequest(signedRequest);
+                const sessionToken = sessionResponse.session;
                 if (!sessionToken) {
                     throw new TurnkeyError("Session token not found in the response", TurnkeyErrorCodes.BAD_RESPONSE);
                 }
@@ -761,8 +686,6 @@ class TurnkeyClient {
             }, {
                 errorCode: TurnkeyErrorCodes.WALLET_LOGIN_OR_SIGNUP_ERROR,
                 errorMessage: "Failed to log in or sign up with wallet",
-                catchFn: async () => {
-                },
             });
         };
         /**
@@ -808,6 +731,7 @@ class TurnkeyClient {
          * @param params.otpCode - OTP code entered by the user.
          * @param params.contact - contact information for the user (e.g., email address or phone number).
          * @param params.otpType - type of OTP being verified (OtpType.Email or OtpType.Sms).
+         * @param params.publicKey - public key the verification token is bound to for ownership verification (client signature verification during login/signup). This public key is optional; if not provided, a new key pair will be generated.
          * @returns A promise that resolves to an object containing:
          *   - subOrganizationId: sub-organization ID if the contact is already associated with a sub-organization, or an empty string if not.
          *   - verificationToken: verification token to be used for login or sign-up.
@@ -815,10 +739,12 @@ class TurnkeyClient {
          */
         this.verifyOtp = async (params) => {
             const { otpId, otpCode, contact, otpType } = params;
+            const resolvedPublicKey = params.publicKey ?? (await this.apiKeyStamper?.createKeyPair());
             return withTurnkeyErrorHandling(async () => {
                 const verifyOtpRes = await this.httpClient.proxyVerifyOtp({
                     otpId: otpId,
                     otpCode: otpCode,
+                    publicKey: resolvedPublicKey,
                 });
                 if (!verifyOtpRes) {
                     throw new TurnkeyError(`OTP verification failed`, TurnkeyErrorCodes.INTERNAL_ERROR);
@@ -826,6 +752,7 @@ class TurnkeyClient {
                 const accountRes = await this.httpClient.proxyGetAccount({
                     filterType: OtpTypeToFilterTypeMap[otpType],
                     filterValue: contact,
+                    verificationToken: verifyOtpRes.verificationToken,
                 });
                 if (!accountRes) {
                     throw new TurnkeyError(`Account fetch failed`, TurnkeyErrorCodes.ACCOUNT_FETCH_ERROR);
@@ -867,10 +794,26 @@ class TurnkeyClient {
         this.loginWithOtp = async (params) => {
             const { verificationToken, invalidateExisting = false, publicKey = await this.apiKeyStamper?.createKeyPair(), organizationId, sessionKey = SessionKey.DefaultSessionkey, } = params;
             return withTurnkeyErrorHandling(async () => {
+                const { message, publicKey: clientSignaturePublicKey } = getClientSignatureMessageForLogin({
+                    verificationToken,
+                    sessionPublicKey: publicKey,
+                });
+                this.apiKeyStamper?.setTemporaryPublicKey(publicKey);
+                const signature = await this.apiKeyStamper?.sign(message, SignatureFormat.Raw);
+                if (!signature) {
+                    throw new TurnkeyError(`Failed to sign client signature for OTP login`, TurnkeyErrorCodes.INTERNAL_ERROR);
+                }
+                const clientSignature = {
+                    message: message,
+                    publicKey: clientSignaturePublicKey,
+                    scheme: "CLIENT_SIGNATURE_SCHEME_API_P256",
+                    signature: signature,
+                };
                 const res = await this.httpClient.proxyOtpLogin({
                     verificationToken,
                     publicKey: publicKey,
                     invalidateExisting,
+                    clientSignature,
                     ...(organizationId && { organizationId }),
                 });
                 if (!res) {
@@ -901,6 +844,10 @@ class TurnkeyClient {
                         }
                     }
                 },
+            }, {
+                finallyFn: async () => {
+                    this.apiKeyStamper?.clearTemporaryPublicKey();
+                },
             });
         };
         /**
@@ -923,7 +870,8 @@ class TurnkeyClient {
          * @throws {TurnkeyError} If there is an error during the OTP sign-up process or session storage.
          */
         this.signUpWithOtp = async (params) => {
-            const { verificationToken, contact, otpType, createSubOrgParams, invalidateExisting, sessionKey, } = params;
+            const { verificationToken, contact, otpType, createSubOrgParams, invalidateExisting, sessionKey, publicKey = await this.apiKeyStamper?.createKeyPair(), } = params;
+            // build sign up body without client signature first
             const signUpBody = buildSignUpBody({
                 createSubOrgParams: {
                     ...createSubOrgParams,
@@ -934,14 +882,37 @@ class TurnkeyClient {
                 },
             });
             return withTurnkeyErrorHandling(async () => {
-                const generatedPublicKey = await this.apiKeyStamper?.createKeyPair();
-                const signupRes = await this.httpClient.proxySignup(signUpBody);
+                const { message, publicKey: clientSignaturePublicKey } = getClientSignatureMessageForSignup({
+                    verificationToken,
+                    ...(signUpBody.userEmail && { email: signUpBody.userEmail }),
+                    ...(signUpBody.userPhoneNumber && {
+                        phoneNumber: signUpBody.userPhoneNumber,
+                    }),
+                    apiKeys: signUpBody.apiKeys,
+                    authenticators: signUpBody.authenticators,
+                    oauthProviders: signUpBody.oauthProviders,
+                });
+                this.apiKeyStamper?.setTemporaryPublicKey(publicKey);
+                const signature = await this.apiKeyStamper?.sign(message, SignatureFormat.Raw);
+                if (!signature) {
+                    throw new TurnkeyError(`Failed to sign client signature for OTP sign up`, TurnkeyErrorCodes.INTERNAL_ERROR);
+                }
+                const clientSignature = {
+                    message: message,
+                    publicKey: clientSignaturePublicKey,
+                    scheme: "CLIENT_SIGNATURE_SCHEME_API_P256",
+                    signature: signature,
+                };
+                const signupRes = await this.httpClient.proxySignup({
+                    ...signUpBody,
+                    clientSignature,
+                });
                 if (!signupRes) {
                     throw new TurnkeyError(`Auth proxy OTP sign up failed`, TurnkeyErrorCodes.OTP_SIGNUP_ERROR);
                 }
                 const otpRes = await this.loginWithOtp({
                     verificationToken,
-                    publicKey: generatedPublicKey,
+                    publicKey: publicKey,
                     ...(invalidateExisting && { invalidateExisting }),
                     ...(sessionKey && { sessionKey }),
                 });
@@ -950,8 +921,23 @@ class TurnkeyClient {
                     appProofs: signupRes.appProofs,
                 };
             }, {
+                catchFn: async () => {
+                    // Clean up the generated key pair if it wasn't successfully used
+                    if (publicKey) {
+                        try {
+                            await this.apiKeyStamper?.deleteKeyPair(publicKey);
+                        }
+                        catch (cleanupError) {
+                            throw new TurnkeyError(`Failed to clean up generated key pair`, TurnkeyErrorCodes.KEY_PAIR_CLEANUP_ERROR, cleanupError);
+                        }
+                    }
+                },
                 errorCode: TurnkeyErrorCodes.OTP_SIGNUP_ERROR,
                 errorMessage: "Failed to sign up with OTP",
+            }, {
+                finallyFn: async () => {
+                    this.apiKeyStamper?.clearTemporaryPublicKey();
+                },
             });
         };
         /**
@@ -978,13 +964,14 @@ class TurnkeyClient {
          * @throws {TurnkeyError} If there is an error during OTP verification, sign-up, or login.
          */
         this.completeOtp = async (params) => {
-            const { otpId, otpCode, contact, otpType, publicKey, invalidateExisting = false, sessionKey, createSubOrgParams, } = params;
+            const { otpId, otpCode, contact, otpType, publicKey = await this.apiKeyStamper?.createKeyPair(), invalidateExisting = false, sessionKey, createSubOrgParams, } = params;
             return withTurnkeyErrorHandling(async () => {
                 const { subOrganizationId, verificationToken } = await this.verifyOtp({
                     otpId: otpId,
                     otpCode: otpCode,
                     contact: contact,
                     otpType: otpType,
+                    publicKey: publicKey,
                 });
                 if (!verificationToken) {
                     throw new TurnkeyError("No verification token returned from OTP verification", TurnkeyErrorCodes.VERIFY_OTP_ERROR);
@@ -997,6 +984,7 @@ class TurnkeyClient {
                         ...(createSubOrgParams && { createSubOrgParams }),
                         ...(invalidateExisting && { invalidateExisting }),
                         ...(sessionKey && { sessionKey }),
+                        publicKey: publicKey,
                     });
                     return {
                         ...signUpRes,
@@ -1007,7 +995,7 @@ class TurnkeyClient {
                 else {
                     const loginRes = await this.loginWithOtp({
                         verificationToken,
-                        ...(publicKey && { publicKey }),
+                        publicKey: publicKey,
                         ...(invalidateExisting && { invalidateExisting }),
                         ...(sessionKey && { sessionKey }),
                     });
@@ -1245,7 +1233,9 @@ class TurnkeyClient {
                     if (!signedUserRequest) {
                         throw new TurnkeyError("Failed to stamp user request", TurnkeyErrorCodes.INVALID_REQUEST);
                     }
-                    userPromise = sendSignedRequest(signedUserRequest).then((response) => getAuthenticatorAddresses(response.user));
+                    userPromise = this.httpClient
+                        .sendSignedRequest(signedUserRequest)
+                        .then((response) => getAuthenticatorAddresses(response.user));
                 }
                 // if connectedOnly is true, we skip fetching embedded wallets
                 if (!connectedOnly) {
@@ -1265,7 +1255,7 @@ class TurnkeyClient {
                     }
                     const [accounts, walletsRes] = await Promise.all([
                         fetchAllWalletAccountsWithCursor(this.httpClient, organizationId, stampWith),
-                        sendSignedRequest(signedWalletsRequest),
+                        this.httpClient.sendSignedRequest(signedWalletsRequest),
                     ]);
                     // create a map of walletId to EmbeddedWallet for easy lookup
                     const walletMap = new Map(walletsRes.wallets.map((wallet) => [
@@ -2060,12 +2050,15 @@ class TurnkeyClient {
                 throw new TurnkeyError("User ID must be provided to update user email", TurnkeyErrorCodes.INVALID_REQUEST);
             }
             return withTurnkeyErrorHandling(async () => {
-                const existingUser = await this.httpClient.proxyGetAccount({
-                    filterType: FilterType.Email,
-                    filterValue: email,
-                });
-                if (existingUser.organizationId) {
-                    throw new TurnkeyError(`Email ${email} is already associated with another user.`, TurnkeyErrorCodes.ACCOUNT_ALREADY_EXISTS);
+                if (verificationToken) {
+                    const existingUser = await this.httpClient.proxyGetAccount({
+                        filterType: FilterType.Email,
+                        filterValue: email,
+                        verificationToken,
+                    });
+                    if (existingUser.organizationId) {
+                        throw new TurnkeyError(`Email ${email} is already associated with another user.`, TurnkeyErrorCodes.ACCOUNT_ALREADY_EXISTS);
+                    }
                 }
                 const res = await this.httpClient.updateUserEmail({
                     userId: userId,
@@ -2143,6 +2136,16 @@ class TurnkeyClient {
                 throw new TurnkeyError("User ID must be provided to update user phone number", TurnkeyErrorCodes.INVALID_REQUEST);
             }
             return withTurnkeyErrorHandling(async () => {
+                if (verificationToken) {
+                    const existingUser = await this.httpClient.proxyGetAccount({
+                        filterType: FilterType.Sms,
+                        filterValue: phoneNumber,
+                        verificationToken,
+                    });
+                    if (existingUser.organizationId) {
+                        throw new TurnkeyError(`Phone number ${phoneNumber} is already associated with another user.`, TurnkeyErrorCodes.ACCOUNT_ALREADY_EXISTS);
+                    }
+                }
                 const res = await this.httpClient.updateUserPhoneNumber({
                     userId,
                     userPhoneNumber: phoneNumber,
@@ -2261,7 +2264,8 @@ class TurnkeyClient {
                 if (!accountRes) {
                     throw new TurnkeyError(`Account fetch failed`, TurnkeyErrorCodes.ACCOUNT_FETCH_ERROR);
                 }
-                if (accountRes.organizationId) {
+                if (accountRes.organizationId &&
+                    accountRes.organizationId !== session?.organizationId) {
                     throw new TurnkeyError("Account already exists with this OIDC token", TurnkeyErrorCodes.ACCOUNT_ALREADY_EXISTS);
                 }
                 const userId = params?.userId || session?.userId;
@@ -2278,18 +2282,33 @@ class TurnkeyClient {
                     const verifiedSuborg = await this.httpClient.proxyGetAccount({
                         filterType: "EMAIL",
                         filterValue: oidcEmail,
+                        oidcToken: oidcToken,
                     });
                     const isVerified = verifiedSuborg.organizationId === organizationId;
                     const user = await this.fetchUser({
                         userId,
                         stampWith,
                     });
+                    // this block's pupose is for social linking, it's important that we update the email BEFORE we call createOauthProviders
+                    // since for social linking createOauthProviders will mark the email as verified as long as it's the same one that lives in the
+                    // OIDC token.
                     if (!user?.userEmail && !isVerified) {
-                        await this.updateUserEmail({
-                            email: oidcEmail,
-                            userId,
-                            stampWith,
+                        // we cannot use our sugared updateUserEmail here since we need to pass in the oidcToken in case Require Verification Token On Account Lookup is enabled
+                        // in the dashboard
+                        const existingUser = await this.httpClient.proxyGetAccount({
+                            filterType: FilterType.Email,
+                            filterValue: oidcEmail,
+                            oidcToken: oidcToken,
                         });
+                        if (existingUser.organizationId) {
+                            throw new TurnkeyError(`Email ${oidcEmail} is already associated with another user.`, TurnkeyErrorCodes.ACCOUNT_ALREADY_EXISTS);
+                        }
+                        // update and verify their email since we got it from a verified OIDC token
+                        await this.httpClient.updateUserEmail({
+                            userId,
+                            userEmail: oidcEmail,
+                            organizationId,
+                        }, stampWith);
                     }
                 }
                 const createProviderRes = await this.httpClient.createOauthProviders({