@turnkey/react-wallet-kit 1.11.1 → 2.0.0

package/dist/providers/client/Provider.js

@@ -191,10 +191,10 @@ const ClientProvider = ({
         const metadata = isAddProvider ? storage.getOAuthAddProviderMetadata() : null;
         /**
          * Helper to complete PKCE redirect flow with optional modal wrapper.
-         * Uses completePKCEFlow from oauth utils for the core logic.
+         * Uses handlePKCEFlow from oauth utils for the core logic.
          * We put this in a separate function to avoid duplicating for each provider.
          */
-        const completePKCERedirect = async (providerName, exchangeCodeFn) => {
+        const completePKCERedirect = async (providerName, exchangeCodeFn, secondaryClientIds) => {
           const action = async () => {
             try {
               await completion.completePKCEFlow({
@@ -202,13 +202,29 @@ const ClientProvider = ({
                 providerName,
                 sessionKey: sessionKey ?? undefined,
                 callbacks,
-                completeOauth,
+                completeOauth: completionParams => {
+                  const existingCreateSubOrgParams = masterConfig?.auth?.createSuborgParams?.oauth;
+                  const secondaryProviders = core.buildSecondaryOauthProviders(completionParams.oidcToken, completionParams.providerName ?? providerName, secondaryClientIds);
+                  return completeOauth({
+                    ...completionParams,
+                    ...(secondaryProviders.length > 0 && {
+                      createSubOrgParams: {
+                        ...existingCreateSubOrgParams,
+                        oauthProviders: [...(existingCreateSubOrgParams?.oauthProviders ?? []), ...secondaryProviders]
+                      }
+                    })
+                  });
+                },
                 onAddProvider:
                 // Only set onAddProvider if we are adding a provider and have metadata
                 isAddProvider && metadata ? async oidcToken => {
+                  const oidcClaims = core.buildSecondaryOidcClaims(oidcToken, secondaryClientIds);
                   await addOauthProvider({
                     providerName: provider,
                     oidcToken,
+                    ...(oidcClaims.length > 0 && {
+                      oidcClaims
+                    }),
                     organizationId: metadata.organizationId,
                     userId: metadata.userId,
                     ...(metadata.stampWith && {
@@ -238,7 +254,8 @@ const ClientProvider = ({
         };
         // FACEBOOK
         if (provider === sdkTypes.OAuthProviders.FACEBOOK) {
-          const clientId = masterConfig?.auth?.oauthConfig?.facebookClientId;
+          const clientId = masterConfig?.auth?.oauthConfig?.facebook?.primaryClientId;
+          const secondaryClientIds = masterConfig?.auth?.oauthConfig?.facebook?.secondaryClientIds ?? [];
           const redirectURI = masterConfig?.auth?.oauthConfig?.oauthRedirectUri;
           const hasVerifier = storage.hasPKCEVerifier(sdkTypes.OAuthProviders.FACEBOOK);
           if (clientId && redirectURI && hasVerifier) {
@@ -249,13 +266,14 @@ const ClientProvider = ({
                 throw new sdkTypes.TurnkeyError("Missing OIDC token", sdkTypes.TurnkeyErrorCodes.OAUTH_LOGIN_ERROR);
               }
               return oidcToken;
-            });
+            }, secondaryClientIds);
           }
           return;
         }
         // DISCORD
         if (provider === sdkTypes.OAuthProviders.DISCORD) {
-          const clientId = masterConfig?.auth?.oauthConfig?.discordClientId;
+          const clientId = masterConfig?.auth?.oauthConfig?.discord?.primaryClientId;
+          const secondaryClientIds = masterConfig?.auth?.oauthConfig?.discord?.secondaryClientIds ?? [];
           const redirectURI = masterConfig?.auth?.oauthConfig?.oauthRedirectUri;
           const hasVerifier = storage.hasPKCEVerifier(sdkTypes.OAuthProviders.DISCORD);
           if (clientId && redirectURI && hasVerifier && nonce) {
@@ -273,13 +291,14 @@ const ClientProvider = ({
                 throw new sdkTypes.TurnkeyError("Missing OIDC token", sdkTypes.TurnkeyErrorCodes.OAUTH_LOGIN_ERROR);
               }
               return oidcToken;
-            });
+            }, secondaryClientIds);
           }
           return;
         }
         // X (Twitter)
         if (provider === sdkTypes.OAuthProviders.X) {
-          const clientId = masterConfig?.auth?.oauthConfig?.xClientId;
+          const clientId = masterConfig?.auth?.oauthConfig?.x?.primaryClientId;
+          const secondaryClientIds = masterConfig?.auth?.oauthConfig?.x?.secondaryClientIds ?? [];
           const redirectURI = masterConfig?.auth?.oauthConfig?.oauthRedirectUri;
           const hasVerifier = storage.hasPKCEVerifier(sdkTypes.OAuthProviders.X);
           if (clientId && redirectURI && hasVerifier && nonce) {
@@ -297,7 +316,7 @@ const ClientProvider = ({
                 throw new sdkTypes.TurnkeyError("Missing OIDC token", sdkTypes.TurnkeyErrorCodes.OAUTH_LOGIN_ERROR);
               }
               return oidcToken;
-            });
+            }, secondaryClientIds);
           }
           return;
         }
@@ -321,6 +340,8 @@ const ClientProvider = ({
         const isAddProvider = oauthIntent === storage.OAUTH_INTENT_ADD_PROVIDER;
         const metadata = isAddProvider ? storage.getOAuthAddProviderMetadata() : null;
         const resolvedProvider = provider || sdkTypes.OAuthProviders.GOOGLE;
+        // Grab Google/Apple secondary client IDs from config for use in completion
+        const secondaryClientIds = (resolvedProvider === sdkTypes.OAuthProviders.GOOGLE ? masterConfig?.auth?.oauthConfig?.google?.secondaryClientIds : resolvedProvider === sdkTypes.OAuthProviders.APPLE ? masterConfig?.auth?.oauthConfig?.apple?.secondaryClientIds : undefined) ?? [];
         // Use completeOAuthFlow from utils for the core completion logic
         const action = async () => {
           await completion.completeOAuthFlow({
@@ -329,11 +350,27 @@ const ClientProvider = ({
             oidcToken: idToken,
             sessionKey: sessionKey ?? undefined,
             callbacks,
-            completeOauth,
+            completeOauth: completionParams => {
+              const existingCreateSubOrgParams = masterConfig?.auth?.createSuborgParams?.oauth;
+              const secondaryProviders = core.buildSecondaryOauthProviders(completionParams.oidcToken, completionParams.providerName ?? resolvedProvider, secondaryClientIds);
+              return completeOauth({
+                ...completionParams,
+                ...(secondaryProviders.length > 0 && {
+                  createSubOrgParams: {
+                    ...existingCreateSubOrgParams,
+                    oauthProviders: [...(existingCreateSubOrgParams?.oauthProviders ?? []), ...secondaryProviders]
+                  }
+                })
+              });
+            },
             onAddProvider: isAddProvider && metadata ? async oidcToken => {
+              const oidcClaims = core.buildSecondaryOidcClaims(oidcToken, secondaryClientIds);
               await addOauthProvider({
                 providerName: resolvedProvider,
                 oidcToken,
+                ...(oidcClaims.length > 0 && {
+                  oidcClaims
+                }),
                 organizationId: metadata.organizationId,
                 userId: metadata.userId,
                 ...(metadata.stampWith && {
@@ -360,28 +397,43 @@ const ClientProvider = ({
   const buildConfig = proxyAuthConfig => {
     // Juggle the local overrides with the values set in the dashboard (proxyAuthConfig).
     const resolvedMethods = {
-      emailOtpAuthEnabled: config.auth?.methods?.emailOtpAuthEnabled ?? proxyAuthConfig?.enabledProviders.includes("email"),
-      smsOtpAuthEnabled: config.auth?.methods?.smsOtpAuthEnabled ?? proxyAuthConfig?.enabledProviders.includes("sms"),
-      passkeyAuthEnabled: config.auth?.methods?.passkeyAuthEnabled ?? proxyAuthConfig?.enabledProviders.includes("passkey"),
-      walletAuthEnabled: config.auth?.methods?.walletAuthEnabled ?? proxyAuthConfig?.enabledProviders.includes("wallet"),
-      googleOauthEnabled: config.auth?.methods?.googleOauthEnabled ?? proxyAuthConfig?.enabledProviders.includes("google"),
-      xOauthEnabled: config.auth?.methods?.xOauthEnabled ?? proxyAuthConfig?.enabledProviders.includes("x"),
-      discordOauthEnabled: config.auth?.methods?.discordOauthEnabled ?? proxyAuthConfig?.enabledProviders.includes("discord"),
-      appleOauthEnabled: config.auth?.methods?.appleOauthEnabled ?? proxyAuthConfig?.enabledProviders.includes("apple"),
-      facebookOauthEnabled: config.auth?.methods?.facebookOauthEnabled ?? proxyAuthConfig?.enabledProviders.includes("facebook")
+      emailOtpAuthEnabled: config.ui?.authModal?.methods?.emailOtpAuthEnabled ?? proxyAuthConfig?.enabledProviders.includes("email"),
+      smsOtpAuthEnabled: config.ui?.authModal?.methods?.smsOtpAuthEnabled ?? proxyAuthConfig?.enabledProviders.includes("sms"),
+      passkeyAuthEnabled: config.ui?.authModal?.methods?.passkeyAuthEnabled ?? proxyAuthConfig?.enabledProviders.includes("passkey"),
+      walletAuthEnabled: config.ui?.authModal?.methods?.walletAuthEnabled ?? proxyAuthConfig?.enabledProviders.includes("wallet"),
+      googleOauthEnabled: config.ui?.authModal?.methods?.googleOauthEnabled ?? proxyAuthConfig?.enabledProviders.includes("google"),
+      xOauthEnabled: config.ui?.authModal?.methods?.xOauthEnabled ?? proxyAuthConfig?.enabledProviders.includes("x"),
+      discordOauthEnabled: config.ui?.authModal?.methods?.discordOauthEnabled ?? proxyAuthConfig?.enabledProviders.includes("discord"),
+      appleOauthEnabled: config.ui?.authModal?.methods?.appleOauthEnabled ?? proxyAuthConfig?.enabledProviders.includes("apple"),
+      facebookOauthEnabled: config.ui?.authModal?.methods?.facebookOauthEnabled ?? proxyAuthConfig?.enabledProviders.includes("facebook")
     };
-    const resolvedClientIds = {
-      googleClientId: config.auth?.oauthConfig?.googleClientId ?? proxyAuthConfig?.oauthClientIds?.google,
-      appleClientId: config.auth?.oauthConfig?.appleClientId ?? proxyAuthConfig?.oauthClientIds?.apple,
-      facebookClientId: config.auth?.oauthConfig?.facebookClientId ?? proxyAuthConfig?.oauthClientIds?.facebook,
-      xClientId: config.auth?.oauthConfig?.xClientId ?? proxyAuthConfig?.oauthClientIds?.x,
-      discordClientId: config.auth?.oauthConfig?.discordClientId ?? proxyAuthConfig?.oauthClientIds?.discord
+    const resolvedOauthProviders = {
+      google: {
+        primaryClientId: config.auth?.oauthConfig?.google?.primaryClientId ?? proxyAuthConfig?.oauthClientIds?.google,
+        secondaryClientIds: config.auth?.oauthConfig?.google?.secondaryClientIds ?? []
+      },
+      apple: {
+        primaryClientId: config.auth?.oauthConfig?.apple?.primaryClientId ?? proxyAuthConfig?.oauthClientIds?.apple,
+        secondaryClientIds: config.auth?.oauthConfig?.apple?.secondaryClientIds ?? []
+      },
+      facebook: {
+        primaryClientId: config.auth?.oauthConfig?.facebook?.primaryClientId ?? proxyAuthConfig?.oauthClientIds?.facebook,
+        secondaryClientIds: config.auth?.oauthConfig?.facebook?.secondaryClientIds ?? []
+      },
+      x: {
+        primaryClientId: config.auth?.oauthConfig?.x?.primaryClientId ?? proxyAuthConfig?.oauthClientIds?.x,
+        secondaryClientIds: config.auth?.oauthConfig?.x?.secondaryClientIds ?? []
+      },
+      discord: {
+        primaryClientId: config.auth?.oauthConfig?.discord?.primaryClientId ?? proxyAuthConfig?.oauthClientIds?.discord,
+        secondaryClientIds: config.auth?.oauthConfig?.discord?.secondaryClientIds ?? []
+      }
     };
     const redirectUrl = config.auth?.oauthConfig?.oauthRedirectUri ?? proxyAuthConfig?.oauthRedirectUrl;
     // Set a default ordering for the oAuth methods
-    const oauthOrder = config.auth?.oauthOrder ?? ["google", "apple", "x", "discord", "facebook"].filter(provider => resolvedMethods[`${provider}OauthEnabled`]);
+    const oauthOrder = config.ui?.authModal?.oauthOrder ?? ["google", "apple", "x", "discord", "facebook"].filter(provider => resolvedMethods[`${provider}OauthEnabled`]);
     // Set a default ordering for the overall auth methods
-    const methodOrder = config.auth?.methodOrder ?? [oauthOrder.length > 0 ? "socials" : null, resolvedMethods.emailOtpAuthEnabled ? "email" : null, resolvedMethods.smsOtpAuthEnabled ? "sms" : null, resolvedMethods.passkeyAuthEnabled ? "passkey" : null, resolvedMethods.walletAuthEnabled ? "wallet" : null].filter(Boolean);
+    const methodOrder = config.ui?.authModal?.methodOrder ?? [oauthOrder.length > 0 ? "socials" : null, resolvedMethods.emailOtpAuthEnabled ? "email" : null, resolvedMethods.smsOtpAuthEnabled ? "sms" : null, resolvedMethods.passkeyAuthEnabled ? "passkey" : null, resolvedMethods.walletAuthEnabled ? "wallet" : null].filter(Boolean);
     // Warn if they are trying to set auth proxy only settings directly
     if (proxyAuthConfig) {
       if (config.auth?.sessionExpirationSeconds) {
@@ -400,24 +452,33 @@ const ClientProvider = ({
       otpAlphanumeric: proxyAuthConfig?.otpAlphanumeric ?? config.auth?.otpAlphanumeric ?? true,
       otpLength: proxyAuthConfig?.otpLength ?? config.auth?.otpLength ?? "6"
     };
+    const scopePasskeyToUser = config.auth?.scopePasskeyToUser ?? true;
     return {
       ...config,
+      scopePasskeyToUser,
       // Overrides:
       auth: {
         ...config.auth,
         ...authProxyPrioSettings,
-        methods: resolvedMethods,
         oauthConfig: {
           ...config.auth?.oauthConfig,
-          ...resolvedClientIds,
+          ...resolvedOauthProviders,
           oauthRedirectUri: redirectUrl,
           // on mobile we default to true since many mobile browsers
           // (e.g. Safari) block popups
           openOauthInPage: isMobile ? true : config.auth?.oauthConfig?.openOauthInPage
         },
-        methodOrder,
-        oauthOrder,
-        autoRefreshSession: config.auth?.autoRefreshSession ?? true
+        autoRefreshSession: config.auth?.autoRefreshSession ?? true,
+        scopePasskeyToUser
+      },
+      ui: {
+        ...config.ui,
+        authModal: {
+          ...config.ui?.authModal,
+          methods: resolvedMethods,
+          methodOrder,
+          oauthOrder
+        }
       },
       autoRefreshManagedState: config.autoRefreshManagedState ?? true,
       walletConfig: {
@@ -482,7 +543,8 @@ const ClientProvider = ({
             walletConnect: masterConfig.walletConfig.walletConnect
           })
         },
-        defaultStamperType: masterConfig.defaultStamperType
+        defaultStamperType: masterConfig.defaultStamperType,
+        scopePasskeyToUser: masterConfig.scopePasskeyToUser ?? true
       });
       await turnkeyClient.init();
       setClient(turnkeyClient);
@@ -535,7 +597,7 @@ const ClientProvider = ({
         // specifically, if WalletConnect finishes initializing before this promise resolves,
         // `maybeRefreshWallets()` could overwrite the WalletConnect wallet state with an outdated
         // list of wallets that doesn’t yet include the WalletConnect wallets
-        const [, wallets] = await Promise.all([maybeRefreshUser(), (() => {
+        const [user, wallets] = await Promise.all([maybeRefreshUser(), (() => {
           if (!masterConfig?.autoRefreshManagedState) return [];
           return fetchWallets();
         })()]);
@@ -543,6 +605,7 @@ const ClientProvider = ({
         if (wallets) {
           setWallets(prev => utils.mergeWalletsWithoutDuplicates(prev, wallets));
         }
+        if (client) await core.applyPasskeyScope(client, client.config.passkeyConfig, user, masterConfig?.auth?.scopePasskeyToUser);
         return;
       }
     } catch (error) {
@@ -730,7 +793,8 @@ const ClientProvider = ({
       const allSessions = await client.getAllSessions();
       setSession(session);
       setAllSessions(allSessions);
-      await Promise.all([maybeRefreshWallets(), maybeRefreshUser()]);
+      const [, user] = await Promise.all([maybeRefreshWallets(), maybeRefreshUser()]);
+      if (client) await core.applyPasskeyScope(client, client.config.passkeyConfig, user, masterConfig?.auth?.scopePasskeyToUser);
       if (masterConfig?.auth?.verifyWalletOnSignup === true && appProofs && appProofs.length > 0 && action === sdkTypes.AuthAction.SIGNUP) {
         // On signup, if we have appProofs, verify them
         await handleVerifyAppProofs({
@@ -764,9 +828,10 @@ const ClientProvider = ({
    * @returns void
    * @throws {TurnkeyError} If there is an error during the post-logout process.
    */
-  const handlePostLogout = sessionKey => {
+  const handlePostLogout = react.useCallback(async sessionKey => {
     try {
-      clearSessionTimeouts(sessionKey ? [sessionKey, `${sessionKey}-warning`] : undefined);
+      const timeoutKeys = sessionKey ? [sessionKey, `${sessionKey}-warning`] : undefined;
+      clearSessionTimeouts(timeoutKeys);
       setAllSessions(prev => {
         if (!prev) return prev;
         if (sessionKey) {
@@ -781,16 +846,29 @@ const ClientProvider = ({
       setSession(undefined);
       setUser(undefined);
       setWallets([]);
+      if (client) await core.resetPasskeyScope(client, client.config.passkeyConfig);
     } catch (error) {
-      callbacks?.onError?.(new sdkTypes.TurnkeyError(`Failed to initialize sessions`, sdkTypes.TurnkeyErrorCodes.HANDLE_POST_LOGOUT_ERROR, error));
+      callbacks?.onError?.(new sdkTypes.TurnkeyError(`Failed to handle post logout`, sdkTypes.TurnkeyErrorCodes.HANDLE_POST_LOGOUT_ERROR, error));
     }
-  };
+  }, [callbacks, clearSessionTimeouts, client, masterConfig?.passkeyConfig]);
   const createHttpClient = react.useCallback(params => {
     if (!client) {
       throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     }
     return client.createHttpClient(params);
   }, [client]);
+  const overrideApiKeyStamper = react.useCallback(params => {
+    if (!client) {
+      throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
+    }
+    return client.overrideApiKeyStamper(params);
+  }, [client]);
+  const overridePasskeyStamper = react.useCallback(params => {
+    if (!client) {
+      throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
+    }
+    return client.overridePasskeyStamper(params);
+  }, [client]);
   const getActiveSessionKey = react.useCallback(async () => {
     if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     return utils.withTurnkeyErrorHandling(() => client.getActiveSessionKey(), undefined, callbacks, "Failed to get active session key");
@@ -805,10 +883,10 @@ const ClientProvider = ({
       if (!sessionKey) sessionKey = await getActiveSessionKey();
       await client.logout(params);
       // We only handle post logout if the sessionKey is defined since that means we actually logged out of a session.
-      if (sessionKey) handlePostLogout(sessionKey);
+      if (sessionKey) await handlePostLogout(sessionKey);
     }, undefined, callbacks, "Failed to logout");
     return;
-  }, [client, callbacks, getActiveSessionKey]);
+  }, [client, callbacks, getActiveSessionKey, handlePostLogout]);
   const getSession = react.useCallback(async params => {
     if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     return utils.withTurnkeyErrorHandling(() => client.getSession(params), undefined, callbacks, "Failed to get session");
@@ -868,6 +946,7 @@ const ClientProvider = ({
     if (user) {
       setUser(user);
     }
+    return user;
   }, [client, callbacks, fetchUser, logout]);
   /**
    * @internal
@@ -879,7 +958,7 @@ const ClientProvider = ({
    * @returns A promise that resolves when the user is refreshed, or does nothing if auto-refresh is disabled
    */
   const maybeRefreshUser = react.useCallback(async params => {
-    if (!masterConfig?.autoRefreshManagedState) return;
+    if (!masterConfig?.autoRefreshManagedState) return undefined;
     return refreshUser(params);
   }, [masterConfig, refreshUser]);
   const refreshWallets = react.useCallback(async params => {
@@ -920,11 +999,15 @@ const ClientProvider = ({
   }, [masterConfig, refreshWallets]);
   const clearSession = react.useCallback(async params => {
     if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
+    const activeSessionKey = await getActiveSessionKey();
     await utils.withTurnkeyErrorHandling(async () => client.clearSession(params), undefined, callbacks, "Failed to clear session");
-    const sessionKey = params?.sessionKey ?? (await getActiveSessionKey());
+    const sessionKey = params?.sessionKey ?? activeSessionKey;
     if (!sessionKey) return;
-    if (!params?.sessionKey) {
+    if (!params?.sessionKey || params.sessionKey === activeSessionKey) {
       setSession(undefined);
+      setUser(undefined);
+      setWallets([]);
+      if (client) await core.resetPasskeyScope(client, client.config.passkeyConfig);
     }
     clearSessionTimeouts([sessionKey]);
     // clear only the cleared session from allSessions
@@ -936,7 +1019,7 @@ const ClientProvider = ({
     }
     setAllSessions(newAllSessions);
     return;
-  }, [client, callbacks, getActiveSessionKey, allSessions]);
+  }, [client, callbacks, getActiveSessionKey, allSessions, masterConfig?.passkeyConfig]);
   /**
    * @internal
    * Schedules a session expiration and warning timer for the given session key.
@@ -1606,17 +1689,20 @@ const ClientProvider = ({
   const addPasskey = react.useCallback(async params => {
     if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     const res = await utils.withTurnkeyErrorHandling(() => client.addPasskey(params), () => logout(), callbacks, "Failed to add passkey");
-    if (res) await maybeRefreshUser({
-      stampWith: params?.stampWith,
-      ...(params?.organizationId && {
-        organizationId: params.organizationId
-      }),
-      ...(params?.userId && {
-        userId: params.userId
-      })
-    });
+    if (res) {
+      const updatedUser = await maybeRefreshUser({
+        stampWith: params?.stampWith,
+        ...(params?.organizationId && {
+          organizationId: params.organizationId
+        }),
+        ...(params?.userId && {
+          userId: params.userId
+        })
+      });
+      await core.applyPasskeyScope(client, client.config.passkeyConfig, updatedUser, masterConfig?.auth?.scopePasskeyToUser);
+    }
     return res;
-  }, [client, callbacks, logout, maybeRefreshUser]);
+  }, [client, callbacks, logout, maybeRefreshUser, masterConfig?.passkeyConfig, masterConfig?.auth?.scopePasskeyToUser]);
   const removePasskeys = react.useCallback(async params => {
     if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     const res = await utils.withTurnkeyErrorHandling(() => client.removePasskeys(params), () => logout(), callbacks, "Failed to remove passkeys");
@@ -1724,15 +1810,20 @@ const ClientProvider = ({
     const allSessions = await getAllSessions();
     setSession(session);
     setAllSessions(allSessions);
-    await Promise.all([maybeRefreshWallets(), maybeRefreshUser()]);
-  }, [client, callbacks, logout, getActiveSessionKey, getSession, scheduleSessionExpiration, getAllSessions, maybeRefreshWallets, maybeRefreshUser]);
+    const nextUser = await maybeRefreshUser();
+    await maybeRefreshWallets();
+    if (client) await core.applyPasskeyScope(client, client.config.passkeyConfig, nextUser, masterConfig?.auth?.scopePasskeyToUser);
+  }, [client, callbacks, logout, getActiveSessionKey, getSession, scheduleSessionExpiration, getAllSessions, masterConfig?.passkeyConfig, masterConfig?.auth?.scopePasskeyToUser, maybeRefreshWallets, maybeRefreshUser]);
   const clearAllSessions = react.useCallback(async () => {
     if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     setSession(undefined);
     setAllSessions(undefined);
+    setUser(undefined);
+    setWallets([]);
     clearSessionTimeouts();
-    return await utils.withTurnkeyErrorHandling(() => client.clearAllSessions(), () => logout(), callbacks, "Failed to clear all sessions");
-  }, [client, callbacks, logout, clearSessionTimeouts]);
+    await utils.withTurnkeyErrorHandling(() => client.clearAllSessions(), () => logout(), callbacks, "Failed to clear all sessions");
+    await core.resetPasskeyScope(client, client.config.passkeyConfig);
+  }, [client, callbacks, logout, clearSessionTimeouts, masterConfig?.passkeyConfig]);
   const setActiveSession = react.useCallback(async params => {
     if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     const session = await utils.withTurnkeyErrorHandling(() => client.getSession({
@@ -1745,10 +1836,12 @@ const ClientProvider = ({
     await utils.withTurnkeyErrorHandling(() => client.setActiveSession(params), () => logout(), callbacks, "Failed to set active session");
     setSession(session);
     await utils.withTurnkeyErrorHandling(async () => {
-      await Promise.all([maybeRefreshWallets(), maybeRefreshUser()]);
+      const nextUser = await maybeRefreshUser();
+      await maybeRefreshWallets();
+      if (client) await core.applyPasskeyScope(client, client.config.passkeyConfig, nextUser, masterConfig?.auth?.scopePasskeyToUser);
     }, () => logout(), callbacks, "Failed to refresh data after setting active session");
     return;
-  }, [client, callbacks, logout, getSession, maybeRefreshWallets, maybeRefreshUser]);
+  }, [client, callbacks, logout, getSession, masterConfig?.passkeyConfig, masterConfig?.auth?.scopePasskeyToUser, maybeRefreshWallets, maybeRefreshUser]);
   const clearUnusedKeyPairs = react.useCallback(async () => {
     if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     return utils.withTurnkeyErrorHandling(() => client.clearUnusedKeyPairs(), undefined, callbacks, "Failed to clear unused key pairs");
@@ -1757,6 +1850,14 @@ const ClientProvider = ({
     if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     return utils.withTurnkeyErrorHandling(() => client.createApiKeyPair(params), undefined, callbacks, "Failed to create API key pair");
   }, [client, callbacks]);
+  const deleteApiKeyPair = react.useCallback(async params => {
+    if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
+    return utils.withTurnkeyErrorHandling(() => client.deleteApiKeyPair(params), undefined, callbacks, "Failed to delete API key pair");
+  }, [client, callbacks]);
+  const signWithApiKey = react.useCallback(async params => {
+    if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
+    return utils.withTurnkeyErrorHandling(() => client.signWithApiKey(params), undefined, callbacks, "Failed to sign with API key");
+  }, [client, callbacks]);
   const getProxyAuthConfig = react.useCallback(async () => {
     if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     return utils.withTurnkeyErrorHandling(() => client.getProxyAuthConfig(), undefined, callbacks, "Failed to get proxy auth config");
@@ -1771,10 +1872,12 @@ const ClientProvider = ({
   }, [client, callbacks, logout]);
   const handleDiscordOauth = react.useCallback(async params => {
     const {
-      clientId = masterConfig?.auth?.oauthConfig?.discordClientId,
+      primaryClientId = masterConfig?.auth?.oauthConfig?.discord?.primaryClientId,
+      secondaryClientIds = masterConfig?.auth?.oauthConfig?.discord?.secondaryClientIds ?? [],
       openInPage = masterConfig?.auth?.oauthConfig?.openOauthInPage ?? false,
       additionalState: additionalParameters
     } = params || {};
+    const clientId = primaryClientId;
     const provider = sdkTypes.OAuthProviders.DISCORD;
     if (!masterConfig) {
       throw new sdkTypes.TurnkeyError("Config is not ready yet!", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
@@ -1839,7 +1942,19 @@ const ClientProvider = ({
                 publicKey,
                 result,
                 callbacks,
-                completeOauth,
+                completeOauth: completionParams => {
+                  const existingCreateSubOrgParams = masterConfig?.auth?.createSuborgParams?.oauth;
+                  const secondaryProviders = core.buildSecondaryOauthProviders(completionParams.oidcToken, completionParams.providerName ?? provider, secondaryClientIds);
+                  return completeOauth({
+                    ...completionParams,
+                    ...(secondaryProviders.length > 0 && {
+                      createSubOrgParams: {
+                        ...existingCreateSubOrgParams,
+                        oauthProviders: [...(existingCreateSubOrgParams?.oauthProviders ?? []), ...secondaryProviders]
+                      }
+                    })
+                  });
+                },
                 onOauthSuccess: params?.onOauthSuccess,
                 exchangeCodeForToken: async codeVerifier => {
                   const resp = await client?.httpClient.proxyOAuth2Authenticate({
@@ -1866,10 +1981,12 @@ const ClientProvider = ({
   }, [client, callbacks, completeOauth, createApiKeyPair, masterConfig]);
   const handleXOauth = react.useCallback(async params => {
     const {
-      clientId = masterConfig?.auth?.oauthConfig?.xClientId,
+      primaryClientId = masterConfig?.auth?.oauthConfig?.x?.primaryClientId,
+      secondaryClientIds = masterConfig?.auth?.oauthConfig?.x?.secondaryClientIds ?? [],
       openInPage = masterConfig?.auth?.oauthConfig?.openOauthInPage ?? false,
       additionalState: additionalParameters
     } = params || {};
+    const clientId = primaryClientId;
     const provider = sdkTypes.OAuthProviders.X;
     if (!masterConfig) {
       throw new sdkTypes.TurnkeyError("Config is not ready yet!", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
@@ -1934,7 +2051,19 @@ const ClientProvider = ({
                 publicKey,
                 result,
                 callbacks,
-                completeOauth,
+                completeOauth: completionParams => {
+                  const existingCreateSubOrgParams = masterConfig?.auth?.createSuborgParams?.oauth;
+                  const secondaryProviders = core.buildSecondaryOauthProviders(completionParams.oidcToken, completionParams.providerName ?? provider, secondaryClientIds);
+                  return completeOauth({
+                    ...completionParams,
+                    ...(secondaryProviders.length > 0 && {
+                      createSubOrgParams: {
+                        ...existingCreateSubOrgParams,
+                        oauthProviders: [...(existingCreateSubOrgParams?.oauthProviders ?? []), ...secondaryProviders]
+                      }
+                    })
+                  });
+                },
                 onOauthSuccess: params?.onOauthSuccess,
                 exchangeCodeForToken: async codeVerifier => {
                   const resp = await client?.httpClient.proxyOAuth2Authenticate({
@@ -1961,10 +2090,12 @@ const ClientProvider = ({
   }, [client, callbacks, completeOauth, createApiKeyPair, masterConfig]);
   const handleGoogleOauth = react.useCallback(async params => {
     const {
-      clientId = masterConfig?.auth?.oauthConfig?.googleClientId,
+      primaryClientId = masterConfig?.auth?.oauthConfig?.google?.primaryClientId,
+      secondaryClientIds = masterConfig?.auth?.oauthConfig?.google?.secondaryClientIds ?? [],
       openInPage = masterConfig?.auth?.oauthConfig?.openOauthInPage ?? false,
       additionalState: additionalParameters
     } = params || {};
+    const clientId = primaryClientId;
     const provider = sdkTypes.OAuthProviders.GOOGLE;
     if (!masterConfig) {
       throw new sdkTypes.TurnkeyError("Config is not ready yet!", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
@@ -2023,7 +2154,19 @@ const ClientProvider = ({
                 publicKey,
                 result,
                 callbacks,
-                completeOauth,
+                completeOauth: completionParams => {
+                  const existingCreateSubOrgParams = masterConfig?.auth?.createSuborgParams?.oauth;
+                  const secondaryProviders = core.buildSecondaryOauthProviders(completionParams.oidcToken, completionParams.providerName ?? provider, secondaryClientIds);
+                  return completeOauth({
+                    ...completionParams,
+                    ...(secondaryProviders.length > 0 && {
+                      createSubOrgParams: {
+                        ...existingCreateSubOrgParams,
+                        oauthProviders: [...(existingCreateSubOrgParams?.oauthProviders ?? []), ...secondaryProviders]
+                      }
+                    })
+                  });
+                },
                 onOauthSuccess: params?.onOauthSuccess
               }).then(() => resolve()).catch(reject);
             }
@@ -2039,10 +2182,12 @@ const ClientProvider = ({
   }, [callbacks, completeOauth, createApiKeyPair, masterConfig]);
   const handleAppleOauth = react.useCallback(async params => {
     const {
-      clientId = masterConfig?.auth?.oauthConfig?.appleClientId,
+      primaryClientId = masterConfig?.auth?.oauthConfig?.apple?.primaryClientId,
+      secondaryClientIds = masterConfig?.auth?.oauthConfig?.apple?.secondaryClientIds ?? [],
       openInPage = masterConfig?.auth?.oauthConfig?.openOauthInPage ?? false,
       additionalState: additionalParameters
     } = params || {};
+    const clientId = primaryClientId;
     const provider = sdkTypes.OAuthProviders.APPLE;
     if (!masterConfig) {
       throw new sdkTypes.TurnkeyError("Config is not ready yet!", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
@@ -2101,7 +2246,19 @@ const ClientProvider = ({
                 publicKey,
                 result,
                 callbacks,
-                completeOauth,
+                completeOauth: completionParams => {
+                  const existingCreateSubOrgParams = masterConfig?.auth?.createSuborgParams?.oauth;
+                  const secondaryProviders = core.buildSecondaryOauthProviders(completionParams.oidcToken, completionParams.providerName ?? provider, secondaryClientIds);
+                  return completeOauth({
+                    ...completionParams,
+                    ...(secondaryProviders.length > 0 && {
+                      createSubOrgParams: {
+                        ...existingCreateSubOrgParams,
+                        oauthProviders: [...(existingCreateSubOrgParams?.oauthProviders ?? []), ...secondaryProviders]
+                      }
+                    })
+                  });
+                },
                 onOauthSuccess: params?.onOauthSuccess
               }).then(() => resolve()).catch(reject);
             }
@@ -2117,10 +2274,12 @@ const ClientProvider = ({
   }, [callbacks, completeOauth, createApiKeyPair, masterConfig]);
   const handleFacebookOauth = react.useCallback(async params => {
     const {
-      clientId = masterConfig?.auth?.oauthConfig?.facebookClientId,
+      primaryClientId = masterConfig?.auth?.oauthConfig?.facebook?.primaryClientId,
+      secondaryClientIds = masterConfig?.auth?.oauthConfig?.facebook?.secondaryClientIds ?? [],
       openInPage = masterConfig?.auth?.oauthConfig?.openOauthInPage ?? false,
       additionalState: additionalParameters
     } = params || {};
+    const clientId = primaryClientId;
     const provider = sdkTypes.OAuthProviders.FACEBOOK;
     if (!masterConfig) {
       throw new sdkTypes.TurnkeyError("Config is not ready yet!", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
@@ -2185,7 +2344,19 @@ const ClientProvider = ({
                 publicKey,
                 result,
                 callbacks,
-                completeOauth,
+                completeOauth: completionParams => {
+                  const existingCreateSubOrgParams = masterConfig?.auth?.createSuborgParams?.oauth;
+                  const secondaryProviders = core.buildSecondaryOauthProviders(completionParams.oidcToken, completionParams.providerName ?? provider, secondaryClientIds);
+                  return completeOauth({
+                    ...completionParams,
+                    ...(secondaryProviders.length > 0 && {
+                      createSubOrgParams: {
+                        ...existingCreateSubOrgParams,
+                        oauthProviders: [...(existingCreateSubOrgParams?.oauthProviders ?? []), ...secondaryProviders]
+                      }
+                    })
+                  });
+                },
                 onOauthSuccess: params?.onOauthSuccess,
                 exchangeCodeForToken: async codeVerifier => {
                   const tokenData = await pkce.exchangeFacebookCodeForToken(clientId, redirectUri, result.authCode, codeVerifier);
@@ -2489,9 +2660,6 @@ const ClientProvider = ({
     if (!masterConfig) {
       throw new sdkTypes.TurnkeyError("Config is not ready yet!", sdkTypes.TurnkeyErrorCodes.CONFIG_NOT_INITIALIZED);
     }
-    if (!masterConfig.auth?.methods?.smsOtpAuthEnabled) {
-      throw new sdkTypes.TurnkeyError("SMS OTP authentication is not enabled in the configuration.", sdkTypes.TurnkeyErrorCodes.AUTH_METHOD_NOT_ENABLED);
-    }
     const s = await getSession();
     const organizationId = params?.organizationId || s?.organizationId;
     if (!organizationId) {
@@ -2541,7 +2709,10 @@ const ClientProvider = ({
           });
         }), () => logout());
       } else {
-        const otpId = await initOtp({
+        const {
+          otpId,
+          otpEncryptionTargetBundle
+        } = await initOtp({
           otpType: core.OtpType.Sms,
           contact: params.phoneNumber
         });
@@ -2552,6 +2723,7 @@ const ClientProvider = ({
               otpType: core.OtpType.Sms,
               contact: params.phoneNumber,
               otpId: otpId,
+              otpEncryptionTargetBundle: otpEncryptionTargetBundle,
               otpLength: masterConfig.auth?.otpLength !== undefined ? Number(masterConfig.auth.otpLength) : undefined,
               alphanumeric: masterConfig.auth?.otpAlphanumeric,
               onContinue: async otpCode => {
@@ -2561,8 +2733,7 @@ const ClientProvider = ({
                   } = await verifyOtp({
                     otpId,
                     otpCode,
-                    contact: params.phoneNumber,
-                    otpType: core.OtpType.Sms
+                    otpEncryptionTargetBundle
                   });
                   const res = await updateUserPhoneNumber({
                     phoneNumber: params.phoneNumber,
@@ -2659,7 +2830,10 @@ const ClientProvider = ({
           });
         }), () => logout());
       } else {
-        const otpId = await initOtp({
+        const {
+          otpId,
+          otpEncryptionTargetBundle
+        } = await initOtp({
           otpType: core.OtpType.Email,
           contact: params.email
         });
@@ -2670,6 +2844,7 @@ const ClientProvider = ({
               otpType: core.OtpType.Email,
               contact: params.email,
               otpId: otpId,
+              otpEncryptionTargetBundle: otpEncryptionTargetBundle,
               otpLength: masterConfig?.auth?.otpLength !== undefined ? Number(masterConfig.auth.otpLength) : undefined,
               alphanumeric: masterConfig?.auth?.otpAlphanumeric,
               onContinue: async otpCode => {
@@ -2679,8 +2854,7 @@ const ClientProvider = ({
                   } = await verifyOtp({
                     otpId,
                     otpCode,
-                    contact: params.email,
-                    otpType: core.OtpType.Email
+                    otpEncryptionTargetBundle
                   });
                   const res = await updateUserEmail({
                     email: params.email,
@@ -2774,7 +2948,10 @@ const ClientProvider = ({
           });
         }), () => logout());
       } else {
-        const otpId = await initOtp({
+        const {
+          otpId,
+          otpEncryptionTargetBundle
+        } = await initOtp({
           otpType: core.OtpType.Email,
           contact: params.email
         });
@@ -2785,6 +2962,7 @@ const ClientProvider = ({
               otpType: core.OtpType.Email,
               contact: params.email,
               otpId: otpId,
+              otpEncryptionTargetBundle: otpEncryptionTargetBundle,
               otpLength: masterConfig?.auth?.otpLength !== undefined ? Number(masterConfig.auth.otpLength) : undefined,
               alphanumeric: masterConfig?.auth?.otpAlphanumeric,
               onContinue: async otpCode => {
@@ -2794,8 +2972,7 @@ const ClientProvider = ({
                   } = await verifyOtp({
                     otpId,
                     otpCode,
-                    contact: params.email,
-                    otpType: core.OtpType.Email
+                    otpEncryptionTargetBundle
                   });
                   const res = await updateUserEmail({
                     email: params.email,
@@ -2839,9 +3016,6 @@ const ClientProvider = ({
     if (!masterConfig) {
       throw new sdkTypes.TurnkeyError("Config is not ready yet!", sdkTypes.TurnkeyErrorCodes.CONFIG_NOT_INITIALIZED);
     }
-    if (!masterConfig.auth?.methods?.smsOtpAuthEnabled) {
-      throw new sdkTypes.TurnkeyError("SMS OTP authentication is not enabled in the configuration.", sdkTypes.TurnkeyErrorCodes.AUTH_METHOD_NOT_ENABLED);
-    }
     const s = await getSession();
     const organizationId = params?.organizationId || s?.organizationId;
     if (!organizationId) {
@@ -2893,7 +3067,10 @@ const ClientProvider = ({
           });
         }), () => logout(), callbacks, "Failed to add phone number");
       } else {
-        const otpId = await initOtp({
+        const {
+          otpId,
+          otpEncryptionTargetBundle
+        } = await initOtp({
           otpType: core.OtpType.Sms,
           contact: params.phoneNumber
         });
@@ -2904,6 +3081,7 @@ const ClientProvider = ({
               otpType: core.OtpType.Sms,
               contact: params.phoneNumber,
               otpId: otpId,
+              otpEncryptionTargetBundle: otpEncryptionTargetBundle,
               otpLength: masterConfig.auth?.otpLength !== undefined ? Number(masterConfig.auth.otpLength) : undefined,
               alphanumeric: masterConfig?.auth?.otpAlphanumeric,
               onContinue: async otpCode => {
@@ -2913,8 +3091,7 @@ const ClientProvider = ({
                   } = await verifyOtp({
                     otpId,
                     otpCode,
-                    contact: params.phoneNumber,
-                    otpType: core.OtpType.Sms
+                    otpEncryptionTargetBundle
                   });
                   const res = await updateUserPhoneNumber({
                     phoneNumber: params.phoneNumber,
@@ -3107,6 +3284,29 @@ const ClientProvider = ({
       successPageDuration = 2000,
       openInPage = masterConfig?.auth?.oauthConfig?.openOauthInPage ?? false
     } = params;
+    // Resolve the provider's per-provider config, then apply per-call overrides.
+    let providerConfig;
+    switch (providerName) {
+      case sdkTypes.OAuthProviders.DISCORD:
+        providerConfig = masterConfig?.auth?.oauthConfig?.discord;
+        break;
+      case sdkTypes.OAuthProviders.X:
+        providerConfig = masterConfig?.auth?.oauthConfig?.x;
+        break;
+      case sdkTypes.OAuthProviders.GOOGLE:
+        providerConfig = masterConfig?.auth?.oauthConfig?.google;
+        break;
+      case sdkTypes.OAuthProviders.APPLE:
+        providerConfig = masterConfig?.auth?.oauthConfig?.apple;
+        break;
+      case sdkTypes.OAuthProviders.FACEBOOK:
+        providerConfig = masterConfig?.auth?.oauthConfig?.facebook;
+        break;
+      default:
+        providerConfig = undefined;
+    }
+    const primaryClientId = params.primaryClientId ?? providerConfig?.primaryClientId;
+    const secondaryClientIds = params.secondaryClientIds ?? providerConfig?.secondaryClientIds ?? [];
     const s = await getSession();
     const organizationId = params?.organizationId || s?.organizationId;
     if (!organizationId) {
@@ -3119,9 +3319,13 @@ const ClientProvider = ({
     return new Promise(async (resolve, reject) => {
       try {
         const onOauthSuccess = async params => {
+          const oidcClaims = core.buildSecondaryOidcClaims(params.oidcToken, secondaryClientIds);
           await addOauthProvider({
             providerName: params.providerName,
             oidcToken: params.oidcToken,
+            ...(oidcClaims.length > 0 && {
+              oidcClaims
+            }),
             stampWith,
             organizationId,
             userId
@@ -3156,66 +3360,42 @@ const ClientProvider = ({
             openModal: "true"
           })
         } : undefined;
+        // Forward overrides so the inner handler uses the same client IDs.
+        const sharedOauthParams = {
+          openInPage,
+          ...(primaryClientId && {
+            primaryClientId
+          }),
+          ...(secondaryClientIds.length > 0 && {
+            secondaryClientIds
+          }),
+          ...(additionalState && {
+            additionalState
+          }),
+          ...(!openInPage && {
+            onOauthSuccess
+          })
+        };
         switch (providerName) {
           case sdkTypes.OAuthProviders.DISCORD:
             {
-              return await handleDiscordOauth({
-                openInPage,
-                ...(additionalState && {
-                  additionalState
-                }),
-                ...(!openInPage && {
-                  onOauthSuccess
-                })
-              });
+              return await handleDiscordOauth(sharedOauthParams);
             }
           case sdkTypes.OAuthProviders.X:
             {
-              return await handleXOauth({
-                openInPage,
-                ...(additionalState && {
-                  additionalState
-                }),
-                ...(!openInPage && {
-                  onOauthSuccess
-                })
-              });
+              return await handleXOauth(sharedOauthParams);
             }
           case sdkTypes.OAuthProviders.GOOGLE:
             {
-              return await handleGoogleOauth({
-                openInPage,
-                ...(additionalState && {
-                  additionalState
-                }),
-                ...(!openInPage && {
-                  onOauthSuccess
-                })
-              });
+              return await handleGoogleOauth(sharedOauthParams);
             }
           case sdkTypes.OAuthProviders.APPLE:
             {
-              return await handleAppleOauth({
-                openInPage,
-                ...(additionalState && {
-                  additionalState
-                }),
-                ...(!openInPage && {
-                  onOauthSuccess
-                })
-              });
+              return await handleAppleOauth(sharedOauthParams);
             }
           case sdkTypes.OAuthProviders.FACEBOOK:
             {
-              return await handleFacebookOauth({
-                openInPage,
-                ...(additionalState && {
-                  additionalState
-                }),
-                ...(!openInPage && {
-                  onOauthSuccess
-                })
-              });
+              return await handleFacebookOauth(sharedOauthParams);
             }
           default:
             {
@@ -3379,7 +3559,7 @@ const ClientProvider = ({
           const tx = {
             from,
             to,
-            caip2,
+            caip2: caip2,
             sponsor: sponsor ?? false,
             ...(value ? {
               value
@@ -3812,6 +3992,8 @@ const ClientProvider = ({
       config: masterConfig,
       httpClient: client?.httpClient,
       createHttpClient,
+      overrideApiKeyStamper,
+      overridePasskeyStamper,
       createPasskey,
       logout,
       loginWithPasskey,
@@ -3874,6 +4056,8 @@ const ClientProvider = ({
       clearUnusedKeyPairs,
       getActiveSessionKey,
       createApiKeyPair,
+      deleteApiKeyPair,
+      signWithApiKey,
       getProxyAuthConfig,
       fetchBootProofForAppProof,
       verifyAppProofs,