@turnkey/react-wallet-kit 1.7.2 → 1.8.0

package/dist/providers/client/Provider.js

@@ -4,6 +4,7 @@
 var jsxRuntime = require('react/jsx-runtime');
 var sha2 = require('@noble/hashes/sha2');
 var utils$1 = require('@noble/hashes/utils');
+var oauth = require('../../utils/oauth.js');
 var utils = require('../../utils/utils.js');
 var timers = require('../../utils/timers.js');
 var core = require('@turnkey/core');
@@ -13,7 +14,6 @@ var Hook = require('../modal/Hook.js');
 var base = require('../../types/base.js');
 var index = require('../../components/auth/index.js');
 var reactFontawesome = require('@fortawesome/react-fontawesome');
-var freeBrandsSvgIcons = require('@fortawesome/free-brands-svg-icons');
 var Action = require('../../components/auth/Action.js');
 var Message = require('../../components/sign/Message.js');
 var Export = require('../../components/export/Export.js');
@@ -45,7 +45,7 @@ var helpers = require('../../components/send-transaction/helpers.js');
  * wallet management, and user profile operations, as well as UI handlers for modal-driven flows.
  *
  * Features:
- * - Passkey, Wallet, OTP (Email/SMS), and OAuth (Google, Apple, Facebook) authentication and sign-up flows.
+ * - Passkey, Wallet, OTP (Email/SMS), and OAuth (Google, Apple, Facebook, X, Discord) authentication and sign-up flows.
  * - Session management: creation, expiration scheduling, refresh, and clearing.
  * - Wallet management: fetch, connect, import, export, account management.
  * - User profile management: email, phone, name, OAuth provider, and passkey linking/removal.
@@ -85,277 +85,280 @@ const ClientProvider = ({
   const {
     isMobile,
     pushPage,
+    popPage,
     closeModal
   } = Hook.useModal();
   const completeRedirectOauth = async () => {
     // Check for either hash or search parameters that could indicate an OAuth redirect
-    if (window.location.hash || window.location.search) {
-      // Handle Facebook redirect (uses search params with code)
-      if (window.location.search && window.location.search.includes("code=") && window.location.search.includes("state=")) {
-        const searchParams = new URLSearchParams(window.location.search.substring(1));
-        const code = searchParams.get("code");
-        const state = searchParams.get("state");
-        // Parse state parameter
-        if (state && code) {
-          const stateParams = new URLSearchParams(state);
-          const provider = stateParams.get("provider");
-          const flow = stateParams.get("flow");
-          const publicKey = stateParams.get("publicKey");
-          const openModal = stateParams.get("openModal");
-          const sessionKey = stateParams.get("sessionKey");
-          if (provider === "facebook" && flow === "redirect" && publicKey) {
-            // We have all the required parameters for a Facebook PKCE flow
-            const clientId = masterConfig?.auth?.oauthConfig?.facebookClientId;
-            const redirectURI = masterConfig?.auth?.oauthConfig?.oauthRedirectUri;
-            if (clientId && redirectURI) {
-              await utils.handleFacebookPKCEFlow({
-                code,
-                publicKey,
-                openModal,
-                clientId,
-                redirectURI,
-                callbacks,
-                completeOauth,
-                onPushPage: oidcToken => {
-                  return new Promise((resolve, reject) => {
+    if (!window.location.hash && !window.location.search) {
+      // No OAuth redirect parameters found, nothing to do
+      return;
+    }
+    /**
+     * Wraps an OAuth completion action with optional modal UI.
+     * This is the key difference between redirect and popup flows:
+     * - Popup: No modal needed (the popup window itself is the UI)
+     * - Redirect: Optional modal to show loading/success states on return
+     */
+    const withModalWrapper = async params => {
+      const {
+        provider,
+        isAddProvider,
+        metadata,
+        openModal,
+        action
+      } = params;
+      const providerDisplayName = oauth.capitalizeProviderName(provider);
+      const icon = oauth.getProviderIcon(provider);
+      if (openModal === "true") {
+        // Show modal UI for the completion
+        await new Promise((resolve, reject) => {
+          pushPage({
+            key: `${providerDisplayName} OAuth`,
+            content: jsxRuntime.jsx(Action.ActionPage, {
+              closeOnComplete: isAddProvider ? false : true,
+              title: isAddProvider ? `Adding ${providerDisplayName} provider...` : `Authenticating with ${providerDisplayName}...`,
+              action: async () => {
+                try {
+                  await action();
+                  if (isAddProvider && metadata) {
+                    // Don't show success for auth. Not needed
                     pushPage({
-                      key: `Facebook OAuth`,
-                      content: jsxRuntime.jsx(Action.ActionPage, {
-                        title: `Authenticating with Facebook...`,
-                        action: async () => {
-                          try {
-                            await completeOauth({
-                              oidcToken,
-                              publicKey,
-                              providerName: "facebook",
-                              ...(sessionKey && {
-                                sessionKey
-                              })
-                            });
-                            // Clean up the URL after processing
-                            window.history.replaceState(null, document.title, window.location.pathname);
-                            resolve();
-                          } catch (err) {
-                            reject(err);
-                          }
-                        },
-                        icon: jsxRuntime.jsx(reactFontawesome.FontAwesomeIcon, {
-                          size: "3x",
-                          icon: freeBrandsSvgIcons.faFacebook
-                        })
+                      key: "OAuth Provider Added",
+                      content: jsxRuntime.jsx(Success.SuccessPage, {
+                        text: `Successfully added ${providerDisplayName} OAuth provider!`,
+                        duration: metadata.successPageDuration ?? 2000,
+                        onComplete: () => {
+                          closeModal();
+                        }
                       }),
-                      showTitle: false,
-                      onClose: () => {
-                        reject(new sdkTypes.TurnkeyError("User canceled the Facebook authentication process.", sdkTypes.TurnkeyErrorCodes.USER_CANCELED));
-                      }
+                      preventBack: true,
+                      showTitle: false
                     });
-                  });
-                }
-              }).catch(error => {
-                // Handle errors
-                if (callbacks?.onError) {
-                  callbacks.onError(error instanceof sdkTypes.TurnkeyError ? error : new sdkTypes.TurnkeyError("Facebook authentication failed", sdkTypes.TurnkeyErrorCodes.OAUTH_SIGNUP_ERROR, error));
+                  }
+                  resolve();
+                } catch (err) {
+                  if (isAddProvider) {
+                    oauth.clearOAuthAddProviderMetadata();
+                  }
+                  reject(err);
+                  popPage();
                 }
-              });
+              },
+              icon: jsxRuntime.jsx(reactFontawesome.FontAwesomeIcon, {
+                icon: icon,
+                size: "3x"
+              })
+            }),
+            showTitle: false,
+            onClose: () => {
+              if (isAddProvider) {
+                oauth.clearOAuthAddProviderMetadata();
+              }
+              reject(new sdkTypes.TurnkeyError(isAddProvider ? `User canceled the ${providerDisplayName} add provider process.` : `User canceled the ${providerDisplayName} authentication process.`, sdkTypes.TurnkeyErrorCodes.USER_CANCELED));
             }
+          });
+        });
+      } else {
+        // No modal - execute directly
+        try {
+          await action();
+        } catch (err) {
+          if (isAddProvider) {
+            oauth.clearOAuthAddProviderMetadata();
           }
-          if (provider === "discord" && flow === "redirect" && publicKey) {
-            const clientId = masterConfig?.auth?.oauthConfig?.discordClientId;
-            const redirectURI = masterConfig?.auth?.oauthConfig?.oauthRedirectUri;
-            const verifier = sessionStorage.getItem("discord_verifier");
-            const nonce = stateParams.get("nonce");
-            const sessionKey = stateParams.get("sessionKey");
-            if (clientId && redirectURI && verifier && nonce) {
-              await new Promise((resolve, reject) => {
-                pushPage({
-                  key: `Discord OAuth`,
-                  content: jsxRuntime.jsx(Action.ActionPage, {
-                    title: `Authenticating with Discord...`,
-                    action: async () => {
-                      try {
-                        const resp = await client?.httpClient.proxyOAuth2Authenticate({
-                          provider: "OAUTH2_PROVIDER_DISCORD",
-                          authCode: code,
-                          redirectUri: redirectURI,
-                          codeVerifier: verifier,
-                          clientId,
-                          nonce: nonce
-                        });
-                        sessionStorage.removeItem("discord_verifier");
-                        const oidcToken = resp?.oidcToken;
-                        if (!oidcToken) {
-                          throw new sdkTypes.TurnkeyError("Missing OIDC token", sdkTypes.TurnkeyErrorCodes.OAUTH_LOGIN_ERROR);
-                        }
-                        await completeOauth({
-                          oidcToken,
-                          publicKey,
-                          providerName: "discord",
-                          ...(sessionKey && {
-                            sessionKey
-                          })
-                        });
-                        // Clean up the URL after processing
-                        window.history.replaceState(null, document.title, window.location.pathname);
-                        resolve(null);
-                      } catch (err) {
-                        reject(err);
-                        if (callbacks?.onError) {
-                          callbacks.onError(err instanceof sdkTypes.TurnkeyError ? err : new sdkTypes.TurnkeyError("Discord authentication failed", sdkTypes.TurnkeyErrorCodes.OAUTH_SIGNUP_ERROR, err));
-                        }
-                      }
-                    },
-                    icon: jsxRuntime.jsx(reactFontawesome.FontAwesomeIcon, {
-                      size: "3x",
-                      icon: freeBrandsSvgIcons.faDiscord
-                    })
-                  }),
-                  showTitle: false,
-                  onClose: () => {
-                    reject(new sdkTypes.TurnkeyError("User canceled the Discord authentication process.", sdkTypes.TurnkeyErrorCodes.USER_CANCELED));
-                  }
+          throw err;
+        }
+      }
+    };
+    // Handle PKCE-based OAuth redirects (Facebook, Discord, X) with code in search parameters
+    if (window.location.search && window.location.search.includes("code=") && window.location.search.includes("state=")) {
+      // Parse the URL using our unified helper
+      const result = oauth.parseOAuthResponse(window.location.href);
+      if (!result || !result.authCode || !result.publicKey) {
+        return;
+      }
+      if (result.flow !== "redirect") {
+        // To complete OAuth we need redirect flow
+        return;
+      }
+      const {
+        authCode: code,
+        provider,
+        publicKey,
+        oauthIntent,
+        sessionKey,
+        nonce,
+        openModal
+      } = result;
+      const isAddProvider = oauthIntent === oauth.OAUTH_INTENT_ADD_PROVIDER;
+      const metadata = isAddProvider ? oauth.getOAuthAddProviderMetadata() : null;
+      /**
+       * Helper to complete PKCE redirect flow with optional modal wrapper.
+       * Uses handlePKCEFlow from oauth utils for the core logic.
+       * We put this in a separate function to avoid duplicating for each provider.
+       */
+      const completePKCERedirect = async (providerName, exchangeCodeFn) => {
+        const action = async () => {
+          try {
+            await oauth.handlePKCEFlow({
+              publicKey,
+              providerName,
+              sessionKey: sessionKey ?? undefined,
+              callbacks,
+              completeOauth,
+              onAddProvider:
+              // Only set onAddProvider if we are adding a provider and have metadata
+              isAddProvider && metadata ? async oidcToken => {
+                await addOauthProvider({
+                  providerName: provider,
+                  oidcToken,
+                  organizationId: metadata.organizationId,
+                  userId: metadata.userId,
+                  ...(metadata.stampWith && {
+                    stampWith: metadata.stampWith
+                  })
                 });
-              });
+                oauth.clearOAuthAddProviderMetadata();
+              } : undefined,
+              exchangeCodeForToken: exchangeCodeFn
+            });
+          } catch (err) {
+            if (callbacks?.onError) {
+              const providerDisplayName = oauth.capitalizeProviderName(providerName);
+              callbacks.onError(err instanceof sdkTypes.TurnkeyError ? err : new sdkTypes.TurnkeyError(`${providerDisplayName} authentication failed`, sdkTypes.TurnkeyErrorCodes.OAUTH_SIGNUP_ERROR, err));
             }
+            throw err;
           }
-          if (provider === "twitter" && flow === "redirect" && publicKey) {
-            const clientId = masterConfig?.auth?.oauthConfig?.xClientId;
-            const redirectURI = masterConfig?.auth?.oauthConfig?.oauthRedirectUri;
-            const verifier = sessionStorage.getItem("twitter_verifier");
-            const nonce = stateParams.get("nonce");
-            const sessionKey = stateParams.get("sessionKey");
-            if (clientId && redirectURI && verifier && nonce) {
-              await new Promise((resolve, reject) => {
-                pushPage({
-                  key: `Twitter OAuth`,
-                  content: jsxRuntime.jsx(Action.ActionPage, {
-                    title: `Authenticating with Twitter...`,
-                    action: async () => {
-                      try {
-                        const resp = await client?.httpClient.proxyOAuth2Authenticate({
-                          provider: "OAUTH2_PROVIDER_X",
-                          authCode: code,
-                          redirectUri: redirectURI,
-                          codeVerifier: verifier,
-                          clientId,
-                          nonce: nonce
-                        });
-                        sessionStorage.removeItem("twitter_verifier");
-                        const oidcToken = resp?.oidcToken;
-                        if (!oidcToken) {
-                          throw new sdkTypes.TurnkeyError("Missing OIDC token", sdkTypes.TurnkeyErrorCodes.OAUTH_LOGIN_ERROR);
-                        }
-                        await completeOauth({
-                          oidcToken,
-                          publicKey,
-                          providerName: "twitter",
-                          ...(sessionKey && {
-                            sessionKey
-                          })
-                        });
-                        // Clean up the URL after processing
-                        window.history.replaceState(null, document.title, window.location.pathname);
-                        resolve(null);
-                      } catch (err) {
-                        reject(err);
-                        if (callbacks?.onError) {
-                          callbacks.onError(err instanceof sdkTypes.TurnkeyError ? err : new sdkTypes.TurnkeyError("Twitter authentication failed", sdkTypes.TurnkeyErrorCodes.OAUTH_SIGNUP_ERROR, err));
-                        }
-                      }
-                    },
-                    icon: jsxRuntime.jsx(reactFontawesome.FontAwesomeIcon, {
-                      size: "3x",
-                      icon: freeBrandsSvgIcons.faXTwitter
-                    })
-                  }),
-                  showTitle: false,
-                  onClose: () => {
-                    reject(new sdkTypes.TurnkeyError("User canceled the Twitter authentication process.", sdkTypes.TurnkeyErrorCodes.USER_CANCELED));
-                  }
-                });
-              });
+        };
+        await withModalWrapper({
+          provider: providerName,
+          isAddProvider,
+          metadata,
+          openModal,
+          action
+        });
+        // Clean up URL after successful completion
+        oauth.cleanupOAuthUrl();
+      };
+      // FACEBOOK
+      if (provider === sdkTypes.OAuthProviders.FACEBOOK) {
+        const clientId = masterConfig?.auth?.oauthConfig?.facebookClientId;
+        const redirectURI = masterConfig?.auth?.oauthConfig?.oauthRedirectUri;
+        const hasVerifier = oauth.hasPKCEVerifier(sdkTypes.OAuthProviders.FACEBOOK);
+        if (clientId && redirectURI && hasVerifier) {
+          await completePKCERedirect(sdkTypes.OAuthProviders.FACEBOOK, async codeVerifier => {
+            const tokenResponse = await oauth.exchangeFacebookCodeForToken(clientId, redirectURI, code, codeVerifier);
+            const oidcToken = tokenResponse?.id_token;
+            if (!oidcToken) {
+              throw new sdkTypes.TurnkeyError("Missing OIDC token", sdkTypes.TurnkeyErrorCodes.OAUTH_LOGIN_ERROR);
             }
-          }
+            return oidcToken;
+          });
         }
+        return;
       }
-      // Handle Google/Apple redirects (uses hash with id_token)
-      else if (window.location.hash) {
-        const hash = window.location.hash.substring(1);
-        // Parse the hash using our helper functions
-        const {
-          idToken,
-          provider,
-          flow,
-          publicKey,
-          openModal,
-          sessionKey
-        } = utils.parseOAuthRedirect(hash);
-        if (idToken && flow === "redirect" && publicKey) {
-          if (openModal === "true") {
-            const providerName = provider ? provider.charAt(0).toUpperCase() + provider.slice(1) : "Provider";
-            // Determine which icon to show based on the provider
-            let icon;
-            if (provider === "apple") {
-              icon = jsxRuntime.jsx(reactFontawesome.FontAwesomeIcon, {
-                size: "3x",
-                icon: freeBrandsSvgIcons.faApple
-              });
-            } else {
-              // Default to Google icon
-              icon = jsxRuntime.jsx(reactFontawesome.FontAwesomeIcon, {
-                size: "3x",
-                icon: freeBrandsSvgIcons.faGoogle
-              });
-            }
-            // This state is set when the OAuth flow comes from the AuthComponent
-            await new Promise((resolve, reject) => {
-              pushPage({
-                key: `${providerName} OAuth`,
-                content: jsxRuntime.jsx(Action.ActionPage, {
-                  title: `Authenticating with ${providerName}...`,
-                  action: async () => {
-                    try {
-                      await completeOauth({
-                        oidcToken: idToken,
-                        publicKey,
-                        ...(provider ? {
-                          providerName: provider
-                        } : {}),
-                        ...(sessionKey && {
-                          sessionKey
-                        })
-                      });
-                      resolve(null);
-                    } catch (err) {
-                      reject(err);
-                    }
-                  },
-                  icon: icon
-                }),
-                showTitle: false,
-                onClose: () => {
-                  reject(new sdkTypes.TurnkeyError(`User canceled the ${providerName} authentication process.`, sdkTypes.TurnkeyErrorCodes.USER_CANCELED));
-                }
-              });
-            });
-          } else if (callbacks?.onOauthRedirect) {
-            callbacks.onOauthRedirect({
-              idToken,
-              publicKey
+      // DISCORD
+      if (provider === sdkTypes.OAuthProviders.DISCORD) {
+        const clientId = masterConfig?.auth?.oauthConfig?.discordClientId;
+        const redirectURI = masterConfig?.auth?.oauthConfig?.oauthRedirectUri;
+        const hasVerifier = oauth.hasPKCEVerifier(sdkTypes.OAuthProviders.DISCORD);
+        if (clientId && redirectURI && hasVerifier && nonce) {
+          await completePKCERedirect(sdkTypes.OAuthProviders.DISCORD, async codeVerifier => {
+            const resp = await client?.httpClient.proxyOAuth2Authenticate({
+              provider: "OAUTH2_PROVIDER_DISCORD",
+              authCode: code,
+              redirectUri: redirectURI,
+              codeVerifier,
+              clientId,
+              nonce
             });
-          } else {
-            completeOauth({
-              oidcToken: idToken,
-              publicKey,
-              ...(provider ? {
-                providerName: provider
-              } : {})
+            const oidcToken = resp?.oidcToken;
+            if (!oidcToken) {
+              throw new sdkTypes.TurnkeyError("Missing OIDC token", sdkTypes.TurnkeyErrorCodes.OAUTH_LOGIN_ERROR);
+            }
+            return oidcToken;
+          });
+        }
+        return;
+      }
+      // X (Twitter)
+      if (provider === sdkTypes.OAuthProviders.X) {
+        const clientId = masterConfig?.auth?.oauthConfig?.xClientId;
+        const redirectURI = masterConfig?.auth?.oauthConfig?.oauthRedirectUri;
+        const hasVerifier = oauth.hasPKCEVerifier(sdkTypes.OAuthProviders.X);
+        if (clientId && redirectURI && hasVerifier && nonce) {
+          await completePKCERedirect(sdkTypes.OAuthProviders.X, async codeVerifier => {
+            const resp = await client?.httpClient.proxyOAuth2Authenticate({
+              provider: "OAUTH2_PROVIDER_X",
+              authCode: code,
+              redirectUri: redirectURI,
+              codeVerifier,
+              clientId,
+              nonce
             });
-          }
-          // Clean up the URL after processing
-          window.history.replaceState(null, document.title, window.location.pathname + window.location.search);
+            const oidcToken = resp?.oidcToken;
+            if (!oidcToken) {
+              throw new sdkTypes.TurnkeyError("Missing OIDC token", sdkTypes.TurnkeyErrorCodes.OAUTH_LOGIN_ERROR);
+            }
+            return oidcToken;
+          });
         }
+        return;
       }
     }
+    // Handle Google/Apple redirects (uses hash with idToken - non-PKCE)
+    if (window.location.hash) {
+      // Parse the URL using our unified helper
+      const result = oauth.parseOAuthResponse(window.location.href);
+      if (!result || !result.idToken || result.flow !== "redirect" || !result.publicKey) {
+        // idToken and publicKey are required to complete OAuth. These are both in the hash for non-PKCE providers
+        return;
+      }
+      const {
+        idToken,
+        provider,
+        publicKey,
+        openModal,
+        sessionKey,
+        oauthIntent
+      } = result;
+      const isAddProvider = oauthIntent === oauth.OAUTH_INTENT_ADD_PROVIDER;
+      const metadata = isAddProvider ? oauth.getOAuthAddProviderMetadata() : null;
+      const resolvedProvider = provider || sdkTypes.OAuthProviders.GOOGLE;
+      // Use completeOAuthFlow from utils for the core completion logic
+      const action = async () => {
+        await oauth.completeOAuthFlow({
+          provider: resolvedProvider,
+          publicKey,
+          oidcToken: idToken,
+          sessionKey: sessionKey ?? undefined,
+          callbacks,
+          completeOauth,
+          onAddProvider: isAddProvider && metadata ? async oidcToken => {
+            await addOauthProvider({
+              providerName: resolvedProvider,
+              oidcToken,
+              organizationId: metadata.organizationId,
+              userId: metadata.userId,
+              ...(metadata.stampWith && {
+                stampWith: metadata.stampWith
+              })
+            });
+            oauth.clearOAuthAddProviderMetadata();
+          } : undefined
+        });
+      };
+      await withModalWrapper({
+        provider: resolvedProvider,
+        isAddProvider,
+        metadata,
+        openModal: openModal ?? undefined,
+        action
+      });
+      // Clean up the URL after processing
+      oauth.cleanupOAuthUrlPreserveSearch();
+    }
   };
   const buildConfig = proxyAuthConfig => {
     // Juggle the local overrides with the values set in the dashboard (proxyAuthConfig).
@@ -1767,139 +1770,94 @@ const ClientProvider = ({
       openInPage = masterConfig?.auth?.oauthConfig?.openOauthInPage ?? false,
       additionalState: additionalParameters
     } = params || {};
-    try {
-      if (!masterConfig) {
-        throw new sdkTypes.TurnkeyError("Config is not ready yet!", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
-      }
-      if (!clientId) {
-        throw new sdkTypes.TurnkeyError("Discord Client ID is not configured.", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
-      }
-      if (!masterConfig.auth?.oauthConfig?.oauthRedirectUri) {
-        throw new sdkTypes.TurnkeyError("OAuth Redirect URI is not configured.", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
-      }
-      const flow = openInPage ? "redirect" : "popup";
-      const redirectURI = masterConfig.auth?.oauthConfig.oauthRedirectUri;
-      // Create key pair and generate nonce
-      const publicKey = await createApiKeyPair();
-      if (!publicKey) {
-        throw new Error("Failed to create public key for OAuth.");
-      }
-      const nonce = utils$1.bytesToHex(sha2.sha256(publicKey));
-      // Generate PKCE challenge pair
-      const {
-        verifier,
-        codeChallenge
-      } = await utils.generateChallengePair();
-      sessionStorage.setItem("discord_verifier", verifier);
-      // Construct Discord Auth URL
-      const discordAuthUrl = new URL(utils.DISCORD_AUTH_URL);
-      discordAuthUrl.searchParams.set("client_id", clientId);
-      discordAuthUrl.searchParams.set("redirect_uri", redirectURI);
-      discordAuthUrl.searchParams.set("response_type", "code");
-      discordAuthUrl.searchParams.set("code_challenge", codeChallenge);
-      discordAuthUrl.searchParams.set("code_challenge_method", "S256");
-      discordAuthUrl.searchParams.set("scope", "identify email");
-      discordAuthUrl.searchParams.set("state", `provider=discord&flow=${flow}&publicKey=${encodeURIComponent(publicKey)}&nonce=${nonce}`);
-      if (additionalParameters) {
-        const extra = Object.entries(additionalParameters).map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`).join("&");
-        if (extra) {
-          discordAuthUrl.searchParams.set("state", discordAuthUrl.searchParams.get("state") + `&${extra}`);
-        }
-      }
-      if (openInPage) {
-        window.location.href = discordAuthUrl.toString();
-        return new Promise((_, reject) => {
-          const timeout = setTimeout(() => {
-            reject(new Error("Authentication timed out."));
-          }, 300000);
-          window.addEventListener("beforeunload", () => clearTimeout(timeout));
-        });
-      } else {
-        const width = utils.popupWidth;
-        const height = utils.popupHeight;
-        const left = window.screenX + (window.innerWidth - width) / 2;
-        const top = window.screenY + (window.innerHeight - height) / 2;
-        const authWindow = window.open("about:blank", "_blank", `width=${width},height=${height},top=${top},left=${left},scrollbars=yes,resizable=yes`);
-        if (!authWindow) {
-          throw new Error("Failed to open Discord login window.");
-        }
-        authWindow.location.href = discordAuthUrl.toString();
-        return new Promise((resolve, reject) => {
-          const interval = setInterval(() => {
-            try {
-              if (authWindow.closed) {
-                clearInterval(interval);
-                reject(new Error("Authentication window was closed."));
-                return;
-              }
-              const url = authWindow.location.href || "";
-              if (url.startsWith(window.location.origin)) {
-                const urlParams = new URLSearchParams(new URL(url).search);
-                const authCode = urlParams.get("code");
-                const stateParam = urlParams.get("state");
-                const sessionKey = stateParam?.split("&").find(param => param.startsWith("sessionKey="))?.split("=")[1];
-                if (authCode && stateParam && stateParam.includes("provider=discord")) {
-                  authWindow.close();
-                  clearInterval(interval);
-                  const verifier = sessionStorage.getItem("discord_verifier");
-                  if (!verifier) {
-                    reject(new Error("Missing PKCE verifier"));
-                    return;
-                  }
-                  client?.httpClient.proxyOAuth2Authenticate({
+    const provider = sdkTypes.OAuthProviders.DISCORD;
+    if (!masterConfig) {
+      throw new sdkTypes.TurnkeyError("Config is not ready yet!", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
+    }
+    if (!clientId) {
+      throw new sdkTypes.TurnkeyError("Discord Client ID is not configured.", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
+    }
+    if (!masterConfig.auth?.oauthConfig?.oauthRedirectUri) {
+      throw new sdkTypes.TurnkeyError("OAuth Redirect URI is not configured.", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
+    }
+    const flow = openInPage ? "redirect" : "popup";
+    const redirectUri = masterConfig.auth?.oauthConfig.oauthRedirectUri;
+    // Create key pair and generate nonce
+    const publicKey = await createApiKeyPair();
+    if (!publicKey) {
+      throw new Error("Failed to create public key for OAuth.");
+    }
+    const nonce = utils$1.bytesToHex(sha2.sha256(publicKey));
+    // Generate PKCE challenge pair and store verifier
+    const {
+      verifier,
+      codeChallenge
+    } = await oauth.generateChallengePair();
+    oauth.storePKCEVerifier(provider, verifier);
+    // Build OAuth URL
+    const authUrl = oauth.buildOAuthUrl({
+      provider,
+      clientId,
+      redirectUri,
+      publicKey,
+      nonce,
+      flow,
+      codeChallenge,
+      additionalState: additionalParameters
+    });
+    if (openInPage) {
+      // Remainder of logic will occur in completeRedirectOauth
+      return oauth.redirectToOAuthProvider(authUrl);
+    }
+    // Popup flow
+    const authWindow = oauth.openOAuthPopup();
+    if (!authWindow) {
+      throw new Error(`Failed to open ${oauth.capitalizeProviderName(provider)} login window.`);
+    }
+    authWindow.location.href = authUrl;
+    return new Promise((resolve, reject) => {
+      const interval = setInterval(() => {
+        try {
+          if (authWindow.closed) {
+            clearInterval(interval);
+            reject(new Error("Authentication window was closed."));
+            return;
+          }
+          const url = authWindow.location.href || "";
+          if (url.startsWith(window.location.origin)) {
+            const result = oauth.parseOAuthResponse(url, provider);
+            if (result) {
+              authWindow.close();
+              clearInterval(interval);
+              oauth.completeOAuthPopup({
+                provider,
+                publicKey,
+                result,
+                callbacks,
+                completeOauth,
+                onOauthSuccess: params?.onOauthSuccess,
+                exchangeCodeForToken: async codeVerifier => {
+                  const resp = await client?.httpClient.proxyOAuth2Authenticate({
                     provider: "OAUTH2_PROVIDER_DISCORD",
-                    authCode,
-                    redirectUri: redirectURI,
-                    codeVerifier: verifier,
+                    authCode: result.authCode,
+                    redirectUri,
+                    codeVerifier,
                     clientId,
-                    nonce: nonce
-                  }).then(resp => {
-                    sessionStorage.removeItem("discord_verifier");
-                    const oidcToken = resp.oidcToken;
-                    if (params?.onOauthSuccess) {
-                      params.onOauthSuccess({
-                        publicKey,
-                        oidcToken,
-                        providerName: "discord",
-                        ...(sessionKey && {
-                          sessionKey
-                        })
-                      });
-                    } else if (callbacks?.onOauthRedirect) {
-                      callbacks.onOauthRedirect({
-                        idToken: oidcToken,
-                        publicKey,
-                        ...(sessionKey && {
-                          sessionKey
-                        })
-                      });
-                    } else {
-                      completeOauth({
-                        oidcToken,
-                        publicKey,
-                        providerName: "discord",
-                        ...(sessionKey && {
-                          sessionKey
-                        })
-                      }).then(() => resolve()).catch(reject);
-                      return;
-                    }
-                    resolve();
-                  }).catch(reject);
+                    nonce
+                  });
+                  return resp?.oidcToken ?? "";
                 }
-              }
-            } catch {
-              // ignore cross-origin
+              }).then(() => resolve()).catch(reject);
             }
-          }, 500);
-          if (authWindow.closed) {
-            clearInterval(interval);
           }
-        });
+        } catch {
+          // ignore cross-origin
+        }
+      }, 500);
+      if (authWindow.closed) {
+        clearInterval(interval);
       }
-    } catch (error) {
-      throw error;
-    }
+    });
   }, [client, callbacks, completeOauth, createApiKeyPair, masterConfig]);
   const handleXOauth = react.useCallback(async params => {
     const {
@@ -1907,139 +1865,94 @@ const ClientProvider = ({
       openInPage = masterConfig?.auth?.oauthConfig?.openOauthInPage ?? false,
       additionalState: additionalParameters
     } = params || {};
-    try {
-      if (!masterConfig) {
-        throw new sdkTypes.TurnkeyError("Config is not ready yet!", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
-      }
-      if (!clientId) {
-        throw new sdkTypes.TurnkeyError("Twitter Client ID is not configured.", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
-      }
-      if (!masterConfig.auth?.oauthConfig?.oauthRedirectUri) {
-        throw new sdkTypes.TurnkeyError("OAuth Redirect URI is not configured.", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
-      }
-      const flow = openInPage ? "redirect" : "popup";
-      const redirectURI = masterConfig.auth?.oauthConfig.oauthRedirectUri;
-      // Create key pair and generate nonce
-      const publicKey = await createApiKeyPair();
-      if (!publicKey) {
-        throw new Error("Failed to create public key for OAuth.");
-      }
-      const nonce = utils$1.bytesToHex(sha2.sha256(publicKey));
-      // Generate PKCE challenge pair
-      const {
-        verifier,
-        codeChallenge
-      } = await utils.generateChallengePair();
-      sessionStorage.setItem("twitter_verifier", verifier);
-      // Construct Twitter Auth URL
-      const twitterAuthUrl = new URL(utils.X_AUTH_URL);
-      twitterAuthUrl.searchParams.set("client_id", clientId);
-      twitterAuthUrl.searchParams.set("redirect_uri", redirectURI);
-      twitterAuthUrl.searchParams.set("response_type", "code");
-      twitterAuthUrl.searchParams.set("code_challenge", codeChallenge);
-      twitterAuthUrl.searchParams.set("code_challenge_method", "S256");
-      twitterAuthUrl.searchParams.set("scope", "tweet.read users.read");
-      twitterAuthUrl.searchParams.set("state", `provider=twitter&flow=${flow}&publicKey=${encodeURIComponent(publicKey)}&nonce=${nonce}`);
-      if (additionalParameters) {
-        const extra = Object.entries(additionalParameters).map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`).join("&");
-        if (extra) {
-          twitterAuthUrl.searchParams.set("state", twitterAuthUrl.searchParams.get("state") + `&${extra}`);
-        }
-      }
-      if (openInPage) {
-        window.location.href = twitterAuthUrl.toString();
-        return new Promise((_, reject) => {
-          const timeout = setTimeout(() => {
-            reject(new Error("Authentication timed out."));
-          }, 300000);
-          window.addEventListener("beforeunload", () => clearTimeout(timeout));
-        });
-      } else {
-        const width = utils.popupWidth;
-        const height = utils.popupHeight;
-        const left = window.screenX + (window.innerWidth - width) / 2;
-        const top = window.screenY + (window.innerHeight - height) / 2;
-        const authWindow = window.open("about:blank", "_blank", `width=${width},height=${height},top=${top},left=${left},scrollbars=yes,resizable=yes`);
-        if (!authWindow) {
-          throw new Error("Failed to open Twitter login window.");
-        }
-        authWindow.location.href = twitterAuthUrl.toString();
-        return new Promise((resolve, reject) => {
-          const interval = setInterval(() => {
-            try {
-              if (authWindow.closed) {
-                clearInterval(interval);
-                reject(new Error("Authentication window was closed."));
-                return;
-              }
-              const url = authWindow.location.href || "";
-              if (url.startsWith(window.location.origin)) {
-                const urlParams = new URLSearchParams(new URL(url).search);
-                const authCode = urlParams.get("code");
-                const stateParam = urlParams.get("state");
-                const sessionKey = stateParam?.split("&").find(param => param.startsWith("sessionKey="))?.split("=")[1];
-                if (authCode && stateParam && stateParam.includes("provider=twitter")) {
-                  authWindow.close();
-                  clearInterval(interval);
-                  const verifier = sessionStorage.getItem("twitter_verifier");
-                  if (!verifier) {
-                    reject(new Error("Missing PKCE verifier"));
-                    return;
-                  }
-                  client?.httpClient.proxyOAuth2Authenticate({
+    const provider = sdkTypes.OAuthProviders.X;
+    if (!masterConfig) {
+      throw new sdkTypes.TurnkeyError("Config is not ready yet!", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
+    }
+    if (!clientId) {
+      throw new sdkTypes.TurnkeyError("Twitter Client ID is not configured.", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
+    }
+    if (!masterConfig.auth?.oauthConfig?.oauthRedirectUri) {
+      throw new sdkTypes.TurnkeyError("OAuth Redirect URI is not configured.", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
+    }
+    const flow = openInPage ? "redirect" : "popup";
+    const redirectUri = masterConfig.auth?.oauthConfig.oauthRedirectUri;
+    // Create key pair and generate nonce
+    const publicKey = await createApiKeyPair();
+    if (!publicKey) {
+      throw new Error("Failed to create public key for OAuth.");
+    }
+    const nonce = utils$1.bytesToHex(sha2.sha256(publicKey));
+    // Generate PKCE challenge pair and store verifier
+    const {
+      verifier,
+      codeChallenge
+    } = await oauth.generateChallengePair();
+    oauth.storePKCEVerifier(provider, verifier);
+    // Build OAuth URL
+    const authUrl = oauth.buildOAuthUrl({
+      provider,
+      clientId,
+      redirectUri,
+      publicKey,
+      nonce,
+      flow,
+      codeChallenge,
+      additionalState: additionalParameters
+    });
+    if (openInPage) {
+      // Remainder of logic will occur in completeRedirectOauth
+      return oauth.redirectToOAuthProvider(authUrl);
+    }
+    // Popup flow
+    const authWindow = oauth.openOAuthPopup();
+    if (!authWindow) {
+      throw new Error(`Failed to open ${oauth.capitalizeProviderName(provider)} login window.`);
+    }
+    authWindow.location.href = authUrl;
+    return new Promise((resolve, reject) => {
+      const interval = setInterval(() => {
+        try {
+          if (authWindow.closed) {
+            clearInterval(interval);
+            reject(new Error("Authentication window was closed."));
+            return;
+          }
+          const url = authWindow.location.href || "";
+          if (url.startsWith(window.location.origin)) {
+            const result = oauth.parseOAuthResponse(url, provider);
+            if (result) {
+              authWindow.close();
+              clearInterval(interval);
+              oauth.completeOAuthPopup({
+                provider,
+                publicKey,
+                result,
+                callbacks,
+                completeOauth,
+                onOauthSuccess: params?.onOauthSuccess,
+                exchangeCodeForToken: async codeVerifier => {
+                  const resp = await client?.httpClient.proxyOAuth2Authenticate({
                     provider: "OAUTH2_PROVIDER_X",
-                    authCode,
-                    redirectUri: redirectURI,
-                    codeVerifier: verifier,
+                    authCode: result.authCode,
+                    redirectUri,
+                    codeVerifier,
                     clientId,
                     nonce
-                  }).then(resp => {
-                    sessionStorage.removeItem("twitter_verifier");
-                    const oidcToken = resp.oidcToken;
-                    if (params?.onOauthSuccess) {
-                      params.onOauthSuccess({
-                        publicKey,
-                        oidcToken,
-                        providerName: "twitter",
-                        ...(sessionKey && {
-                          sessionKey
-                        })
-                      });
-                    } else if (callbacks?.onOauthRedirect) {
-                      callbacks.onOauthRedirect({
-                        idToken: oidcToken,
-                        publicKey,
-                        ...(sessionKey && {
-                          sessionKey
-                        })
-                      });
-                    } else {
-                      completeOauth({
-                        oidcToken,
-                        publicKey,
-                        providerName: "twitter",
-                        ...(sessionKey && {
-                          sessionKey
-                        })
-                      }).then(() => resolve()).catch(reject);
-                      return;
-                    }
-                    resolve();
-                  }).catch(reject);
+                  });
+                  return resp?.oidcToken ?? "";
                 }
-              }
-            } catch {
-              // ignore cross-origin
+              }).then(() => resolve()).catch(reject);
             }
-          }, 500);
-          if (authWindow.closed) {
-            clearInterval(interval);
           }
-        });
+        } catch {
+          // ignore cross-origin
+        }
+      }, 500);
+      if (authWindow.closed) {
+        clearInterval(interval);
       }
-    } catch (error) {
-      throw error;
-    }
+    });
   }, [client, callbacks, completeOauth, createApiKeyPair, masterConfig]);
   const handleGoogleOauth = react.useCallback(async params => {
     const {
@@ -2047,128 +1960,77 @@ const ClientProvider = ({
       openInPage = masterConfig?.auth?.oauthConfig?.openOauthInPage ?? false,
       additionalState: additionalParameters
     } = params || {};
-    try {
-      if (!masterConfig) {
-        throw new sdkTypes.TurnkeyError("Config is not ready yet!", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
-      }
-      if (!clientId) {
-        throw new sdkTypes.TurnkeyError("Google Client ID is not configured.", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
-      }
-      if (!masterConfig.auth?.oauthConfig?.oauthRedirectUri) {
-        throw new sdkTypes.TurnkeyError("OAuth Redirect URI is not configured.", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
-      }
-      const flow = openInPage ? "redirect" : "popup";
-      const redirectURI = masterConfig.auth?.oauthConfig.oauthRedirectUri.replace(/\/$/, "");
-      // Create key pair and generate nonce
-      const publicKey = await createApiKeyPair();
-      if (!publicKey) {
-        throw new Error("Failed to create public key for OAuth.");
-      }
-      const nonce = utils$1.bytesToHex(sha2.sha256(publicKey));
-      // Construct Google Auth URL
-      const googleAuthUrl = new URL(utils.GOOGLE_AUTH_URL);
-      googleAuthUrl.searchParams.set("client_id", clientId);
-      googleAuthUrl.searchParams.set("redirect_uri", redirectURI);
-      googleAuthUrl.searchParams.set("response_type", "id_token");
-      googleAuthUrl.searchParams.set("scope", "openid email profile");
-      googleAuthUrl.searchParams.set("nonce", nonce);
-      googleAuthUrl.searchParams.set("prompt", "select_account");
-      // Create state parameter
-      let state = `provider=google&flow=${flow}&publicKey=${encodeURIComponent(publicKey)}`;
-      if (additionalParameters) {
-        const additionalState = Object.entries(additionalParameters).map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`).join("&");
-        if (additionalState) {
-          state += `&${additionalState}`;
-        }
-      }
-      googleAuthUrl.searchParams.set("state", state);
-      if (openInPage) {
-        // Redirect current page to Google Auth
-        window.location.href = googleAuthUrl.toString();
-        return new Promise((_, reject) => {
-          // By here, the page should have already redirected. We wait here since the function is async.
-          // We want any function that runs this to simply wait until the page redirects.
-          // A 5 min timeout is set just in case, idk
-          const timeout = setTimeout(() => {
-            reject(new Error("Authentication timed out."));
-          }, 300000); // 5 minutes
-          // If the page is unloaded (user navigates away), clear the timeout
-          window.addEventListener("beforeunload", () => clearTimeout(timeout));
-        });
-      } else {
-        // Open popup window
-        const width = utils.popupWidth;
-        const height = utils.popupHeight;
-        const left = window.screenX + (window.innerWidth - width) / 2;
-        const top = window.screenY + (window.innerHeight - height) / 2;
-        const authWindow = window.open("about:blank", "_blank", `width=${width},height=${height},top=${top},left=${left},scrollbars=yes,resizable=yes`);
-        if (!authWindow) {
-          throw new Error("Failed to open Google login window.");
-        }
-        authWindow.location.href = googleAuthUrl.toString();
-        // Return a promise that resolves when the OAuth flow completes
-        // This following code will only run for the popup flow
-        return new Promise((resolve, reject) => {
-          const interval = setInterval(() => {
-            try {
-              // Check if window was closed without completing auth
-              if (authWindow.closed) {
-                clearInterval(interval);
-                reject(new Error("Authentication window was closed."));
-                return;
-              }
-              const url = authWindow.location.href || "";
-              if (url.startsWith(window.location.origin)) {
-                const hashParams = new URLSearchParams(url.split("#")[1]);
-                const idToken = hashParams.get("id_token");
-                const stateParams = hashParams.get("state");
-                const sessionKey = stateParams?.split("&").find(param => param.startsWith("sessionKey="))?.split("=")[1];
-                if (idToken) {
-                  authWindow.close();
-                  clearInterval(interval);
-                  if (params?.onOauthSuccess) {
-                    params.onOauthSuccess({
-                      publicKey,
-                      oidcToken: idToken,
-                      providerName: "google",
-                      ...(sessionKey && {
-                        sessionKey
-                      })
-                    });
-                  } else if (callbacks?.onOauthRedirect) {
-                    callbacks.onOauthRedirect({
-                      idToken,
-                      publicKey,
-                      ...(sessionKey && {
-                        sessionKey
-                      })
-                    });
-                  } else {
-                    completeOauth({
-                      oidcToken: idToken,
-                      publicKey,
-                      providerName: "google",
-                      ...(sessionKey && {
-                        sessionKey
-                      })
-                    }).then(() => resolve()).catch(reject);
-                    return;
-                  }
-                  resolve();
-                }
-              }
-            } catch (error) {
-              // Ignore cross-origin errors
-            }
-          }, 500);
+    const provider = sdkTypes.OAuthProviders.GOOGLE;
+    if (!masterConfig) {
+      throw new sdkTypes.TurnkeyError("Config is not ready yet!", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
+    }
+    if (!clientId) {
+      throw new sdkTypes.TurnkeyError("Google Client ID is not configured.", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
+    }
+    if (!masterConfig.auth?.oauthConfig?.oauthRedirectUri) {
+      throw new sdkTypes.TurnkeyError("OAuth Redirect URI is not configured.", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
+    }
+    const flow = openInPage ? "redirect" : "popup";
+    // Google requires no trailing slash
+    const redirectUri = masterConfig.auth?.oauthConfig.oauthRedirectUri.replace(/\/$/, "");
+    // Create key pair and generate nonce
+    const publicKey = await createApiKeyPair();
+    if (!publicKey) {
+      throw new Error("Failed to create public key for OAuth.");
+    }
+    const nonce = utils$1.bytesToHex(sha2.sha256(publicKey));
+    // Build OAuth URL
+    const authUrl = oauth.buildOAuthUrl({
+      provider,
+      clientId,
+      redirectUri,
+      publicKey,
+      nonce,
+      flow,
+      additionalState: additionalParameters
+    });
+    if (openInPage) {
+      // Remainder of logic will occur in completeRedirectOauth
+      return oauth.redirectToOAuthProvider(authUrl);
+    }
+    // Popup flow
+    const authWindow = oauth.openOAuthPopup();
+    if (!authWindow) {
+      throw new Error(`Failed to open ${oauth.capitalizeProviderName(provider)} login window.`);
+    }
+    authWindow.location.href = authUrl;
+    return new Promise((resolve, reject) => {
+      const interval = setInterval(() => {
+        try {
           if (authWindow.closed) {
             clearInterval(interval);
+            reject(new Error("Authentication window was closed."));
+            return;
           }
-        });
+          const url = authWindow.location.href || "";
+          if (url.startsWith(window.location.origin)) {
+            const result = oauth.parseOAuthResponse(url, provider);
+            if (result) {
+              authWindow.close();
+              clearInterval(interval);
+              oauth.completeOAuthPopup({
+                provider,
+                publicKey,
+                result,
+                callbacks,
+                completeOauth,
+                onOauthSuccess: params?.onOauthSuccess
+              }).then(() => resolve()).catch(reject);
+            }
+          }
+        } catch {
+          // Ignore cross-origin errors
+        }
+      }, 500);
+      if (authWindow.closed) {
+        clearInterval(interval);
       }
-    } catch (error) {
-      throw error;
-    }
+    });
   }, [callbacks, completeOauth, createApiKeyPair, masterConfig]);
   const handleAppleOauth = react.useCallback(async params => {
     const {
@@ -2176,124 +2038,77 @@ const ClientProvider = ({
       openInPage = masterConfig?.auth?.oauthConfig?.openOauthInPage ?? false,
       additionalState: additionalParameters
     } = params || {};
-    try {
-      if (!masterConfig) {
-        throw new sdkTypes.TurnkeyError("Config is not ready yet!", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
-      }
-      if (!clientId) {
-        throw new sdkTypes.TurnkeyError("Apple Client ID is not configured.", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
-      }
-      if (!masterConfig.auth?.oauthConfig?.oauthRedirectUri) {
-        throw new sdkTypes.TurnkeyError("OAuth Redirect URI is not configured.", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
-      }
-      const flow = openInPage ? "redirect" : "popup";
-      const redirectURI = masterConfig.auth?.oauthConfig.oauthRedirectUri; // TODO (Amir): Apple needs the '/' at the end. Maybe we should add it if not there?
-      // Create key pair and generate nonce
-      const publicKey = await createApiKeyPair();
-      if (!publicKey) {
-        throw new Error("Failed to create public key for OAuth.");
-      }
-      const nonce = utils$1.bytesToHex(sha2.sha256(publicKey));
-      // Construct Apple Auth URL
-      const appleAuthUrl = new URL(utils.APPLE_AUTH_URL);
-      appleAuthUrl.searchParams.set("client_id", clientId);
-      appleAuthUrl.searchParams.set("redirect_uri", redirectURI);
-      appleAuthUrl.searchParams.set("response_type", "code id_token");
-      appleAuthUrl.searchParams.set("response_mode", "fragment");
-      appleAuthUrl.searchParams.set("nonce", nonce);
-      // Create state parameter
-      let state = `provider=apple&flow=${flow}&publicKey=${encodeURIComponent(publicKey)}`;
-      if (additionalParameters) {
-        const additionalState = Object.entries(additionalParameters).map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`).join("&");
-        if (additionalState) {
-          state += `&${additionalState}`;
-        }
-      }
-      appleAuthUrl.searchParams.set("state", state);
-      if (openInPage) {
-        // Redirect current page to Apple Auth
-        window.location.href = appleAuthUrl.toString();
-        return new Promise((_, reject) => {
-          // Set a timeout just in case the redirect doesn't happen
-          const timeout = setTimeout(() => {
-            reject(new Error("Authentication timed out."));
-          }, 300000); // 5 minutes
-          // If the page is unloaded (user navigates away), clear the timeout
-          window.addEventListener("beforeunload", () => clearTimeout(timeout));
-        });
-      } else {
-        // Open popup window
-        const width = utils.popupWidth;
-        const height = utils.popupHeight;
-        const left = window.screenX + (window.innerWidth - width) / 2;
-        const top = window.screenY + (window.innerHeight - height) / 2;
-        const authWindow = window.open("about:blank", "_blank", `width=${width},height=${height},top=${top},left=${left},scrollbars=yes,resizable=yes`);
-        if (!authWindow) {
-          throw new Error("Failed to open Apple login window.");
-        }
-        authWindow.location.href = appleAuthUrl.toString();
-        // Return a promise that resolves when the OAuth flow completes
-        return new Promise((resolve, reject) => {
-          const interval = setInterval(() => {
-            try {
-              // Check if window was closed without completing auth
-              if (authWindow.closed) {
-                clearInterval(interval);
-                reject(new Error("Authentication window was closed."));
-                return;
-              }
-              const url = authWindow.location.href || "";
-              if (url.startsWith(window.location.origin)) {
-                const hashParams = new URLSearchParams(url.split("#")[1]);
-                const idToken = hashParams.get("id_token");
-                const stateParams = hashParams.get("state");
-                const sessionKey = stateParams?.split("&").find(param => param.startsWith("sessionKey="))?.split("=")[1];
-                if (idToken) {
-                  authWindow.close();
-                  clearInterval(interval);
-                  if (params?.onOauthSuccess) {
-                    params.onOauthSuccess({
-                      publicKey,
-                      oidcToken: idToken,
-                      providerName: "apple",
-                      ...(sessionKey && {
-                        sessionKey
-                      })
-                    });
-                  } else if (callbacks?.onOauthRedirect) {
-                    callbacks.onOauthRedirect({
-                      idToken,
-                      publicKey,
-                      ...(sessionKey && {
-                        sessionKey
-                      })
-                    });
-                  } else {
-                    completeOauth({
-                      oidcToken: idToken,
-                      publicKey,
-                      providerName: "apple",
-                      ...(sessionKey && {
-                        sessionKey
-                      })
-                    }).then(() => resolve()).catch(reject);
-                    return;
-                  }
-                  resolve();
-                }
-              }
-            } catch (error) {
-              // Ignore cross-origin errors
-            }
-          }, 500);
+    const provider = sdkTypes.OAuthProviders.APPLE;
+    if (!masterConfig) {
+      throw new sdkTypes.TurnkeyError("Config is not ready yet!", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
+    }
+    if (!clientId) {
+      throw new sdkTypes.TurnkeyError("Apple Client ID is not configured.", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
+    }
+    if (!masterConfig.auth?.oauthConfig?.oauthRedirectUri) {
+      throw new sdkTypes.TurnkeyError("OAuth Redirect URI is not configured.", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
+    }
+    const flow = openInPage ? "redirect" : "popup";
+    // TODO (Amir): Apple needs the '/' at the end. Maybe we should add it if not there?
+    const redirectUri = masterConfig.auth?.oauthConfig.oauthRedirectUri;
+    // Create key pair and generate nonce
+    const publicKey = await createApiKeyPair();
+    if (!publicKey) {
+      throw new Error("Failed to create public key for OAuth.");
+    }
+    const nonce = utils$1.bytesToHex(sha2.sha256(publicKey));
+    // Build OAuth URL
+    const authUrl = oauth.buildOAuthUrl({
+      provider,
+      clientId,
+      redirectUri,
+      publicKey,
+      nonce,
+      flow,
+      additionalState: additionalParameters
+    });
+    if (openInPage) {
+      // Remainder of logic will occur in completeRedirectOauth
+      return oauth.redirectToOAuthProvider(authUrl);
+    }
+    // Popup flow
+    const authWindow = oauth.openOAuthPopup();
+    if (!authWindow) {
+      throw new Error(`Failed to open ${oauth.capitalizeProviderName(provider)} login window.`);
+    }
+    authWindow.location.href = authUrl;
+    return new Promise((resolve, reject) => {
+      const interval = setInterval(() => {
+        try {
           if (authWindow.closed) {
             clearInterval(interval);
+            reject(new Error("Authentication window was closed."));
+            return;
           }
-        });
+          const url = authWindow.location.href || "";
+          if (url.startsWith(window.location.origin)) {
+            const result = oauth.parseOAuthResponse(url, provider);
+            if (result) {
+              authWindow.close();
+              clearInterval(interval);
+              oauth.completeOAuthPopup({
+                provider,
+                publicKey,
+                result,
+                callbacks,
+                completeOauth,
+                onOauthSuccess: params?.onOauthSuccess
+              }).then(() => resolve()).catch(reject);
+            }
+          }
+        } catch {
+          // Ignore cross-origin errors
+        }
+      }, 500);
+      if (authWindow.closed) {
+        clearInterval(interval);
       }
-    } catch (error) {
-      throw error;
-    }
+    });
   }, [callbacks, completeOauth, createApiKeyPair, masterConfig]);
   const handleFacebookOauth = react.useCallback(async params => {
     const {
@@ -2301,142 +2116,87 @@ const ClientProvider = ({
       openInPage = masterConfig?.auth?.oauthConfig?.openOauthInPage ?? false,
       additionalState: additionalParameters
     } = params || {};
-    try {
-      if (!masterConfig) {
-        throw new sdkTypes.TurnkeyError("Config is not ready yet!", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
-      }
-      if (!clientId) {
-        throw new sdkTypes.TurnkeyError("Facebook Client ID is not configured.", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
-      }
-      if (!masterConfig.auth?.oauthConfig?.oauthRedirectUri) {
-        throw new sdkTypes.TurnkeyError("OAuth Redirect URI is not configured.", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
-      }
-      const flow = openInPage ? "redirect" : "popup";
-      const redirectURI = masterConfig.auth?.oauthConfig.oauthRedirectUri;
-      // Create key pair and generate nonce
-      const publicKey = await createApiKeyPair();
-      if (!publicKey) {
-        throw new Error("Failed to create public key for OAuth.");
-      }
-      const nonce = utils$1.bytesToHex(sha2.sha256(publicKey));
-      // Generate PKCE challenge pair
-      const {
-        verifier,
-        codeChallenge
-      } = await utils.generateChallengePair();
-      // Store verifier for later token exchange
-      sessionStorage.setItem("facebook_verifier", verifier);
-      // Construct Facebook Auth URL
-      const facebookAuthUrl = new URL(utils.FACEBOOK_AUTH_URL);
-      facebookAuthUrl.searchParams.set("client_id", clientId);
-      facebookAuthUrl.searchParams.set("redirect_uri", redirectURI);
-      facebookAuthUrl.searchParams.set("response_type", "code");
-      facebookAuthUrl.searchParams.set("code_challenge", codeChallenge);
-      facebookAuthUrl.searchParams.set("code_challenge_method", "S256");
-      facebookAuthUrl.searchParams.set("nonce", nonce);
-      facebookAuthUrl.searchParams.set("scope", "openid");
-      // Create state parameter
-      let state = `provider=facebook&flow=${flow}&publicKey=${encodeURIComponent(publicKey)}`;
-      if (additionalParameters) {
-        const additionalState = Object.entries(additionalParameters).map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`).join("&");
-        if (additionalState) {
-          state += `&${additionalState}`;
-        }
-      }
-      facebookAuthUrl.searchParams.set("state", state);
-      if (openInPage) {
-        // Redirect current page to Facebook Auth
-        window.location.href = facebookAuthUrl.toString();
-        return new Promise((_, reject) => {
-          // Set a timeout just in case the redirect doesn't happen
-          const timeout = setTimeout(() => {
-            reject(new Error("Authentication timed out."));
-          }, 300000); // 5 minutes
-          // If the page is unloaded (user navigates away), clear the timeout
-          window.addEventListener("beforeunload", () => clearTimeout(timeout));
-        });
-      } else {
-        // Open popup window
-        const width = utils.popupWidth;
-        const height = utils.popupHeight;
-        const left = window.screenX + (window.innerWidth - width) / 2;
-        const top = window.screenY + (window.innerHeight - height) / 2;
-        const authWindow = window.open("about:blank", "_blank", `width=${width},height=${height},top=${top},left=${left},scrollbars=yes,resizable=yes`);
-        if (!authWindow) {
-          throw new Error("Failed to open Facebook login window.");
-        }
-        authWindow.location.href = facebookAuthUrl.toString();
-        // Return a promise that resolves when the OAuth flow completes
-        return new Promise((resolve, reject) => {
-          const interval = setInterval(() => {
-            try {
-              // Check if window was closed without completing auth
-              if (authWindow.closed) {
-                clearInterval(interval);
-                reject(new Error("Authentication window was closed."));
-                return;
-              }
-              const url = authWindow.location.href || "";
-              if (url.startsWith(window.location.origin)) {
-                const urlParams = new URLSearchParams(new URL(url).search);
-                const authCode = urlParams.get("code");
-                const stateParam = urlParams.get("state");
-                if (authCode && stateParam && stateParam.includes("provider=facebook")) {
-                  const sessionKey = stateParam?.split("&").find(param => param.startsWith("sessionKey="))?.split("=")[1];
-                  authWindow.close();
-                  clearInterval(interval);
-                  // Exchange code for token
-                  const verifier = sessionStorage.getItem("facebook_verifier");
-                  if (!verifier) {
-                    reject(new Error("Missing PKCE verifier"));
-                    return;
-                  }
-                  utils.exchangeCodeForToken(clientId, redirectURI, authCode, verifier).then(tokenData => {
-                    sessionStorage.removeItem("facebook_verifier");
-                    if (params?.onOauthSuccess) {
-                      params.onOauthSuccess({
-                        publicKey,
-                        oidcToken: tokenData.id_token,
-                        providerName: "facebook",
-                        ...(sessionKey && {
-                          sessionKey
-                        })
-                      });
-                    } else if (callbacks?.onOauthRedirect) {
-                      callbacks.onOauthRedirect({
-                        idToken: tokenData.id_token,
-                        publicKey,
-                        ...(sessionKey && {
-                          sessionKey
-                        })
-                      });
-                    } else {
-                      completeOauth({
-                        oidcToken: tokenData.id_token,
-                        publicKey,
-                        providerName: "facebook",
-                        ...(sessionKey && {
-                          sessionKey
-                        })
-                      }).then(() => resolve()).catch(reject);
-                      return;
-                    }
-                    resolve();
-                  }).catch(reject);
-                }
-              }
-            } catch (error) {
-              // Ignore cross-origin errors
-            }
-          }, 500);
+    const provider = sdkTypes.OAuthProviders.FACEBOOK;
+    if (!masterConfig) {
+      throw new sdkTypes.TurnkeyError("Config is not ready yet!", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
+    }
+    if (!clientId) {
+      throw new sdkTypes.TurnkeyError("Facebook Client ID is not configured.", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
+    }
+    if (!masterConfig.auth?.oauthConfig?.oauthRedirectUri) {
+      throw new sdkTypes.TurnkeyError("OAuth Redirect URI is not configured.", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
+    }
+    const flow = openInPage ? "redirect" : "popup";
+    const redirectUri = masterConfig.auth?.oauthConfig.oauthRedirectUri;
+    // Create key pair and generate nonce
+    const publicKey = await createApiKeyPair();
+    if (!publicKey) {
+      throw new Error("Failed to create public key for OAuth.");
+    }
+    const nonce = utils$1.bytesToHex(sha2.sha256(publicKey));
+    // Generate PKCE challenge pair and store verifier
+    const {
+      verifier,
+      codeChallenge
+    } = await oauth.generateChallengePair();
+    oauth.storePKCEVerifier(provider, verifier);
+    // Build OAuth URL
+    const authUrl = oauth.buildOAuthUrl({
+      provider,
+      clientId,
+      redirectUri,
+      publicKey,
+      nonce,
+      flow,
+      codeChallenge,
+      additionalState: additionalParameters
+    });
+    if (openInPage) {
+      // Remainder of logic will occur in completeRedirectOauth
+      return oauth.redirectToOAuthProvider(authUrl);
+    }
+    // Popup flow
+    const authWindow = oauth.openOAuthPopup();
+    if (!authWindow) {
+      throw new Error(`Failed to open ${oauth.capitalizeProviderName(provider)} login window.`);
+    }
+    authWindow.location.href = authUrl;
+    return new Promise((resolve, reject) => {
+      const interval = setInterval(() => {
+        try {
           if (authWindow.closed) {
             clearInterval(interval);
+            reject(new Error("Authentication window was closed."));
+            return;
           }
-        });
+          const url = authWindow.location.href || "";
+          if (url.startsWith(window.location.origin)) {
+            const result = oauth.parseOAuthResponse(url, provider);
+            if (result) {
+              authWindow.close();
+              clearInterval(interval);
+              oauth.completeOAuthPopup({
+                provider,
+                publicKey,
+                result,
+                callbacks,
+                completeOauth,
+                onOauthSuccess: params?.onOauthSuccess,
+                exchangeCodeForToken: async codeVerifier => {
+                  const tokenData = await oauth.exchangeFacebookCodeForToken(clientId, redirectUri, result.authCode, codeVerifier);
+                  return tokenData.id_token;
+                }
+              }).then(() => resolve()).catch(reject);
+            }
+          }
+        } catch {
+          // Ignore cross-origin errors
+        }
+      }, 500);
+      if (authWindow.closed) {
+        clearInterval(interval);
       }
-    } catch (error) {
-      throw error;
-    }
+    });
   }, [callbacks, completeOauth, createApiKeyPair, masterConfig]);
   const handleLogin = react.useCallback(async params => {
     const logo = masterConfig?.ui?.darkMode ? params?.logoDark ?? masterConfig?.ui?.logoDark : params?.logoLight ?? masterConfig?.ui?.logoLight;
@@ -2596,6 +2356,7 @@ const ClientProvider = ({
       successPageDuration = 2000,
       stampWith,
       keyName,
+      keyFormat,
       clearClipboardOnPaste,
       organizationId
     } = params || {};
@@ -2606,6 +2367,7 @@ const ClientProvider = ({
           importType: base.ImportType.PrivateKey,
           curve: curve,
           addressFormats: addressFormats,
+          keyFormat: keyFormat,
           onError: error => {
             reject(error);
           },
@@ -3337,7 +3099,8 @@ const ClientProvider = ({
     const {
       providerName,
       stampWith,
-      successPageDuration = 2000
+      successPageDuration = 2000,
+      openInPage = masterConfig?.auth?.oauthConfig?.openOauthInPage ?? false
     } = params;
     const s = await getSession();
     const organizationId = params?.organizationId || s?.organizationId;
@@ -3372,40 +3135,81 @@ const ClientProvider = ({
             showTitle: false
           });
         };
+        if (openInPage) {
+          oauth.storeOAuthAddProviderMetadata({
+            organizationId,
+            userId,
+            ...(stampWith && {
+              stampWith: stampWith
+            }),
+            successPageDuration
+          });
+        }
+        const additionalState = openInPage ? {
+          oauthIntent: oauth.OAUTH_INTENT_ADD_PROVIDER,
+          ...(successPageDuration > 0 && {
+            openModal: "true"
+          })
+        } : undefined;
         switch (providerName) {
           case sdkTypes.OAuthProviders.DISCORD:
             {
               return await handleDiscordOauth({
-                openInPage: false,
-                onOauthSuccess
+                openInPage,
+                ...(additionalState && {
+                  additionalState
+                }),
+                ...(!openInPage && {
+                  onOauthSuccess
+                })
               });
             }
           case sdkTypes.OAuthProviders.X:
             {
               return await handleXOauth({
-                openInPage: false,
-                onOauthSuccess
+                openInPage,
+                ...(additionalState && {
+                  additionalState
+                }),
+                ...(!openInPage && {
+                  onOauthSuccess
+                })
               });
             }
           case sdkTypes.OAuthProviders.GOOGLE:
             {
               return await handleGoogleOauth({
-                openInPage: false,
-                onOauthSuccess
+                openInPage,
+                ...(additionalState && {
+                  additionalState
+                }),
+                ...(!openInPage && {
+                  onOauthSuccess
+                })
               });
             }
           case sdkTypes.OAuthProviders.APPLE:
             {
               return await handleAppleOauth({
-                openInPage: false,
-                onOauthSuccess
+                openInPage,
+                ...(additionalState && {
+                  additionalState
+                }),
+                ...(!openInPage && {
+                  onOauthSuccess
+                })
               });
             }
           case sdkTypes.OAuthProviders.FACEBOOK:
             {
               return await handleFacebookOauth({
-                openInPage: false,
-                onOauthSuccess
+                openInPage,
+                ...(additionalState && {
+                  additionalState
+                }),
+                ...(!openInPage && {
+                  onOauthSuccess
+                })
               });
             }
           default: