@turnkey/react-wallet-kit 1.11.0 → 2.0.0

package/dist/providers/client/Provider.js

@@ -4,7 +4,12 @@
 var jsxRuntime = require('react/jsx-runtime');
 var sha2 = require('@noble/hashes/sha2');
 var utils$1 = require('@noble/hashes/utils');
-var oauth = require('../../utils/oauth.js');
+var storage = require('../../utils/oauth/storage.js');
+require('../../utils/oauth/config.js');
+var url = require('../../utils/oauth/url.js');
+var completion = require('../../utils/oauth/completion.js');
+var pkce = require('../../utils/oauth/pkce.js');
+var helpers = require('../../utils/oauth/helpers.js');
 var utils = require('../../utils/utils.js');
 var timers = require('../../utils/timers.js');
 var core = require('@turnkey/core');
@@ -33,7 +38,7 @@ var Verify = require('../../components/verify/Verify.js');
 var OnRamp = require('../../components/onramp/OnRamp.js');
 var Svg = require('../../components/design/Svg.js');
 var SendTransaction = require('../../components/send-transaction/SendTransaction.js');
-var helpers = require('../../components/send-transaction/helpers.js');
+var helpers$1 = require('../../components/send-transaction/helpers.js');
 
 /**
  * Provides Turnkey client authentication, session management, wallet operations, and user profile management
@@ -89,302 +94,346 @@ const ClientProvider = ({
     closeModal
   } = Hook.useModal();
   const completeRedirectOauth = async () => {
-    // Check for either hash or search parameters that could indicate an OAuth redirect
-    if (!window.location.hash && !window.location.search) {
-      // No OAuth redirect parameters found, nothing to do
-      return;
-    }
-    /**
-     * Wraps an OAuth completion action with optional modal UI.
-     * This is the key difference between redirect and popup flows:
-     * - Popup: No modal needed (the popup window itself is the UI)
-     * - Redirect: Optional modal to show loading/success states on return
-     */
-    const withModalWrapper = async params => {
-      const {
-        provider,
-        isAddProvider,
-        metadata,
-        openModal,
-        action
-      } = params;
-      const providerDisplayName = oauth.capitalizeProviderName(provider);
-      const icon = oauth.getProviderIcon(provider);
-      if (openModal === "true") {
-        // Show modal UI for the completion
-        await new Promise((resolve, reject) => {
-          pushPage({
-            key: `${providerDisplayName} OAuth`,
-            content: jsxRuntime.jsx(Action.ActionPage, {
-              closeOnComplete: isAddProvider ? false : true,
-              title: isAddProvider ? `Adding ${providerDisplayName} provider...` : `Authenticating with ${providerDisplayName}...`,
-              action: async () => {
-                try {
-                  await action();
-                  if (isAddProvider && metadata) {
-                    // Don't show success for auth. Not needed
-                    pushPage({
-                      key: "OAuth Provider Added",
-                      content: jsxRuntime.jsx(Success.SuccessPage, {
-                        text: `Successfully added ${providerDisplayName} OAuth provider!`,
-                        duration: metadata.successPageDuration ?? 2000,
-                        onComplete: () => {
-                          closeModal();
-                        }
-                      }),
-                      preventBack: true,
-                      showTitle: false
-                    });
-                  }
-                  resolve();
-                } catch (err) {
-                  if (isAddProvider) {
-                    oauth.clearOAuthAddProviderMetadata();
-                  }
-                  reject(err);
-                  popPage();
-                }
-              },
-              icon: jsxRuntime.jsx(reactFontawesome.FontAwesomeIcon, {
-                icon: icon,
-                size: "3x"
-              })
-            }),
-            showTitle: false,
-            onClose: () => {
-              if (isAddProvider) {
-                oauth.clearOAuthAddProviderMetadata();
-              }
-              reject(new sdkTypes.TurnkeyError(isAddProvider ? `User canceled the ${providerDisplayName} add provider process.` : `User canceled the ${providerDisplayName} authentication process.`, sdkTypes.TurnkeyErrorCodes.USER_CANCELED));
-            }
-          });
-        });
-      } else {
-        // No modal - execute directly
-        try {
-          await action();
-        } catch (err) {
-          if (isAddProvider) {
-            oauth.clearOAuthAddProviderMetadata();
-          }
-          throw err;
-        }
-      }
-    };
-    // Handle PKCE-based OAuth redirects (Facebook, Discord, X) with code in search parameters
-    if (window.location.search && window.location.search.includes("code=") && window.location.search.includes("state=")) {
-      // Parse the URL using our unified helper
-      const result = oauth.parseOAuthResponse(window.location.href);
-      if (!result || !result.authCode || !result.publicKey) {
-        return;
-      }
-      if (result.flow !== "redirect") {
-        // To complete OAuth we need redirect flow
+    // Since we use localStorage (see storage.ts), we always clean up OAuth data
+    // when this runs — even if there are no OAuth params in the URL (e.g. the
+    // user canceled at the provider and came back manually)
+    try {
+      // Check for either hash or search parameters that could indicate an OAuth redirect
+      if (!window.location.hash && !window.location.search) {
+        // No OAuth redirect parameters found, nothing to do
         return;
       }
-      const {
-        authCode: code,
-        provider,
-        publicKey,
-        oauthIntent,
-        sessionKey,
-        nonce,
-        openModal
-      } = result;
-      const isAddProvider = oauthIntent === oauth.OAUTH_INTENT_ADD_PROVIDER;
-      const metadata = isAddProvider ? oauth.getOAuthAddProviderMetadata() : null;
       /**
-       * Helper to complete PKCE redirect flow with optional modal wrapper.
-       * Uses handlePKCEFlow from oauth utils for the core logic.
-       * We put this in a separate function to avoid duplicating for each provider.
+       * Wraps an OAuth completion action with optional modal UI.
+       * This is the key difference between redirect and popup flows:
+       * - Popup: No modal needed (the popup window itself is the UI)
+       * - Redirect: Optional modal to show loading/success states on return
        */
-      const completePKCERedirect = async (providerName, exchangeCodeFn) => {
-        const action = async () => {
-          try {
-            await oauth.handlePKCEFlow({
-              publicKey,
-              providerName,
-              sessionKey: sessionKey ?? undefined,
-              callbacks,
-              completeOauth,
-              onAddProvider:
-              // Only set onAddProvider if we are adding a provider and have metadata
-              isAddProvider && metadata ? async oidcToken => {
-                await addOauthProvider({
-                  providerName: provider,
-                  oidcToken,
-                  organizationId: metadata.organizationId,
-                  userId: metadata.userId,
-                  ...(metadata.stampWith && {
-                    stampWith: metadata.stampWith
-                  })
-                });
-                oauth.clearOAuthAddProviderMetadata();
-              } : undefined,
-              exchangeCodeForToken: exchangeCodeFn
-            });
-          } catch (err) {
-            if (callbacks?.onError) {
-              const providerDisplayName = oauth.capitalizeProviderName(providerName);
-              callbacks.onError(err instanceof sdkTypes.TurnkeyError ? err : new sdkTypes.TurnkeyError(`${providerDisplayName} authentication failed`, sdkTypes.TurnkeyErrorCodes.OAUTH_SIGNUP_ERROR, err));
-            }
-            throw err;
-          }
-        };
-        await withModalWrapper({
-          provider: providerName,
+      const withModalWrapper = async params => {
+        const {
+          provider,
           isAddProvider,
           metadata,
           openModal,
           action
-        });
-        // Clean up URL after successful completion
-        oauth.cleanupOAuthUrl();
-      };
-      // FACEBOOK
-      if (provider === sdkTypes.OAuthProviders.FACEBOOK) {
-        const clientId = masterConfig?.auth?.oauthConfig?.facebookClientId;
-        const redirectURI = masterConfig?.auth?.oauthConfig?.oauthRedirectUri;
-        const hasVerifier = oauth.hasPKCEVerifier(sdkTypes.OAuthProviders.FACEBOOK);
-        if (clientId && redirectURI && hasVerifier) {
-          await completePKCERedirect(sdkTypes.OAuthProviders.FACEBOOK, async codeVerifier => {
-            const tokenResponse = await oauth.exchangeFacebookCodeForToken(clientId, redirectURI, code, codeVerifier);
-            const oidcToken = tokenResponse?.id_token;
-            if (!oidcToken) {
-              throw new sdkTypes.TurnkeyError("Missing OIDC token", sdkTypes.TurnkeyErrorCodes.OAUTH_LOGIN_ERROR);
-            }
-            return oidcToken;
-          });
-        }
-        return;
-      }
-      // DISCORD
-      if (provider === sdkTypes.OAuthProviders.DISCORD) {
-        const clientId = masterConfig?.auth?.oauthConfig?.discordClientId;
-        const redirectURI = masterConfig?.auth?.oauthConfig?.oauthRedirectUri;
-        const hasVerifier = oauth.hasPKCEVerifier(sdkTypes.OAuthProviders.DISCORD);
-        if (clientId && redirectURI && hasVerifier && nonce) {
-          await completePKCERedirect(sdkTypes.OAuthProviders.DISCORD, async codeVerifier => {
-            const resp = await client?.httpClient.proxyOAuth2Authenticate({
-              provider: "OAUTH2_PROVIDER_DISCORD",
-              authCode: code,
-              redirectUri: redirectURI,
-              codeVerifier,
-              clientId,
-              nonce
+        } = params;
+        const providerDisplayName = helpers.capitalizeProviderName(provider);
+        const icon = helpers.getProviderIcon(provider);
+        if (openModal === "true") {
+          // Show modal UI for the completion
+          await new Promise((resolve, reject) => {
+            pushPage({
+              key: `${providerDisplayName} OAuth`,
+              content: jsxRuntime.jsx(Action.ActionPage, {
+                closeOnComplete: isAddProvider ? false : true,
+                title: isAddProvider ? `Adding ${providerDisplayName} provider...` : `Authenticating with ${providerDisplayName}...`,
+                action: async () => {
+                  try {
+                    await action();
+                    if (isAddProvider && metadata) {
+                      // Don't show success for auth. Not needed
+                      pushPage({
+                        key: "OAuth Provider Added",
+                        content: jsxRuntime.jsx(Success.SuccessPage, {
+                          text: `Successfully added ${providerDisplayName} OAuth provider!`,
+                          duration: metadata.successPageDuration ?? 2000,
+                          onComplete: () => {
+                            closeModal();
+                          }
+                        }),
+                        preventBack: true,
+                        showTitle: false
+                      });
+                    }
+                    resolve();
+                  } catch (err) {
+                    reject(err);
+                    popPage();
+                  }
+                },
+                icon: jsxRuntime.jsx(reactFontawesome.FontAwesomeIcon, {
+                  icon: icon,
+                  size: "3x"
+                })
+              }),
+              showTitle: false,
+              onClose: () => {
+                reject(new sdkTypes.TurnkeyError(isAddProvider ? `User canceled the ${providerDisplayName} add provider process.` : `User canceled the ${providerDisplayName} authentication process.`, sdkTypes.TurnkeyErrorCodes.USER_CANCELED));
+              }
             });
-            const oidcToken = resp?.oidcToken;
-            if (!oidcToken) {
-              throw new sdkTypes.TurnkeyError("Missing OIDC token", sdkTypes.TurnkeyErrorCodes.OAUTH_LOGIN_ERROR);
-            }
-            return oidcToken;
           });
+        } else {
+          // No modal - execute directly
+          await action();
         }
-        return;
-      }
-      // X (Twitter)
-      if (provider === sdkTypes.OAuthProviders.X) {
-        const clientId = masterConfig?.auth?.oauthConfig?.xClientId;
-        const redirectURI = masterConfig?.auth?.oauthConfig?.oauthRedirectUri;
-        const hasVerifier = oauth.hasPKCEVerifier(sdkTypes.OAuthProviders.X);
-        if (clientId && redirectURI && hasVerifier && nonce) {
-          await completePKCERedirect(sdkTypes.OAuthProviders.X, async codeVerifier => {
-            const resp = await client?.httpClient.proxyOAuth2Authenticate({
-              provider: "OAUTH2_PROVIDER_X",
-              authCode: code,
-              redirectUri: redirectURI,
-              codeVerifier,
-              clientId,
-              nonce
-            });
-            const oidcToken = resp?.oidcToken;
-            if (!oidcToken) {
-              throw new sdkTypes.TurnkeyError("Missing OIDC token", sdkTypes.TurnkeyErrorCodes.OAUTH_LOGIN_ERROR);
+      };
+      // Handle PKCE-based OAuth redirects (Facebook, Discord, X) with code in search parameters
+      if (window.location.search && window.location.search.includes("code=") && window.location.search.includes("state=")) {
+        // Parse the URL using our unified helper
+        const result = url.parseOAuthResponse(window.location.href);
+        if (!result || !result.authCode || !result.publicKey) {
+          return;
+        }
+        if (result.flow !== "redirect") {
+          // To complete OAuth we need redirect flow
+          return;
+        }
+        const {
+          authCode: code,
+          provider,
+          publicKey,
+          oauthIntent,
+          sessionKey,
+          nonce,
+          openModal
+        } = result;
+        const isAddProvider = oauthIntent === storage.OAUTH_INTENT_ADD_PROVIDER;
+        const metadata = isAddProvider ? storage.getOAuthAddProviderMetadata() : null;
+        /**
+         * Helper to complete PKCE redirect flow with optional modal wrapper.
+         * Uses handlePKCEFlow from oauth utils for the core logic.
+         * We put this in a separate function to avoid duplicating for each provider.
+         */
+        const completePKCERedirect = async (providerName, exchangeCodeFn, secondaryClientIds) => {
+          const action = async () => {
+            try {
+              await completion.completePKCEFlow({
+                publicKey,
+                providerName,
+                sessionKey: sessionKey ?? undefined,
+                callbacks,
+                completeOauth: completionParams => {
+                  const existingCreateSubOrgParams = masterConfig?.auth?.createSuborgParams?.oauth;
+                  const secondaryProviders = core.buildSecondaryOauthProviders(completionParams.oidcToken, completionParams.providerName ?? providerName, secondaryClientIds);
+                  return completeOauth({
+                    ...completionParams,
+                    ...(secondaryProviders.length > 0 && {
+                      createSubOrgParams: {
+                        ...existingCreateSubOrgParams,
+                        oauthProviders: [...(existingCreateSubOrgParams?.oauthProviders ?? []), ...secondaryProviders]
+                      }
+                    })
+                  });
+                },
+                onAddProvider:
+                // Only set onAddProvider if we are adding a provider and have metadata
+                isAddProvider && metadata ? async oidcToken => {
+                  const oidcClaims = core.buildSecondaryOidcClaims(oidcToken, secondaryClientIds);
+                  await addOauthProvider({
+                    providerName: provider,
+                    oidcToken,
+                    ...(oidcClaims.length > 0 && {
+                      oidcClaims
+                    }),
+                    organizationId: metadata.organizationId,
+                    userId: metadata.userId,
+                    ...(metadata.stampWith && {
+                      stampWith: metadata.stampWith
+                    })
+                  });
+                } : undefined,
+                exchangeCodeForToken: exchangeCodeFn
+              });
+            } catch (err) {
+              if (callbacks?.onError) {
+                const providerDisplayName = helpers.capitalizeProviderName(providerName);
+                callbacks.onError(err instanceof sdkTypes.TurnkeyError ? err : new sdkTypes.TurnkeyError(`${providerDisplayName} authentication failed`, sdkTypes.TurnkeyErrorCodes.OAUTH_SIGNUP_ERROR, err));
+              }
+              throw err;
             }
-            return oidcToken;
+          };
+          await withModalWrapper({
+            provider: providerName,
+            isAddProvider,
+            metadata,
+            openModal,
+            action
           });
+          // Clean up URL after successful completion
+          url.cleanupOAuthUrl();
+        };
+        // FACEBOOK
+        if (provider === sdkTypes.OAuthProviders.FACEBOOK) {
+          const clientId = masterConfig?.auth?.oauthConfig?.facebook?.primaryClientId;
+          const secondaryClientIds = masterConfig?.auth?.oauthConfig?.facebook?.secondaryClientIds ?? [];
+          const redirectURI = masterConfig?.auth?.oauthConfig?.oauthRedirectUri;
+          const hasVerifier = storage.hasPKCEVerifier(sdkTypes.OAuthProviders.FACEBOOK);
+          if (clientId && redirectURI && hasVerifier) {
+            await completePKCERedirect(sdkTypes.OAuthProviders.FACEBOOK, async codeVerifier => {
+              const tokenResponse = await pkce.exchangeFacebookCodeForToken(clientId, redirectURI, code, codeVerifier);
+              const oidcToken = tokenResponse?.id_token;
+              if (!oidcToken) {
+                throw new sdkTypes.TurnkeyError("Missing OIDC token", sdkTypes.TurnkeyErrorCodes.OAUTH_LOGIN_ERROR);
+              }
+              return oidcToken;
+            }, secondaryClientIds);
+          }
+          return;
+        }
+        // DISCORD
+        if (provider === sdkTypes.OAuthProviders.DISCORD) {
+          const clientId = masterConfig?.auth?.oauthConfig?.discord?.primaryClientId;
+          const secondaryClientIds = masterConfig?.auth?.oauthConfig?.discord?.secondaryClientIds ?? [];
+          const redirectURI = masterConfig?.auth?.oauthConfig?.oauthRedirectUri;
+          const hasVerifier = storage.hasPKCEVerifier(sdkTypes.OAuthProviders.DISCORD);
+          if (clientId && redirectURI && hasVerifier && nonce) {
+            await completePKCERedirect(sdkTypes.OAuthProviders.DISCORD, async codeVerifier => {
+              const resp = await client?.httpClient.proxyOAuth2Authenticate({
+                provider: "OAUTH2_PROVIDER_DISCORD",
+                authCode: code,
+                redirectUri: redirectURI,
+                codeVerifier,
+                clientId,
+                nonce
+              });
+              const oidcToken = resp?.oidcToken;
+              if (!oidcToken) {
+                throw new sdkTypes.TurnkeyError("Missing OIDC token", sdkTypes.TurnkeyErrorCodes.OAUTH_LOGIN_ERROR);
+              }
+              return oidcToken;
+            }, secondaryClientIds);
+          }
+          return;
+        }
+        // X (Twitter)
+        if (provider === sdkTypes.OAuthProviders.X) {
+          const clientId = masterConfig?.auth?.oauthConfig?.x?.primaryClientId;
+          const secondaryClientIds = masterConfig?.auth?.oauthConfig?.x?.secondaryClientIds ?? [];
+          const redirectURI = masterConfig?.auth?.oauthConfig?.oauthRedirectUri;
+          const hasVerifier = storage.hasPKCEVerifier(sdkTypes.OAuthProviders.X);
+          if (clientId && redirectURI && hasVerifier && nonce) {
+            await completePKCERedirect(sdkTypes.OAuthProviders.X, async codeVerifier => {
+              const resp = await client?.httpClient.proxyOAuth2Authenticate({
+                provider: "OAUTH2_PROVIDER_X",
+                authCode: code,
+                redirectUri: redirectURI,
+                codeVerifier,
+                clientId,
+                nonce
+              });
+              const oidcToken = resp?.oidcToken;
+              if (!oidcToken) {
+                throw new sdkTypes.TurnkeyError("Missing OIDC token", sdkTypes.TurnkeyErrorCodes.OAUTH_LOGIN_ERROR);
+              }
+              return oidcToken;
+            }, secondaryClientIds);
+          }
+          return;
         }
-        return;
-      }
-    }
-    // Handle Google/Apple redirects (uses hash with idToken - non-PKCE)
-    if (window.location.hash) {
-      // Parse the URL using our unified helper
-      const result = oauth.parseOAuthResponse(window.location.href);
-      if (!result || !result.idToken || result.flow !== "redirect" || !result.publicKey) {
-        // idToken and publicKey are required to complete OAuth. These are both in the hash for non-PKCE providers
-        return;
       }
-      const {
-        idToken,
-        provider,
-        publicKey,
-        openModal,
-        sessionKey,
-        oauthIntent
-      } = result;
-      const isAddProvider = oauthIntent === oauth.OAUTH_INTENT_ADD_PROVIDER;
-      const metadata = isAddProvider ? oauth.getOAuthAddProviderMetadata() : null;
-      const resolvedProvider = provider || sdkTypes.OAuthProviders.GOOGLE;
-      // Use completeOAuthFlow from utils for the core completion logic
-      const action = async () => {
-        await oauth.completeOAuthFlow({
-          provider: resolvedProvider,
+      // Handle Google/Apple redirects (uses hash with idToken - non-PKCE)
+      if (window.location.hash) {
+        // Parse the URL using our unified helper
+        const result = url.parseOAuthResponse(window.location.href);
+        if (!result || !result.idToken || result.flow !== "redirect" || !result.publicKey) {
+          // idToken and publicKey are required to complete OAuth. These are both in the hash for non-PKCE providers
+          return;
+        }
+        const {
+          idToken,
+          provider,
           publicKey,
-          oidcToken: idToken,
-          sessionKey: sessionKey ?? undefined,
-          callbacks,
-          completeOauth,
-          onAddProvider: isAddProvider && metadata ? async oidcToken => {
-            await addOauthProvider({
-              providerName: resolvedProvider,
-              oidcToken,
-              organizationId: metadata.organizationId,
-              userId: metadata.userId,
-              ...(metadata.stampWith && {
-                stampWith: metadata.stampWith
-              })
-            });
-            oauth.clearOAuthAddProviderMetadata();
-          } : undefined
+          openModal,
+          sessionKey,
+          oauthIntent
+        } = result;
+        const isAddProvider = oauthIntent === storage.OAUTH_INTENT_ADD_PROVIDER;
+        const metadata = isAddProvider ? storage.getOAuthAddProviderMetadata() : null;
+        const resolvedProvider = provider || sdkTypes.OAuthProviders.GOOGLE;
+        // Grab Google/Apple secondary client IDs from config for use in completion
+        const secondaryClientIds = (resolvedProvider === sdkTypes.OAuthProviders.GOOGLE ? masterConfig?.auth?.oauthConfig?.google?.secondaryClientIds : resolvedProvider === sdkTypes.OAuthProviders.APPLE ? masterConfig?.auth?.oauthConfig?.apple?.secondaryClientIds : undefined) ?? [];
+        // Use completeOAuthFlow from utils for the core completion logic
+        const action = async () => {
+          await completion.completeOAuthFlow({
+            provider: resolvedProvider,
+            publicKey,
+            oidcToken: idToken,
+            sessionKey: sessionKey ?? undefined,
+            callbacks,
+            completeOauth: completionParams => {
+              const existingCreateSubOrgParams = masterConfig?.auth?.createSuborgParams?.oauth;
+              const secondaryProviders = core.buildSecondaryOauthProviders(completionParams.oidcToken, completionParams.providerName ?? resolvedProvider, secondaryClientIds);
+              return completeOauth({
+                ...completionParams,
+                ...(secondaryProviders.length > 0 && {
+                  createSubOrgParams: {
+                    ...existingCreateSubOrgParams,
+                    oauthProviders: [...(existingCreateSubOrgParams?.oauthProviders ?? []), ...secondaryProviders]
+                  }
+                })
+              });
+            },
+            onAddProvider: isAddProvider && metadata ? async oidcToken => {
+              const oidcClaims = core.buildSecondaryOidcClaims(oidcToken, secondaryClientIds);
+              await addOauthProvider({
+                providerName: resolvedProvider,
+                oidcToken,
+                ...(oidcClaims.length > 0 && {
+                  oidcClaims
+                }),
+                organizationId: metadata.organizationId,
+                userId: metadata.userId,
+                ...(metadata.stampWith && {
+                  stampWith: metadata.stampWith
+                })
+              });
+            } : undefined
+          });
+        };
+        await withModalWrapper({
+          provider: resolvedProvider,
+          isAddProvider,
+          metadata,
+          openModal: openModal ?? undefined,
+          action
         });
-      };
-      await withModalWrapper({
-        provider: resolvedProvider,
-        isAddProvider,
-        metadata,
-        openModal: openModal ?? undefined,
-        action
-      });
-      // Clean up the URL after processing
-      oauth.cleanupOAuthUrlPreserveSearch();
+        // Clean up the URL after processing
+        url.cleanupOAuthUrlPreserveSearch();
+      }
+    } finally {
+      storage.clearAllOAuthData();
     }
   };
   const buildConfig = proxyAuthConfig => {
     // Juggle the local overrides with the values set in the dashboard (proxyAuthConfig).
     const resolvedMethods = {
-      emailOtpAuthEnabled: config.auth?.methods?.emailOtpAuthEnabled ?? proxyAuthConfig?.enabledProviders.includes("email"),
-      smsOtpAuthEnabled: config.auth?.methods?.smsOtpAuthEnabled ?? proxyAuthConfig?.enabledProviders.includes("sms"),
-      passkeyAuthEnabled: config.auth?.methods?.passkeyAuthEnabled ?? proxyAuthConfig?.enabledProviders.includes("passkey"),
-      walletAuthEnabled: config.auth?.methods?.walletAuthEnabled ?? proxyAuthConfig?.enabledProviders.includes("wallet"),
-      googleOauthEnabled: config.auth?.methods?.googleOauthEnabled ?? proxyAuthConfig?.enabledProviders.includes("google"),
-      xOauthEnabled: config.auth?.methods?.xOauthEnabled ?? proxyAuthConfig?.enabledProviders.includes("x"),
-      discordOauthEnabled: config.auth?.methods?.discordOauthEnabled ?? proxyAuthConfig?.enabledProviders.includes("discord"),
-      appleOauthEnabled: config.auth?.methods?.appleOauthEnabled ?? proxyAuthConfig?.enabledProviders.includes("apple"),
-      facebookOauthEnabled: config.auth?.methods?.facebookOauthEnabled ?? proxyAuthConfig?.enabledProviders.includes("facebook")
+      emailOtpAuthEnabled: config.ui?.authModal?.methods?.emailOtpAuthEnabled ?? proxyAuthConfig?.enabledProviders.includes("email"),
+      smsOtpAuthEnabled: config.ui?.authModal?.methods?.smsOtpAuthEnabled ?? proxyAuthConfig?.enabledProviders.includes("sms"),
+      passkeyAuthEnabled: config.ui?.authModal?.methods?.passkeyAuthEnabled ?? proxyAuthConfig?.enabledProviders.includes("passkey"),
+      walletAuthEnabled: config.ui?.authModal?.methods?.walletAuthEnabled ?? proxyAuthConfig?.enabledProviders.includes("wallet"),
+      googleOauthEnabled: config.ui?.authModal?.methods?.googleOauthEnabled ?? proxyAuthConfig?.enabledProviders.includes("google"),
+      xOauthEnabled: config.ui?.authModal?.methods?.xOauthEnabled ?? proxyAuthConfig?.enabledProviders.includes("x"),
+      discordOauthEnabled: config.ui?.authModal?.methods?.discordOauthEnabled ?? proxyAuthConfig?.enabledProviders.includes("discord"),
+      appleOauthEnabled: config.ui?.authModal?.methods?.appleOauthEnabled ?? proxyAuthConfig?.enabledProviders.includes("apple"),
+      facebookOauthEnabled: config.ui?.authModal?.methods?.facebookOauthEnabled ?? proxyAuthConfig?.enabledProviders.includes("facebook")
     };
-    const resolvedClientIds = {
-      googleClientId: config.auth?.oauthConfig?.googleClientId ?? proxyAuthConfig?.oauthClientIds?.google,
-      appleClientId: config.auth?.oauthConfig?.appleClientId ?? proxyAuthConfig?.oauthClientIds?.apple,
-      facebookClientId: config.auth?.oauthConfig?.facebookClientId ?? proxyAuthConfig?.oauthClientIds?.facebook,
-      xClientId: config.auth?.oauthConfig?.xClientId ?? proxyAuthConfig?.oauthClientIds?.x,
-      discordClientId: config.auth?.oauthConfig?.discordClientId ?? proxyAuthConfig?.oauthClientIds?.discord
+    const resolvedOauthProviders = {
+      google: {
+        primaryClientId: config.auth?.oauthConfig?.google?.primaryClientId ?? proxyAuthConfig?.oauthClientIds?.google,
+        secondaryClientIds: config.auth?.oauthConfig?.google?.secondaryClientIds ?? []
+      },
+      apple: {
+        primaryClientId: config.auth?.oauthConfig?.apple?.primaryClientId ?? proxyAuthConfig?.oauthClientIds?.apple,
+        secondaryClientIds: config.auth?.oauthConfig?.apple?.secondaryClientIds ?? []
+      },
+      facebook: {
+        primaryClientId: config.auth?.oauthConfig?.facebook?.primaryClientId ?? proxyAuthConfig?.oauthClientIds?.facebook,
+        secondaryClientIds: config.auth?.oauthConfig?.facebook?.secondaryClientIds ?? []
+      },
+      x: {
+        primaryClientId: config.auth?.oauthConfig?.x?.primaryClientId ?? proxyAuthConfig?.oauthClientIds?.x,
+        secondaryClientIds: config.auth?.oauthConfig?.x?.secondaryClientIds ?? []
+      },
+      discord: {
+        primaryClientId: config.auth?.oauthConfig?.discord?.primaryClientId ?? proxyAuthConfig?.oauthClientIds?.discord,
+        secondaryClientIds: config.auth?.oauthConfig?.discord?.secondaryClientIds ?? []
+      }
     };
     const redirectUrl = config.auth?.oauthConfig?.oauthRedirectUri ?? proxyAuthConfig?.oauthRedirectUrl;
     // Set a default ordering for the oAuth methods
-    const oauthOrder = config.auth?.oauthOrder ?? ["google", "apple", "x", "discord", "facebook"].filter(provider => resolvedMethods[`${provider}OauthEnabled`]);
+    const oauthOrder = config.ui?.authModal?.oauthOrder ?? ["google", "apple", "x", "discord", "facebook"].filter(provider => resolvedMethods[`${provider}OauthEnabled`]);
     // Set a default ordering for the overall auth methods
-    const methodOrder = config.auth?.methodOrder ?? [oauthOrder.length > 0 ? "socials" : null, resolvedMethods.emailOtpAuthEnabled ? "email" : null, resolvedMethods.smsOtpAuthEnabled ? "sms" : null, resolvedMethods.passkeyAuthEnabled ? "passkey" : null, resolvedMethods.walletAuthEnabled ? "wallet" : null].filter(Boolean);
+    const methodOrder = config.ui?.authModal?.methodOrder ?? [oauthOrder.length > 0 ? "socials" : null, resolvedMethods.emailOtpAuthEnabled ? "email" : null, resolvedMethods.smsOtpAuthEnabled ? "sms" : null, resolvedMethods.passkeyAuthEnabled ? "passkey" : null, resolvedMethods.walletAuthEnabled ? "wallet" : null].filter(Boolean);
     // Warn if they are trying to set auth proxy only settings directly
     if (proxyAuthConfig) {
       if (config.auth?.sessionExpirationSeconds) {
@@ -403,24 +452,33 @@ const ClientProvider = ({
       otpAlphanumeric: proxyAuthConfig?.otpAlphanumeric ?? config.auth?.otpAlphanumeric ?? true,
       otpLength: proxyAuthConfig?.otpLength ?? config.auth?.otpLength ?? "6"
     };
+    const scopePasskeyToUser = config.auth?.scopePasskeyToUser ?? true;
     return {
       ...config,
+      scopePasskeyToUser,
       // Overrides:
       auth: {
         ...config.auth,
         ...authProxyPrioSettings,
-        methods: resolvedMethods,
         oauthConfig: {
           ...config.auth?.oauthConfig,
-          ...resolvedClientIds,
+          ...resolvedOauthProviders,
           oauthRedirectUri: redirectUrl,
           // on mobile we default to true since many mobile browsers
           // (e.g. Safari) block popups
           openOauthInPage: isMobile ? true : config.auth?.oauthConfig?.openOauthInPage
         },
-        methodOrder,
-        oauthOrder,
-        autoRefreshSession: config.auth?.autoRefreshSession ?? true
+        autoRefreshSession: config.auth?.autoRefreshSession ?? true,
+        scopePasskeyToUser
+      },
+      ui: {
+        ...config.ui,
+        authModal: {
+          ...config.ui?.authModal,
+          methods: resolvedMethods,
+          methodOrder,
+          oauthOrder
+        }
       },
       autoRefreshManagedState: config.autoRefreshManagedState ?? true,
       walletConfig: {
@@ -485,7 +543,8 @@ const ClientProvider = ({
             walletConnect: masterConfig.walletConfig.walletConnect
           })
         },
-        defaultStamperType: masterConfig.defaultStamperType
+        defaultStamperType: masterConfig.defaultStamperType,
+        scopePasskeyToUser: masterConfig.scopePasskeyToUser ?? true
       });
       await turnkeyClient.init();
       setClient(turnkeyClient);
@@ -538,7 +597,7 @@ const ClientProvider = ({
         // specifically, if WalletConnect finishes initializing before this promise resolves,
         // `maybeRefreshWallets()` could overwrite the WalletConnect wallet state with an outdated
         // list of wallets that doesn’t yet include the WalletConnect wallets
-        const [, wallets] = await Promise.all([maybeRefreshUser(), (() => {
+        const [user, wallets] = await Promise.all([maybeRefreshUser(), (() => {
           if (!masterConfig?.autoRefreshManagedState) return [];
           return fetchWallets();
         })()]);
@@ -546,6 +605,7 @@ const ClientProvider = ({
         if (wallets) {
           setWallets(prev => utils.mergeWalletsWithoutDuplicates(prev, wallets));
         }
+        if (client) await core.applyPasskeyScope(client, client.config.passkeyConfig, user, masterConfig?.auth?.scopePasskeyToUser);
         return;
       }
     } catch (error) {
@@ -733,7 +793,8 @@ const ClientProvider = ({
       const allSessions = await client.getAllSessions();
       setSession(session);
       setAllSessions(allSessions);
-      await Promise.all([maybeRefreshWallets(), maybeRefreshUser()]);
+      const [, user] = await Promise.all([maybeRefreshWallets(), maybeRefreshUser()]);
+      if (client) await core.applyPasskeyScope(client, client.config.passkeyConfig, user, masterConfig?.auth?.scopePasskeyToUser);
       if (masterConfig?.auth?.verifyWalletOnSignup === true && appProofs && appProofs.length > 0 && action === sdkTypes.AuthAction.SIGNUP) {
         // On signup, if we have appProofs, verify them
         await handleVerifyAppProofs({
@@ -767,9 +828,10 @@ const ClientProvider = ({
    * @returns void
    * @throws {TurnkeyError} If there is an error during the post-logout process.
    */
-  const handlePostLogout = sessionKey => {
+  const handlePostLogout = react.useCallback(async sessionKey => {
     try {
-      clearSessionTimeouts(sessionKey ? [sessionKey, `${sessionKey}-warning`] : undefined);
+      const timeoutKeys = sessionKey ? [sessionKey, `${sessionKey}-warning`] : undefined;
+      clearSessionTimeouts(timeoutKeys);
       setAllSessions(prev => {
         if (!prev) return prev;
         if (sessionKey) {
@@ -784,16 +846,29 @@ const ClientProvider = ({
       setSession(undefined);
       setUser(undefined);
       setWallets([]);
+      if (client) await core.resetPasskeyScope(client, client.config.passkeyConfig);
     } catch (error) {
-      callbacks?.onError?.(new sdkTypes.TurnkeyError(`Failed to initialize sessions`, sdkTypes.TurnkeyErrorCodes.HANDLE_POST_LOGOUT_ERROR, error));
+      callbacks?.onError?.(new sdkTypes.TurnkeyError(`Failed to handle post logout`, sdkTypes.TurnkeyErrorCodes.HANDLE_POST_LOGOUT_ERROR, error));
     }
-  };
+  }, [callbacks, clearSessionTimeouts, client, masterConfig?.passkeyConfig]);
   const createHttpClient = react.useCallback(params => {
     if (!client) {
       throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     }
     return client.createHttpClient(params);
   }, [client]);
+  const overrideApiKeyStamper = react.useCallback(params => {
+    if (!client) {
+      throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
+    }
+    return client.overrideApiKeyStamper(params);
+  }, [client]);
+  const overridePasskeyStamper = react.useCallback(params => {
+    if (!client) {
+      throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
+    }
+    return client.overridePasskeyStamper(params);
+  }, [client]);
   const getActiveSessionKey = react.useCallback(async () => {
     if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     return utils.withTurnkeyErrorHandling(() => client.getActiveSessionKey(), undefined, callbacks, "Failed to get active session key");
@@ -808,10 +883,10 @@ const ClientProvider = ({
       if (!sessionKey) sessionKey = await getActiveSessionKey();
       await client.logout(params);
       // We only handle post logout if the sessionKey is defined since that means we actually logged out of a session.
-      if (sessionKey) handlePostLogout(sessionKey);
+      if (sessionKey) await handlePostLogout(sessionKey);
     }, undefined, callbacks, "Failed to logout");
     return;
-  }, [client, callbacks, getActiveSessionKey]);
+  }, [client, callbacks, getActiveSessionKey, handlePostLogout]);
   const getSession = react.useCallback(async params => {
     if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     return utils.withTurnkeyErrorHandling(() => client.getSession(params), undefined, callbacks, "Failed to get session");
@@ -871,6 +946,7 @@ const ClientProvider = ({
     if (user) {
       setUser(user);
     }
+    return user;
   }, [client, callbacks, fetchUser, logout]);
   /**
    * @internal
@@ -882,7 +958,7 @@ const ClientProvider = ({
    * @returns A promise that resolves when the user is refreshed, or does nothing if auto-refresh is disabled
    */
   const maybeRefreshUser = react.useCallback(async params => {
-    if (!masterConfig?.autoRefreshManagedState) return;
+    if (!masterConfig?.autoRefreshManagedState) return undefined;
     return refreshUser(params);
   }, [masterConfig, refreshUser]);
   const refreshWallets = react.useCallback(async params => {
@@ -923,11 +999,15 @@ const ClientProvider = ({
   }, [masterConfig, refreshWallets]);
   const clearSession = react.useCallback(async params => {
     if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
+    const activeSessionKey = await getActiveSessionKey();
     await utils.withTurnkeyErrorHandling(async () => client.clearSession(params), undefined, callbacks, "Failed to clear session");
-    const sessionKey = params?.sessionKey ?? (await getActiveSessionKey());
+    const sessionKey = params?.sessionKey ?? activeSessionKey;
     if (!sessionKey) return;
-    if (!params?.sessionKey) {
+    if (!params?.sessionKey || params.sessionKey === activeSessionKey) {
       setSession(undefined);
+      setUser(undefined);
+      setWallets([]);
+      if (client) await core.resetPasskeyScope(client, client.config.passkeyConfig);
     }
     clearSessionTimeouts([sessionKey]);
     // clear only the cleared session from allSessions
@@ -939,7 +1019,7 @@ const ClientProvider = ({
     }
     setAllSessions(newAllSessions);
     return;
-  }, [client, callbacks, getActiveSessionKey, allSessions]);
+  }, [client, callbacks, getActiveSessionKey, allSessions, masterConfig?.passkeyConfig]);
   /**
    * @internal
    * Schedules a session expiration and warning timer for the given session key.
@@ -1609,17 +1689,20 @@ const ClientProvider = ({
   const addPasskey = react.useCallback(async params => {
     if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     const res = await utils.withTurnkeyErrorHandling(() => client.addPasskey(params), () => logout(), callbacks, "Failed to add passkey");
-    if (res) await maybeRefreshUser({
-      stampWith: params?.stampWith,
-      ...(params?.organizationId && {
-        organizationId: params.organizationId
-      }),
-      ...(params?.userId && {
-        userId: params.userId
-      })
-    });
+    if (res) {
+      const updatedUser = await maybeRefreshUser({
+        stampWith: params?.stampWith,
+        ...(params?.organizationId && {
+          organizationId: params.organizationId
+        }),
+        ...(params?.userId && {
+          userId: params.userId
+        })
+      });
+      await core.applyPasskeyScope(client, client.config.passkeyConfig, updatedUser, masterConfig?.auth?.scopePasskeyToUser);
+    }
     return res;
-  }, [client, callbacks, logout, maybeRefreshUser]);
+  }, [client, callbacks, logout, maybeRefreshUser, masterConfig?.passkeyConfig, masterConfig?.auth?.scopePasskeyToUser]);
   const removePasskeys = react.useCallback(async params => {
     if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     const res = await utils.withTurnkeyErrorHandling(() => client.removePasskeys(params), () => logout(), callbacks, "Failed to remove passkeys");
@@ -1727,15 +1810,20 @@ const ClientProvider = ({
     const allSessions = await getAllSessions();
     setSession(session);
     setAllSessions(allSessions);
-    await Promise.all([maybeRefreshWallets(), maybeRefreshUser()]);
-  }, [client, callbacks, logout, getActiveSessionKey, getSession, scheduleSessionExpiration, getAllSessions, maybeRefreshWallets, maybeRefreshUser]);
+    const nextUser = await maybeRefreshUser();
+    await maybeRefreshWallets();
+    if (client) await core.applyPasskeyScope(client, client.config.passkeyConfig, nextUser, masterConfig?.auth?.scopePasskeyToUser);
+  }, [client, callbacks, logout, getActiveSessionKey, getSession, scheduleSessionExpiration, getAllSessions, masterConfig?.passkeyConfig, masterConfig?.auth?.scopePasskeyToUser, maybeRefreshWallets, maybeRefreshUser]);
   const clearAllSessions = react.useCallback(async () => {
     if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     setSession(undefined);
     setAllSessions(undefined);
+    setUser(undefined);
+    setWallets([]);
     clearSessionTimeouts();
-    return await utils.withTurnkeyErrorHandling(() => client.clearAllSessions(), () => logout(), callbacks, "Failed to clear all sessions");
-  }, [client, callbacks, logout, clearSessionTimeouts]);
+    await utils.withTurnkeyErrorHandling(() => client.clearAllSessions(), () => logout(), callbacks, "Failed to clear all sessions");
+    await core.resetPasskeyScope(client, client.config.passkeyConfig);
+  }, [client, callbacks, logout, clearSessionTimeouts, masterConfig?.passkeyConfig]);
   const setActiveSession = react.useCallback(async params => {
     if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     const session = await utils.withTurnkeyErrorHandling(() => client.getSession({
@@ -1748,10 +1836,12 @@ const ClientProvider = ({
     await utils.withTurnkeyErrorHandling(() => client.setActiveSession(params), () => logout(), callbacks, "Failed to set active session");
     setSession(session);
     await utils.withTurnkeyErrorHandling(async () => {
-      await Promise.all([maybeRefreshWallets(), maybeRefreshUser()]);
+      const nextUser = await maybeRefreshUser();
+      await maybeRefreshWallets();
+      if (client) await core.applyPasskeyScope(client, client.config.passkeyConfig, nextUser, masterConfig?.auth?.scopePasskeyToUser);
     }, () => logout(), callbacks, "Failed to refresh data after setting active session");
     return;
-  }, [client, callbacks, logout, getSession, maybeRefreshWallets, maybeRefreshUser]);
+  }, [client, callbacks, logout, getSession, masterConfig?.passkeyConfig, masterConfig?.auth?.scopePasskeyToUser, maybeRefreshWallets, maybeRefreshUser]);
   const clearUnusedKeyPairs = react.useCallback(async () => {
     if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     return utils.withTurnkeyErrorHandling(() => client.clearUnusedKeyPairs(), undefined, callbacks, "Failed to clear unused key pairs");
@@ -1760,6 +1850,14 @@ const ClientProvider = ({
     if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     return utils.withTurnkeyErrorHandling(() => client.createApiKeyPair(params), undefined, callbacks, "Failed to create API key pair");
   }, [client, callbacks]);
+  const deleteApiKeyPair = react.useCallback(async params => {
+    if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
+    return utils.withTurnkeyErrorHandling(() => client.deleteApiKeyPair(params), undefined, callbacks, "Failed to delete API key pair");
+  }, [client, callbacks]);
+  const signWithApiKey = react.useCallback(async params => {
+    if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
+    return utils.withTurnkeyErrorHandling(() => client.signWithApiKey(params), undefined, callbacks, "Failed to sign with API key");
+  }, [client, callbacks]);
   const getProxyAuthConfig = react.useCallback(async () => {
     if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     return utils.withTurnkeyErrorHandling(() => client.getProxyAuthConfig(), undefined, callbacks, "Failed to get proxy auth config");
@@ -1774,10 +1872,12 @@ const ClientProvider = ({
   }, [client, callbacks, logout]);
   const handleDiscordOauth = react.useCallback(async params => {
     const {
-      clientId = masterConfig?.auth?.oauthConfig?.discordClientId,
+      primaryClientId = masterConfig?.auth?.oauthConfig?.discord?.primaryClientId,
+      secondaryClientIds = masterConfig?.auth?.oauthConfig?.discord?.secondaryClientIds ?? [],
       openInPage = masterConfig?.auth?.oauthConfig?.openOauthInPage ?? false,
       additionalState: additionalParameters
     } = params || {};
+    const clientId = primaryClientId;
     const provider = sdkTypes.OAuthProviders.DISCORD;
     if (!masterConfig) {
       throw new sdkTypes.TurnkeyError("Config is not ready yet!", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
@@ -1800,10 +1900,10 @@ const ClientProvider = ({
     const {
       verifier,
       codeChallenge
-    } = await oauth.generateChallengePair();
-    oauth.storePKCEVerifier(provider, verifier);
+    } = await pkce.generateChallengePair();
+    storage.storePKCEVerifier(provider, verifier);
     // Build OAuth URL
-    const authUrl = oauth.buildOAuthUrl({
+    const authUrl = url.buildOAuthUrl({
       provider,
       clientId,
       redirectUri,
@@ -1815,12 +1915,12 @@ const ClientProvider = ({
     });
     if (openInPage) {
       // Remainder of logic will occur in completeRedirectOauth
-      return oauth.redirectToOAuthProvider(authUrl);
+      return url.redirectToOAuthProvider(authUrl);
     }
     // Popup flow
-    const authWindow = oauth.openOAuthPopup();
+    const authWindow = url.openOAuthPopup();
     if (!authWindow) {
-      throw new Error(`Failed to open ${oauth.capitalizeProviderName(provider)} login window.`);
+      throw new Error(`Failed to open ${helpers.capitalizeProviderName(provider)} login window.`);
     }
     authWindow.location.href = authUrl;
     return new Promise((resolve, reject) => {
@@ -1831,18 +1931,30 @@ const ClientProvider = ({
             reject(new Error("Authentication window was closed."));
             return;
           }
-          const url = authWindow.location.href || "";
-          if (url.startsWith(window.location.origin)) {
-            const result = oauth.parseOAuthResponse(url, provider);
+          const url$1 = authWindow.location.href || "";
+          if (url$1.startsWith(window.location.origin)) {
+            const result = url.parseOAuthResponse(url$1, provider);
             if (result) {
               authWindow.close();
               clearInterval(interval);
-              oauth.completeOAuthPopup({
+              completion.completeOAuthPopup({
                 provider,
                 publicKey,
                 result,
                 callbacks,
-                completeOauth,
+                completeOauth: completionParams => {
+                  const existingCreateSubOrgParams = masterConfig?.auth?.createSuborgParams?.oauth;
+                  const secondaryProviders = core.buildSecondaryOauthProviders(completionParams.oidcToken, completionParams.providerName ?? provider, secondaryClientIds);
+                  return completeOauth({
+                    ...completionParams,
+                    ...(secondaryProviders.length > 0 && {
+                      createSubOrgParams: {
+                        ...existingCreateSubOrgParams,
+                        oauthProviders: [...(existingCreateSubOrgParams?.oauthProviders ?? []), ...secondaryProviders]
+                      }
+                    })
+                  });
+                },
                 onOauthSuccess: params?.onOauthSuccess,
                 exchangeCodeForToken: async codeVerifier => {
                   const resp = await client?.httpClient.proxyOAuth2Authenticate({
@@ -1869,10 +1981,12 @@ const ClientProvider = ({
   }, [client, callbacks, completeOauth, createApiKeyPair, masterConfig]);
   const handleXOauth = react.useCallback(async params => {
     const {
-      clientId = masterConfig?.auth?.oauthConfig?.xClientId,
+      primaryClientId = masterConfig?.auth?.oauthConfig?.x?.primaryClientId,
+      secondaryClientIds = masterConfig?.auth?.oauthConfig?.x?.secondaryClientIds ?? [],
       openInPage = masterConfig?.auth?.oauthConfig?.openOauthInPage ?? false,
       additionalState: additionalParameters
     } = params || {};
+    const clientId = primaryClientId;
     const provider = sdkTypes.OAuthProviders.X;
     if (!masterConfig) {
       throw new sdkTypes.TurnkeyError("Config is not ready yet!", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
@@ -1895,10 +2009,10 @@ const ClientProvider = ({
     const {
       verifier,
       codeChallenge
-    } = await oauth.generateChallengePair();
-    oauth.storePKCEVerifier(provider, verifier);
+    } = await pkce.generateChallengePair();
+    storage.storePKCEVerifier(provider, verifier);
     // Build OAuth URL
-    const authUrl = oauth.buildOAuthUrl({
+    const authUrl = url.buildOAuthUrl({
       provider,
       clientId,
       redirectUri,
@@ -1910,12 +2024,12 @@ const ClientProvider = ({
     });
     if (openInPage) {
       // Remainder of logic will occur in completeRedirectOauth
-      return oauth.redirectToOAuthProvider(authUrl);
+      return url.redirectToOAuthProvider(authUrl);
     }
     // Popup flow
-    const authWindow = oauth.openOAuthPopup();
+    const authWindow = url.openOAuthPopup();
     if (!authWindow) {
-      throw new Error(`Failed to open ${oauth.capitalizeProviderName(provider)} login window.`);
+      throw new Error(`Failed to open ${helpers.capitalizeProviderName(provider)} login window.`);
     }
     authWindow.location.href = authUrl;
     return new Promise((resolve, reject) => {
@@ -1926,18 +2040,30 @@ const ClientProvider = ({
             reject(new Error("Authentication window was closed."));
             return;
           }
-          const url = authWindow.location.href || "";
-          if (url.startsWith(window.location.origin)) {
-            const result = oauth.parseOAuthResponse(url, provider);
+          const url$1 = authWindow.location.href || "";
+          if (url$1.startsWith(window.location.origin)) {
+            const result = url.parseOAuthResponse(url$1, provider);
             if (result) {
               authWindow.close();
               clearInterval(interval);
-              oauth.completeOAuthPopup({
+              completion.completeOAuthPopup({
                 provider,
                 publicKey,
                 result,
                 callbacks,
-                completeOauth,
+                completeOauth: completionParams => {
+                  const existingCreateSubOrgParams = masterConfig?.auth?.createSuborgParams?.oauth;
+                  const secondaryProviders = core.buildSecondaryOauthProviders(completionParams.oidcToken, completionParams.providerName ?? provider, secondaryClientIds);
+                  return completeOauth({
+                    ...completionParams,
+                    ...(secondaryProviders.length > 0 && {
+                      createSubOrgParams: {
+                        ...existingCreateSubOrgParams,
+                        oauthProviders: [...(existingCreateSubOrgParams?.oauthProviders ?? []), ...secondaryProviders]
+                      }
+                    })
+                  });
+                },
                 onOauthSuccess: params?.onOauthSuccess,
                 exchangeCodeForToken: async codeVerifier => {
                   const resp = await client?.httpClient.proxyOAuth2Authenticate({
@@ -1964,10 +2090,12 @@ const ClientProvider = ({
   }, [client, callbacks, completeOauth, createApiKeyPair, masterConfig]);
   const handleGoogleOauth = react.useCallback(async params => {
     const {
-      clientId = masterConfig?.auth?.oauthConfig?.googleClientId,
+      primaryClientId = masterConfig?.auth?.oauthConfig?.google?.primaryClientId,
+      secondaryClientIds = masterConfig?.auth?.oauthConfig?.google?.secondaryClientIds ?? [],
       openInPage = masterConfig?.auth?.oauthConfig?.openOauthInPage ?? false,
       additionalState: additionalParameters
     } = params || {};
+    const clientId = primaryClientId;
     const provider = sdkTypes.OAuthProviders.GOOGLE;
     if (!masterConfig) {
       throw new sdkTypes.TurnkeyError("Config is not ready yet!", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
@@ -1988,7 +2116,7 @@ const ClientProvider = ({
     }
     const nonce = utils$1.bytesToHex(sha2.sha256(publicKey));
     // Build OAuth URL
-    const authUrl = oauth.buildOAuthUrl({
+    const authUrl = url.buildOAuthUrl({
       provider,
       clientId,
       redirectUri,
@@ -1999,12 +2127,12 @@ const ClientProvider = ({
     });
     if (openInPage) {
       // Remainder of logic will occur in completeRedirectOauth
-      return oauth.redirectToOAuthProvider(authUrl);
+      return url.redirectToOAuthProvider(authUrl);
     }
     // Popup flow
-    const authWindow = oauth.openOAuthPopup();
+    const authWindow = url.openOAuthPopup();
     if (!authWindow) {
-      throw new Error(`Failed to open ${oauth.capitalizeProviderName(provider)} login window.`);
+      throw new Error(`Failed to open ${helpers.capitalizeProviderName(provider)} login window.`);
     }
     authWindow.location.href = authUrl;
     return new Promise((resolve, reject) => {
@@ -2015,18 +2143,30 @@ const ClientProvider = ({
             reject(new Error("Authentication window was closed."));
             return;
           }
-          const url = authWindow.location.href || "";
-          if (url.startsWith(window.location.origin)) {
-            const result = oauth.parseOAuthResponse(url, provider);
+          const url$1 = authWindow.location.href || "";
+          if (url$1.startsWith(window.location.origin)) {
+            const result = url.parseOAuthResponse(url$1, provider);
             if (result) {
               authWindow.close();
               clearInterval(interval);
-              oauth.completeOAuthPopup({
+              completion.completeOAuthPopup({
                 provider,
                 publicKey,
                 result,
                 callbacks,
-                completeOauth,
+                completeOauth: completionParams => {
+                  const existingCreateSubOrgParams = masterConfig?.auth?.createSuborgParams?.oauth;
+                  const secondaryProviders = core.buildSecondaryOauthProviders(completionParams.oidcToken, completionParams.providerName ?? provider, secondaryClientIds);
+                  return completeOauth({
+                    ...completionParams,
+                    ...(secondaryProviders.length > 0 && {
+                      createSubOrgParams: {
+                        ...existingCreateSubOrgParams,
+                        oauthProviders: [...(existingCreateSubOrgParams?.oauthProviders ?? []), ...secondaryProviders]
+                      }
+                    })
+                  });
+                },
                 onOauthSuccess: params?.onOauthSuccess
               }).then(() => resolve()).catch(reject);
             }
@@ -2042,10 +2182,12 @@ const ClientProvider = ({
   }, [callbacks, completeOauth, createApiKeyPair, masterConfig]);
   const handleAppleOauth = react.useCallback(async params => {
     const {
-      clientId = masterConfig?.auth?.oauthConfig?.appleClientId,
+      primaryClientId = masterConfig?.auth?.oauthConfig?.apple?.primaryClientId,
+      secondaryClientIds = masterConfig?.auth?.oauthConfig?.apple?.secondaryClientIds ?? [],
       openInPage = masterConfig?.auth?.oauthConfig?.openOauthInPage ?? false,
       additionalState: additionalParameters
     } = params || {};
+    const clientId = primaryClientId;
     const provider = sdkTypes.OAuthProviders.APPLE;
     if (!masterConfig) {
       throw new sdkTypes.TurnkeyError("Config is not ready yet!", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
@@ -2066,7 +2208,7 @@ const ClientProvider = ({
     }
     const nonce = utils$1.bytesToHex(sha2.sha256(publicKey));
     // Build OAuth URL
-    const authUrl = oauth.buildOAuthUrl({
+    const authUrl = url.buildOAuthUrl({
       provider,
       clientId,
       redirectUri,
@@ -2077,12 +2219,12 @@ const ClientProvider = ({
     });
     if (openInPage) {
       // Remainder of logic will occur in completeRedirectOauth
-      return oauth.redirectToOAuthProvider(authUrl);
+      return url.redirectToOAuthProvider(authUrl);
     }
     // Popup flow
-    const authWindow = oauth.openOAuthPopup();
+    const authWindow = url.openOAuthPopup();
     if (!authWindow) {
-      throw new Error(`Failed to open ${oauth.capitalizeProviderName(provider)} login window.`);
+      throw new Error(`Failed to open ${helpers.capitalizeProviderName(provider)} login window.`);
     }
     authWindow.location.href = authUrl;
     return new Promise((resolve, reject) => {
@@ -2093,18 +2235,30 @@ const ClientProvider = ({
             reject(new Error("Authentication window was closed."));
             return;
           }
-          const url = authWindow.location.href || "";
-          if (url.startsWith(window.location.origin)) {
-            const result = oauth.parseOAuthResponse(url, provider);
+          const url$1 = authWindow.location.href || "";
+          if (url$1.startsWith(window.location.origin)) {
+            const result = url.parseOAuthResponse(url$1, provider);
             if (result) {
               authWindow.close();
               clearInterval(interval);
-              oauth.completeOAuthPopup({
+              completion.completeOAuthPopup({
                 provider,
                 publicKey,
                 result,
                 callbacks,
-                completeOauth,
+                completeOauth: completionParams => {
+                  const existingCreateSubOrgParams = masterConfig?.auth?.createSuborgParams?.oauth;
+                  const secondaryProviders = core.buildSecondaryOauthProviders(completionParams.oidcToken, completionParams.providerName ?? provider, secondaryClientIds);
+                  return completeOauth({
+                    ...completionParams,
+                    ...(secondaryProviders.length > 0 && {
+                      createSubOrgParams: {
+                        ...existingCreateSubOrgParams,
+                        oauthProviders: [...(existingCreateSubOrgParams?.oauthProviders ?? []), ...secondaryProviders]
+                      }
+                    })
+                  });
+                },
                 onOauthSuccess: params?.onOauthSuccess
               }).then(() => resolve()).catch(reject);
             }
@@ -2120,10 +2274,12 @@ const ClientProvider = ({
   }, [callbacks, completeOauth, createApiKeyPair, masterConfig]);
   const handleFacebookOauth = react.useCallback(async params => {
     const {
-      clientId = masterConfig?.auth?.oauthConfig?.facebookClientId,
+      primaryClientId = masterConfig?.auth?.oauthConfig?.facebook?.primaryClientId,
+      secondaryClientIds = masterConfig?.auth?.oauthConfig?.facebook?.secondaryClientIds ?? [],
       openInPage = masterConfig?.auth?.oauthConfig?.openOauthInPage ?? false,
       additionalState: additionalParameters
     } = params || {};
+    const clientId = primaryClientId;
     const provider = sdkTypes.OAuthProviders.FACEBOOK;
     if (!masterConfig) {
       throw new sdkTypes.TurnkeyError("Config is not ready yet!", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
@@ -2146,10 +2302,10 @@ const ClientProvider = ({
     const {
       verifier,
       codeChallenge
-    } = await oauth.generateChallengePair();
-    oauth.storePKCEVerifier(provider, verifier);
+    } = await pkce.generateChallengePair();
+    storage.storePKCEVerifier(provider, verifier);
     // Build OAuth URL
-    const authUrl = oauth.buildOAuthUrl({
+    const authUrl = url.buildOAuthUrl({
       provider,
       clientId,
       redirectUri,
@@ -2161,12 +2317,12 @@ const ClientProvider = ({
     });
     if (openInPage) {
       // Remainder of logic will occur in completeRedirectOauth
-      return oauth.redirectToOAuthProvider(authUrl);
+      return url.redirectToOAuthProvider(authUrl);
     }
     // Popup flow
-    const authWindow = oauth.openOAuthPopup();
+    const authWindow = url.openOAuthPopup();
     if (!authWindow) {
-      throw new Error(`Failed to open ${oauth.capitalizeProviderName(provider)} login window.`);
+      throw new Error(`Failed to open ${helpers.capitalizeProviderName(provider)} login window.`);
     }
     authWindow.location.href = authUrl;
     return new Promise((resolve, reject) => {
@@ -2177,21 +2333,33 @@ const ClientProvider = ({
             reject(new Error("Authentication window was closed."));
             return;
           }
-          const url = authWindow.location.href || "";
-          if (url.startsWith(window.location.origin)) {
-            const result = oauth.parseOAuthResponse(url, provider);
+          const url$1 = authWindow.location.href || "";
+          if (url$1.startsWith(window.location.origin)) {
+            const result = url.parseOAuthResponse(url$1, provider);
             if (result) {
               authWindow.close();
               clearInterval(interval);
-              oauth.completeOAuthPopup({
+              completion.completeOAuthPopup({
                 provider,
                 publicKey,
                 result,
                 callbacks,
-                completeOauth,
+                completeOauth: completionParams => {
+                  const existingCreateSubOrgParams = masterConfig?.auth?.createSuborgParams?.oauth;
+                  const secondaryProviders = core.buildSecondaryOauthProviders(completionParams.oidcToken, completionParams.providerName ?? provider, secondaryClientIds);
+                  return completeOauth({
+                    ...completionParams,
+                    ...(secondaryProviders.length > 0 && {
+                      createSubOrgParams: {
+                        ...existingCreateSubOrgParams,
+                        oauthProviders: [...(existingCreateSubOrgParams?.oauthProviders ?? []), ...secondaryProviders]
+                      }
+                    })
+                  });
+                },
                 onOauthSuccess: params?.onOauthSuccess,
                 exchangeCodeForToken: async codeVerifier => {
-                  const tokenData = await oauth.exchangeFacebookCodeForToken(clientId, redirectUri, result.authCode, codeVerifier);
+                  const tokenData = await pkce.exchangeFacebookCodeForToken(clientId, redirectUri, result.authCode, codeVerifier);
                   return tokenData.id_token;
                 }
               }).then(() => resolve()).catch(reject);
@@ -2492,9 +2660,6 @@ const ClientProvider = ({
     if (!masterConfig) {
       throw new sdkTypes.TurnkeyError("Config is not ready yet!", sdkTypes.TurnkeyErrorCodes.CONFIG_NOT_INITIALIZED);
     }
-    if (!masterConfig.auth?.methods?.smsOtpAuthEnabled) {
-      throw new sdkTypes.TurnkeyError("SMS OTP authentication is not enabled in the configuration.", sdkTypes.TurnkeyErrorCodes.AUTH_METHOD_NOT_ENABLED);
-    }
     const s = await getSession();
     const organizationId = params?.organizationId || s?.organizationId;
     if (!organizationId) {
@@ -2544,7 +2709,10 @@ const ClientProvider = ({
           });
         }), () => logout());
       } else {
-        const otpId = await initOtp({
+        const {
+          otpId,
+          otpEncryptionTargetBundle
+        } = await initOtp({
           otpType: core.OtpType.Sms,
           contact: params.phoneNumber
         });
@@ -2555,6 +2723,7 @@ const ClientProvider = ({
               otpType: core.OtpType.Sms,
               contact: params.phoneNumber,
               otpId: otpId,
+              otpEncryptionTargetBundle: otpEncryptionTargetBundle,
               otpLength: masterConfig.auth?.otpLength !== undefined ? Number(masterConfig.auth.otpLength) : undefined,
               alphanumeric: masterConfig.auth?.otpAlphanumeric,
               onContinue: async otpCode => {
@@ -2564,8 +2733,7 @@ const ClientProvider = ({
                   } = await verifyOtp({
                     otpId,
                     otpCode,
-                    contact: params.phoneNumber,
-                    otpType: core.OtpType.Sms
+                    otpEncryptionTargetBundle
                   });
                   const res = await updateUserPhoneNumber({
                     phoneNumber: params.phoneNumber,
@@ -2662,7 +2830,10 @@ const ClientProvider = ({
           });
         }), () => logout());
       } else {
-        const otpId = await initOtp({
+        const {
+          otpId,
+          otpEncryptionTargetBundle
+        } = await initOtp({
           otpType: core.OtpType.Email,
           contact: params.email
         });
@@ -2673,6 +2844,7 @@ const ClientProvider = ({
               otpType: core.OtpType.Email,
               contact: params.email,
               otpId: otpId,
+              otpEncryptionTargetBundle: otpEncryptionTargetBundle,
               otpLength: masterConfig?.auth?.otpLength !== undefined ? Number(masterConfig.auth.otpLength) : undefined,
               alphanumeric: masterConfig?.auth?.otpAlphanumeric,
               onContinue: async otpCode => {
@@ -2682,8 +2854,7 @@ const ClientProvider = ({
                   } = await verifyOtp({
                     otpId,
                     otpCode,
-                    contact: params.email,
-                    otpType: core.OtpType.Email
+                    otpEncryptionTargetBundle
                   });
                   const res = await updateUserEmail({
                     email: params.email,
@@ -2777,7 +2948,10 @@ const ClientProvider = ({
           });
         }), () => logout());
       } else {
-        const otpId = await initOtp({
+        const {
+          otpId,
+          otpEncryptionTargetBundle
+        } = await initOtp({
           otpType: core.OtpType.Email,
           contact: params.email
         });
@@ -2788,6 +2962,7 @@ const ClientProvider = ({
               otpType: core.OtpType.Email,
               contact: params.email,
               otpId: otpId,
+              otpEncryptionTargetBundle: otpEncryptionTargetBundle,
               otpLength: masterConfig?.auth?.otpLength !== undefined ? Number(masterConfig.auth.otpLength) : undefined,
               alphanumeric: masterConfig?.auth?.otpAlphanumeric,
               onContinue: async otpCode => {
@@ -2797,8 +2972,7 @@ const ClientProvider = ({
                   } = await verifyOtp({
                     otpId,
                     otpCode,
-                    contact: params.email,
-                    otpType: core.OtpType.Email
+                    otpEncryptionTargetBundle
                   });
                   const res = await updateUserEmail({
                     email: params.email,
@@ -2842,9 +3016,6 @@ const ClientProvider = ({
     if (!masterConfig) {
       throw new sdkTypes.TurnkeyError("Config is not ready yet!", sdkTypes.TurnkeyErrorCodes.CONFIG_NOT_INITIALIZED);
     }
-    if (!masterConfig.auth?.methods?.smsOtpAuthEnabled) {
-      throw new sdkTypes.TurnkeyError("SMS OTP authentication is not enabled in the configuration.", sdkTypes.TurnkeyErrorCodes.AUTH_METHOD_NOT_ENABLED);
-    }
     const s = await getSession();
     const organizationId = params?.organizationId || s?.organizationId;
     if (!organizationId) {
@@ -2896,7 +3067,10 @@ const ClientProvider = ({
           });
         }), () => logout(), callbacks, "Failed to add phone number");
       } else {
-        const otpId = await initOtp({
+        const {
+          otpId,
+          otpEncryptionTargetBundle
+        } = await initOtp({
           otpType: core.OtpType.Sms,
           contact: params.phoneNumber
         });
@@ -2907,6 +3081,7 @@ const ClientProvider = ({
               otpType: core.OtpType.Sms,
               contact: params.phoneNumber,
               otpId: otpId,
+              otpEncryptionTargetBundle: otpEncryptionTargetBundle,
               otpLength: masterConfig.auth?.otpLength !== undefined ? Number(masterConfig.auth.otpLength) : undefined,
               alphanumeric: masterConfig?.auth?.otpAlphanumeric,
               onContinue: async otpCode => {
@@ -2916,8 +3091,7 @@ const ClientProvider = ({
                   } = await verifyOtp({
                     otpId,
                     otpCode,
-                    contact: params.phoneNumber,
-                    otpType: core.OtpType.Sms
+                    otpEncryptionTargetBundle
                   });
                   const res = await updateUserPhoneNumber({
                     phoneNumber: params.phoneNumber,
@@ -3110,6 +3284,29 @@ const ClientProvider = ({
       successPageDuration = 2000,
       openInPage = masterConfig?.auth?.oauthConfig?.openOauthInPage ?? false
     } = params;
+    // Resolve the provider's per-provider config, then apply per-call overrides.
+    let providerConfig;
+    switch (providerName) {
+      case sdkTypes.OAuthProviders.DISCORD:
+        providerConfig = masterConfig?.auth?.oauthConfig?.discord;
+        break;
+      case sdkTypes.OAuthProviders.X:
+        providerConfig = masterConfig?.auth?.oauthConfig?.x;
+        break;
+      case sdkTypes.OAuthProviders.GOOGLE:
+        providerConfig = masterConfig?.auth?.oauthConfig?.google;
+        break;
+      case sdkTypes.OAuthProviders.APPLE:
+        providerConfig = masterConfig?.auth?.oauthConfig?.apple;
+        break;
+      case sdkTypes.OAuthProviders.FACEBOOK:
+        providerConfig = masterConfig?.auth?.oauthConfig?.facebook;
+        break;
+      default:
+        providerConfig = undefined;
+    }
+    const primaryClientId = params.primaryClientId ?? providerConfig?.primaryClientId;
+    const secondaryClientIds = params.secondaryClientIds ?? providerConfig?.secondaryClientIds ?? [];
     const s = await getSession();
     const organizationId = params?.organizationId || s?.organizationId;
     if (!organizationId) {
@@ -3122,9 +3319,13 @@ const ClientProvider = ({
     return new Promise(async (resolve, reject) => {
       try {
         const onOauthSuccess = async params => {
+          const oidcClaims = core.buildSecondaryOidcClaims(params.oidcToken, secondaryClientIds);
           await addOauthProvider({
             providerName: params.providerName,
             oidcToken: params.oidcToken,
+            ...(oidcClaims.length > 0 && {
+              oidcClaims
+            }),
             stampWith,
             organizationId,
             userId
@@ -3144,7 +3345,7 @@ const ClientProvider = ({
           });
         };
         if (openInPage) {
-          oauth.storeOAuthAddProviderMetadata({
+          storage.storeOAuthAddProviderMetadata({
             organizationId,
             userId,
             ...(stampWith && {
@@ -3154,71 +3355,47 @@ const ClientProvider = ({
           });
         }
         const additionalState = openInPage ? {
-          oauthIntent: oauth.OAUTH_INTENT_ADD_PROVIDER,
+          oauthIntent: storage.OAUTH_INTENT_ADD_PROVIDER,
           ...(successPageDuration > 0 && {
             openModal: "true"
           })
         } : undefined;
+        // Forward overrides so the inner handler uses the same client IDs.
+        const sharedOauthParams = {
+          openInPage,
+          ...(primaryClientId && {
+            primaryClientId
+          }),
+          ...(secondaryClientIds.length > 0 && {
+            secondaryClientIds
+          }),
+          ...(additionalState && {
+            additionalState
+          }),
+          ...(!openInPage && {
+            onOauthSuccess
+          })
+        };
         switch (providerName) {
           case sdkTypes.OAuthProviders.DISCORD:
             {
-              return await handleDiscordOauth({
-                openInPage,
-                ...(additionalState && {
-                  additionalState
-                }),
-                ...(!openInPage && {
-                  onOauthSuccess
-                })
-              });
+              return await handleDiscordOauth(sharedOauthParams);
             }
           case sdkTypes.OAuthProviders.X:
             {
-              return await handleXOauth({
-                openInPage,
-                ...(additionalState && {
-                  additionalState
-                }),
-                ...(!openInPage && {
-                  onOauthSuccess
-                })
-              });
+              return await handleXOauth(sharedOauthParams);
             }
           case sdkTypes.OAuthProviders.GOOGLE:
             {
-              return await handleGoogleOauth({
-                openInPage,
-                ...(additionalState && {
-                  additionalState
-                }),
-                ...(!openInPage && {
-                  onOauthSuccess
-                })
-              });
+              return await handleGoogleOauth(sharedOauthParams);
             }
           case sdkTypes.OAuthProviders.APPLE:
             {
-              return await handleAppleOauth({
-                openInPage,
-                ...(additionalState && {
-                  additionalState
-                }),
-                ...(!openInPage && {
-                  onOauthSuccess
-                })
-              });
+              return await handleAppleOauth(sharedOauthParams);
             }
           case sdkTypes.OAuthProviders.FACEBOOK:
             {
-              return await handleFacebookOauth({
-                openInPage,
-                ...(additionalState && {
-                  additionalState
-                }),
-                ...(!openInPage && {
-                  onOauthSuccess
-                })
-              });
+              return await handleFacebookOauth(sharedOauthParams);
             }
           default:
             {
@@ -3382,7 +3559,7 @@ const ClientProvider = ({
           const tx = {
             from,
             to,
-            caip2,
+            caip2: caip2,
             sponsor: sponsor ?? false,
             ...(value ? {
               value
@@ -3428,7 +3605,7 @@ const ClientProvider = ({
         preventBack: true,
         onClose: () => reject(new sdkTypes.TurnkeyError("User canceled the transaction.", sdkTypes.TurnkeyErrorCodes.USER_CANCELED)),
         content: jsxRuntime.jsx(SendTransaction.SendTransactionPage, {
-          icon: icon ?? helpers.getChainLogo(caip2),
+          icon: icon ?? helpers$1.getChainLogo(caip2),
           action: action,
           caip2: caip2,
           successPageDuration: successPageDuration,
@@ -3478,7 +3655,7 @@ const ClientProvider = ({
         preventBack: true,
         onClose: () => reject(new sdkTypes.TurnkeyError("User canceled the transaction.", sdkTypes.TurnkeyErrorCodes.USER_CANCELED)),
         content: jsxRuntime.jsx(SendTransaction.SendTransactionPage, {
-          icon: icon ?? helpers.getChainLogo(caip2),
+          icon: icon ?? helpers$1.getChainLogo(caip2),
           action: action,
           caip2: caip2,
           successPageDuration: successPageDuration,
@@ -3815,6 +3992,8 @@ const ClientProvider = ({
       config: masterConfig,
       httpClient: client?.httpClient,
       createHttpClient,
+      overrideApiKeyStamper,
+      overridePasskeyStamper,
       createPasskey,
       logout,
       loginWithPasskey,
@@ -3877,6 +4056,8 @@ const ClientProvider = ({
       clearUnusedKeyPairs,
       getActiveSessionKey,
       createApiKeyPair,
+      deleteApiKeyPair,
+      signWithApiKey,
       getProxyAuthConfig,
       fetchBootProofForAppProof,
       verifyAppProofs,