@turnkey/react-wallet-kit 2.3.1 → 2.4.0

package/dist/providers/client/Provider.js

@@ -5,7 +5,7 @@ var jsxRuntime = require('react/jsx-runtime');
 var sha2 = require('@noble/hashes/sha2');
 var utils$1 = require('@noble/hashes/utils');
 var storage = require('../../utils/oauth/storage.js');
-require('../../utils/oauth/config.js');
+var config = require('../../utils/oauth/config.js');
 var url = require('../../utils/oauth/url.js');
 var completion = require('../../utils/oauth/completion.js');
 var pkce = require('../../utils/oauth/pkce.js');
@@ -69,7 +69,7 @@ var Turnstile = require('../../components/auth/Turnstile.js');
  * @returns A React context provider exposing authentication, wallet, and user management methods and state.
  */
 const ClientProvider = ({
-  config,
+  config: config$1,
   children,
   callbacks
 }) => {
@@ -88,13 +88,16 @@ const ClientProvider = ({
   }, []);
   // if there is no authProxyConfigId or if autoFetchWalletKitConfig is specifically
   // set to false, we don't need to fetch the config
-  const shouldFetchWalletKitConfig = !!config.authProxyConfigId && (config.autoFetchWalletKitConfig ?? true);
+  const shouldFetchWalletKitConfig = !!config$1.authProxyConfigId && (config$1.autoFetchWalletKitConfig ?? true);
   // we use this custom hook to only update the state if the value is different
   // this is so our useEffect that calls `initializeWalletProviderListeners()` only runs when it needs to
   const [walletProviders, setWalletProviders] = utils.useWalletProviderState();
   const expiryTimeoutsRef = react.useRef({});
   const proxyAuthConfigRef = react.useRef(null);
   const clientParamsRef = react.useRef(null);
+  // Stores the developer's custom MFA handler set via setMfaHandler.
+  // When unset, the default httpClient MFA behavior is used (no onMfaRequired callback).
+  const mfaHandlerRef = react.useRef(undefined);
   const [allSessions, setAllSessions] = react.useState(undefined);
   const {
     isMobile,
@@ -410,115 +413,115 @@ const ClientProvider = ({
   const buildConfig = (proxyAuthConfig, clientParams) => {
     // Juggle the local overrides with the values set in the dashboard (proxyAuthConfig).
     const resolvedMethods = {
-      emailOtpAuthEnabled: config.ui?.authModal?.methods?.emailOtpAuthEnabled ?? proxyAuthConfig?.enabledProviders.includes("email"),
-      smsOtpAuthEnabled: config.ui?.authModal?.methods?.smsOtpAuthEnabled ?? proxyAuthConfig?.enabledProviders.includes("sms"),
-      passkeyAuthEnabled: config.ui?.authModal?.methods?.passkeyAuthEnabled ?? proxyAuthConfig?.enabledProviders.includes("passkey"),
-      walletAuthEnabled: config.ui?.authModal?.methods?.walletAuthEnabled ?? proxyAuthConfig?.enabledProviders.includes("wallet"),
-      googleOauthEnabled: config.ui?.authModal?.methods?.googleOauthEnabled ?? proxyAuthConfig?.enabledProviders.includes("google"),
-      xOauthEnabled: config.ui?.authModal?.methods?.xOauthEnabled ?? proxyAuthConfig?.enabledProviders.includes("x"),
-      discordOauthEnabled: config.ui?.authModal?.methods?.discordOauthEnabled ?? proxyAuthConfig?.enabledProviders.includes("discord"),
-      appleOauthEnabled: config.ui?.authModal?.methods?.appleOauthEnabled ?? proxyAuthConfig?.enabledProviders.includes("apple"),
-      facebookOauthEnabled: config.ui?.authModal?.methods?.facebookOauthEnabled ?? proxyAuthConfig?.enabledProviders.includes("facebook")
+      emailOtpAuthEnabled: config$1.ui?.authModal?.methods?.emailOtpAuthEnabled ?? proxyAuthConfig?.enabledProviders.includes("email"),
+      smsOtpAuthEnabled: config$1.ui?.authModal?.methods?.smsOtpAuthEnabled ?? proxyAuthConfig?.enabledProviders.includes("sms"),
+      passkeyAuthEnabled: config$1.ui?.authModal?.methods?.passkeyAuthEnabled ?? proxyAuthConfig?.enabledProviders.includes("passkey"),
+      walletAuthEnabled: config$1.ui?.authModal?.methods?.walletAuthEnabled ?? proxyAuthConfig?.enabledProviders.includes("wallet"),
+      googleOauthEnabled: config$1.ui?.authModal?.methods?.googleOauthEnabled ?? proxyAuthConfig?.enabledProviders.includes("google"),
+      xOauthEnabled: config$1.ui?.authModal?.methods?.xOauthEnabled ?? proxyAuthConfig?.enabledProviders.includes("x"),
+      discordOauthEnabled: config$1.ui?.authModal?.methods?.discordOauthEnabled ?? proxyAuthConfig?.enabledProviders.includes("discord"),
+      appleOauthEnabled: config$1.ui?.authModal?.methods?.appleOauthEnabled ?? proxyAuthConfig?.enabledProviders.includes("apple"),
+      facebookOauthEnabled: config$1.ui?.authModal?.methods?.facebookOauthEnabled ?? proxyAuthConfig?.enabledProviders.includes("facebook")
     };
     const resolvedOauthProviders = {
       google: {
-        primaryClientId: config.auth?.oauthConfig?.google?.primaryClientId ?? proxyAuthConfig?.oauthClientIds?.google,
-        secondaryClientIds: config.auth?.oauthConfig?.google?.secondaryClientIds ?? []
+        primaryClientId: config$1.auth?.oauthConfig?.google?.primaryClientId ?? proxyAuthConfig?.oauthClientIds?.google,
+        secondaryClientIds: config$1.auth?.oauthConfig?.google?.secondaryClientIds ?? []
       },
       apple: {
-        primaryClientId: config.auth?.oauthConfig?.apple?.primaryClientId ?? proxyAuthConfig?.oauthClientIds?.apple,
-        secondaryClientIds: config.auth?.oauthConfig?.apple?.secondaryClientIds ?? []
+        primaryClientId: config$1.auth?.oauthConfig?.apple?.primaryClientId ?? proxyAuthConfig?.oauthClientIds?.apple,
+        secondaryClientIds: config$1.auth?.oauthConfig?.apple?.secondaryClientIds ?? []
       },
       facebook: {
-        primaryClientId: config.auth?.oauthConfig?.facebook?.primaryClientId ?? proxyAuthConfig?.oauthClientIds?.facebook,
-        secondaryClientIds: config.auth?.oauthConfig?.facebook?.secondaryClientIds ?? []
+        primaryClientId: config$1.auth?.oauthConfig?.facebook?.primaryClientId ?? proxyAuthConfig?.oauthClientIds?.facebook,
+        secondaryClientIds: config$1.auth?.oauthConfig?.facebook?.secondaryClientIds ?? []
       },
       x: {
-        primaryClientId: config.auth?.oauthConfig?.x?.primaryClientId ?? proxyAuthConfig?.oauthClientIds?.x,
-        secondaryClientIds: config.auth?.oauthConfig?.x?.secondaryClientIds ?? []
+        primaryClientId: config$1.auth?.oauthConfig?.x?.primaryClientId ?? proxyAuthConfig?.oauthClientIds?.x,
+        secondaryClientIds: config$1.auth?.oauthConfig?.x?.secondaryClientIds ?? []
       },
       discord: {
-        primaryClientId: config.auth?.oauthConfig?.discord?.primaryClientId ?? proxyAuthConfig?.oauthClientIds?.discord,
-        secondaryClientIds: config.auth?.oauthConfig?.discord?.secondaryClientIds ?? []
+        primaryClientId: config$1.auth?.oauthConfig?.discord?.primaryClientId ?? proxyAuthConfig?.oauthClientIds?.discord,
+        secondaryClientIds: config$1.auth?.oauthConfig?.discord?.secondaryClientIds ?? []
       }
     };
-    const redirectUrl = config.auth?.oauthConfig?.oauthRedirectUri ?? proxyAuthConfig?.oauthRedirectUrl;
+    const redirectUrl = config$1.auth?.oauthConfig?.oauthRedirectUri ?? proxyAuthConfig?.oauthRedirectUrl;
     // Set a default ordering for the oAuth methods
-    const oauthOrder = config.ui?.authModal?.oauthOrder ?? ["google", "apple", "x", "discord", "facebook"].filter(provider => resolvedMethods[`${provider}OauthEnabled`]);
+    const oauthOrder = config$1.ui?.authModal?.oauthOrder ?? ["google", "apple", "x", "discord", "facebook"].filter(provider => resolvedMethods[`${provider}OauthEnabled`]);
     // Set a default ordering for the overall auth methods
-    const methodOrder = config.ui?.authModal?.methodOrder ?? [oauthOrder.length > 0 ? "socials" : null, resolvedMethods.emailOtpAuthEnabled ? "email" : null, resolvedMethods.smsOtpAuthEnabled ? "sms" : null, resolvedMethods.passkeyAuthEnabled ? "passkey" : null, resolvedMethods.walletAuthEnabled ? "wallet" : null].filter(Boolean);
+    const methodOrder = config$1.ui?.authModal?.methodOrder ?? [oauthOrder.length > 0 ? "socials" : null, resolvedMethods.emailOtpAuthEnabled ? "email" : null, resolvedMethods.smsOtpAuthEnabled ? "sms" : null, resolvedMethods.passkeyAuthEnabled ? "passkey" : null, resolvedMethods.walletAuthEnabled ? "wallet" : null].filter(Boolean);
     // Warn if they are trying to set auth proxy only settings directly
     if (proxyAuthConfig) {
-      if (config.auth?.sessionExpirationSeconds) {
+      if (config$1.auth?.sessionExpirationSeconds) {
         console.warn("Turnkey SDK warning. You have set sessionExpirationSeconds directly in the TurnkeyProvider. This setting will be ignored because you are using an auth proxy. Please configure session expiration in the Turnkey dashboard.");
       }
-      if (config.auth?.otpAlphanumeric !== undefined) {
+      if (config$1.auth?.otpAlphanumeric !== undefined) {
         console.warn("Turnkey SDK warning. You have set otpAlphanumeric directly in the TurnkeyProvider. This setting will be ignored because you are using an auth proxy. Please configure OTP settings in the Turnkey dashboard.");
       }
-      if (config.auth?.otpLength) {
+      if (config$1.auth?.otpLength) {
         console.warn("Turnkey SDK warning. You have set otpLength directly in the TurnkeyProvider. This setting will be ignored because you are using an auth proxy. Please configure OTP settings in the Turnkey dashboard.");
       }
     }
     // These are settings that, if using the auth proxy, must be set in the dashboard. They override any local settings unless they are not using auth proxy or are not fetching the auth proxy config.
     const authProxyPrioSettings = {
-      sessionExpirationSeconds: proxyAuthConfig?.sessionExpirationSeconds ?? config.auth?.sessionExpirationSeconds,
-      otpAlphanumeric: proxyAuthConfig?.otpAlphanumeric ?? config.auth?.otpAlphanumeric ?? true,
-      otpLength: proxyAuthConfig?.otpLength ?? config.auth?.otpLength ?? "6"
+      sessionExpirationSeconds: proxyAuthConfig?.sessionExpirationSeconds ?? config$1.auth?.sessionExpirationSeconds,
+      otpAlphanumeric: proxyAuthConfig?.otpAlphanumeric ?? config$1.auth?.otpAlphanumeric ?? true,
+      otpLength: proxyAuthConfig?.otpLength ?? config$1.auth?.otpLength ?? "6"
     };
-    const scopePasskeyToUser = config.auth?.scopePasskeyToUser ?? true;
+    const scopePasskeyToUser = config$1.auth?.scopePasskeyToUser ?? true;
     return {
-      ...config,
+      ...config$1,
       scopePasskeyToUser,
       // Overrides:
       auth: {
-        ...config.auth,
+        ...config$1.auth,
         ...authProxyPrioSettings,
         oauthConfig: {
-          ...config.auth?.oauthConfig,
+          ...config$1.auth?.oauthConfig,
           ...resolvedOauthProviders,
           oauthRedirectUri: redirectUrl,
           // on mobile we default to true since many mobile browsers
           // (e.g. Safari) block popups
-          openOauthInPage: isMobile ? true : config.auth?.oauthConfig?.openOauthInPage
+          openOauthInPage: isMobile ? true : config$1.auth?.oauthConfig?.openOauthInPage
         },
-        autoRefreshSession: config.auth?.autoRefreshSession ?? true,
+        autoRefreshSession: config$1.auth?.autoRefreshSession ?? true,
         scopePasskeyToUser
       },
       ui: {
-        ...config.ui,
+        ...config$1.ui,
         authModal: {
-          ...config.ui?.authModal,
+          ...config$1.ui?.authModal,
           methods: resolvedMethods,
           methodOrder,
           oauthOrder
         }
       },
-      autoRefreshManagedState: config.autoRefreshManagedState ?? true,
+      autoRefreshManagedState: config$1.autoRefreshManagedState ?? true,
       walletConfig: {
-        ...config.walletConfig,
+        ...config$1.walletConfig,
         features: {
-          ...config.walletConfig?.features,
+          ...config$1.walletConfig?.features,
           auth:
           // If walletAuthEnabled is not set, default to true. Wallet auth can be enabled/disabled in the dashboard or by explicitly changing the walletAuthEnabled / walletConfig auth feature.
-          resolvedMethods.walletAuthEnabled ?? config.walletConfig?.features?.auth ?? true,
-          connecting: config.walletConfig?.features?.connecting ?? true // Default connecting to true if not set. We don't care about auth settings here.
+          resolvedMethods.walletAuthEnabled ?? config$1.walletConfig?.features?.auth ?? true,
+          connecting: config$1.walletConfig?.features?.connecting ?? true // Default connecting to true if not set. We don't care about auth settings here.
         },
         chains: {
-          ...config.walletConfig?.chains,
+          ...config$1.walletConfig?.chains,
           ethereum: {
-            ...config.walletConfig?.chains?.ethereum,
+            ...config$1.walletConfig?.chains?.ethereum,
             // keep user's value if provided; default only when undefined
-            native: config.walletConfig?.chains?.ethereum?.native ?? true
+            native: config$1.walletConfig?.chains?.ethereum?.native ?? true
           },
           solana: {
-            ...config.walletConfig?.chains?.solana,
+            ...config$1.walletConfig?.chains?.solana,
             // keep user's value if provided; default only when undefined
-            native: config.walletConfig?.chains?.solana?.native ?? true
+            native: config$1.walletConfig?.chains?.solana?.native ?? true
           }
         }
       },
-      importIframeUrl: config.importIframeUrl ?? "https://import.turnkey.com",
-      exportIframeUrl: config.exportIframeUrl ?? "https://export.turnkey.com",
+      importIframeUrl: config$1.importIframeUrl ?? "https://import.turnkey.com",
+      exportIframeUrl: config$1.exportIframeUrl ?? "https://export.turnkey.com",
       turnstileSiteKey: clientParams?.turnstileSiteKey
     };
   };
@@ -883,6 +886,12 @@ const ClientProvider = ({
     }
     return client.overridePasskeyStamper(params);
   }, [client]);
+  const overrideAttestedStamper = react.useCallback(params => {
+    if (!client) {
+      throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
+    }
+    return client.overrideAttestedStamper(params);
+  }, [client]);
   const getActiveSessionKey = react.useCallback(async () => {
     if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     return utils.withTurnkeyErrorHandling(() => client.getActiveSessionKey(), undefined, callbacks, "Failed to get active session key");
@@ -1367,13 +1376,23 @@ const ClientProvider = ({
     if (!client) {
       throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     }
-    return utils.withTurnkeyErrorHandling(() => client.verifyOtp(params), undefined, callbacks, "Failed to verify OTP");
+    const res = await utils.withTurnkeyErrorHandling(() => client.verifyOtp(params), undefined, callbacks, "Failed to verify OTP");
+    // Automatically override the attested stamper with the verification token
+    await client.overrideAttestedStamper({
+      verificationToken: res.verificationToken,
+      publicKey: res.publicKey
+    });
+    return res;
   }, [client, callbacks]);
   const loginWithOtp = react.useCallback(async params => {
     if (!client) {
       throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     }
-    const res = await utils.withTurnkeyErrorHandling(() => client.loginWithOtp(params), undefined, callbacks, "Failed to login with OTP");
+    const expirationSeconds = params?.expirationSeconds ?? masterConfig?.auth?.sessionExpirationSeconds ?? core.DEFAULT_SESSION_EXPIRATION_IN_SECONDS;
+    const res = await utils.withTurnkeyErrorHandling(() => client.loginWithOtp({
+      ...params,
+      expirationSeconds
+    }), undefined, callbacks, "Failed to login with OTP");
     if (res) {
       await handlePostAuth({
         method: base.AuthMethod.Otp,
@@ -1383,7 +1402,7 @@ const ClientProvider = ({
       });
     }
     return res;
-  }, [client, callbacks, handlePostAuth]);
+  }, [client, callbacks, masterConfig, handlePostAuth]);
   const signUpWithOtp = react.useCallback(async params => {
     if (!client) {
       throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
@@ -1454,7 +1473,11 @@ const ClientProvider = ({
     if (!client) {
       throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     }
-    const res = await utils.withTurnkeyErrorHandling(() => client.loginWithOauth(params), undefined, callbacks, "Failed to login with OAuth");
+    const expirationSeconds = params?.expirationSeconds ?? masterConfig?.auth?.sessionExpirationSeconds ?? core.DEFAULT_SESSION_EXPIRATION_IN_SECONDS;
+    const res = await utils.withTurnkeyErrorHandling(() => client.loginWithOauth({
+      ...params,
+      expirationSeconds
+    }), undefined, callbacks, "Failed to login with OAuth");
     if (res) {
       await handlePostAuth({
         method: base.AuthMethod.Oauth,
@@ -1464,7 +1487,7 @@ const ClientProvider = ({
       });
     }
     return res;
-  }, [client, callbacks, handlePostAuth]);
+  }, [client, callbacks, masterConfig, handlePostAuth]);
   const signUpWithOauth = react.useCallback(async params => {
     if (!client) {
       throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
@@ -1840,10 +1863,9 @@ const ClientProvider = ({
   }, [client, callbacks, logout, clearSessionTimeouts, masterConfig?.passkeyConfig]);
   const setActiveSession = react.useCallback(async params => {
     if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
-    const session = await utils.withTurnkeyErrorHandling(() => client.getSession({
+    const s = await getSession({
       sessionKey: params.sessionKey
-    }), () => logout(), callbacks, "Failed to get session");
-    const s = await getSession();
+    });
     if (!s) {
       throw new sdkTypes.TurnkeyError("Session not found.", sdkTypes.TurnkeyErrorCodes.NOT_FOUND);
     }
@@ -1884,6 +1906,17 @@ const ClientProvider = ({
     if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     return utils.withTurnkeyErrorHandling(() => client.verifyAppProofs(params), () => logout(), callbacks, "Failed to verify app proofs");
   }, [client, callbacks, logout]);
+  const setMfaHandler = react.useCallback(handler => {
+    mfaHandlerRef.current = handler;
+    // Apply immediately if the client is ready.
+    // When a custom handler is set, route the httpClient's MFA callback to it.
+    // When cleared, restore the default httpClient behavior (no onMfaRequired callback).
+    if (client) {
+      client.httpClient.config.onMfaRequired = handler ? async ctx => {
+        await handler(ctx);
+      } : undefined;
+    }
+  }, [client]);
   const handleDiscordOauth = react.useCallback(async params => {
     const {
       primaryClientId = masterConfig?.auth?.oauthConfig?.discord?.primaryClientId,
@@ -1945,7 +1978,7 @@ const ClientProvider = ({
     }
     authWindow.location.href = authUrl;
     return new Promise((resolve, reject) => {
-      const interval = setInterval(() => {
+      const interval = setInterval(async () => {
         try {
           if (authWindow.closed) {
             clearInterval(interval);
@@ -1953,7 +1986,7 @@ const ClientProvider = ({
             return;
           }
           const url$1 = authWindow.location.href || "";
-          if (url$1.startsWith(window.location.origin)) {
+          if (url.isExpectedOAuthRedirectUrl(url$1, redirectUri, config.OAUTH_PROVIDER_CONFIGS[provider].expectedResponseMode)) {
             const result = url.parseOAuthResponse(url$1, provider);
             if (result) {
               authWindow.close();
@@ -1987,7 +2020,15 @@ const ClientProvider = ({
                     clientId,
                     nonce
                   });
-                  return resp?.oidcToken ?? "";
+                  const oidcToken = resp?.oidcToken ?? "";
+                  // Set the attested stamper with the oidcToken
+                  if (oidcToken) {
+                    await client?.overrideAttestedStamper({
+                      oidcToken,
+                      publicKey
+                    });
+                  }
+                  return oidcToken;
                 }
               }).then(() => resolve()).catch(reject);
             }
@@ -2062,7 +2103,7 @@ const ClientProvider = ({
     }
     authWindow.location.href = authUrl;
     return new Promise((resolve, reject) => {
-      const interval = setInterval(() => {
+      const interval = setInterval(async () => {
         try {
           if (authWindow.closed) {
             clearInterval(interval);
@@ -2070,7 +2111,7 @@ const ClientProvider = ({
             return;
           }
           const url$1 = authWindow.location.href || "";
-          if (url$1.startsWith(window.location.origin)) {
+          if (url.isExpectedOAuthRedirectUrl(url$1, redirectUri, config.OAUTH_PROVIDER_CONFIGS[provider].expectedResponseMode)) {
             const result = url.parseOAuthResponse(url$1, provider);
             if (result) {
               authWindow.close();
@@ -2104,7 +2145,15 @@ const ClientProvider = ({
                     clientId,
                     nonce
                   });
-                  return resp?.oidcToken ?? "";
+                  const oidcToken = resp?.oidcToken ?? "";
+                  // Set the attested stamper with the oidcToken
+                  if (oidcToken) {
+                    await client?.overrideAttestedStamper({
+                      oidcToken,
+                      publicKey
+                    });
+                  }
+                  return oidcToken;
                 }
               }).then(() => resolve()).catch(reject);
             }
@@ -2173,7 +2222,7 @@ const ClientProvider = ({
     }
     authWindow.location.href = authUrl;
     return new Promise((resolve, reject) => {
-      const interval = setInterval(() => {
+      const interval = setInterval(async () => {
         try {
           if (authWindow.closed) {
             clearInterval(interval);
@@ -2181,11 +2230,18 @@ const ClientProvider = ({
             return;
           }
           const url$1 = authWindow.location.href || "";
-          if (url$1.startsWith(window.location.origin)) {
+          if (url.isExpectedOAuthRedirectUrl(url$1, redirectUri, config.OAUTH_PROVIDER_CONFIGS[provider].expectedResponseMode)) {
             const result = url.parseOAuthResponse(url$1, provider);
             if (result) {
               authWindow.close();
               clearInterval(interval);
+              // Set the attested stamper with the oidcToken
+              if (result.idToken) {
+                await client?.overrideAttestedStamper({
+                  oidcToken: result.idToken,
+                  publicKey
+                });
+              }
               completion.completeOAuthPopup({
                 provider,
                 publicKey,
@@ -2273,7 +2329,7 @@ const ClientProvider = ({
     }
     authWindow.location.href = authUrl;
     return new Promise((resolve, reject) => {
-      const interval = setInterval(() => {
+      const interval = setInterval(async () => {
         try {
           if (authWindow.closed) {
             clearInterval(interval);
@@ -2281,11 +2337,18 @@ const ClientProvider = ({
             return;
           }
           const url$1 = authWindow.location.href || "";
-          if (url$1.startsWith(window.location.origin)) {
+          if (url.isExpectedOAuthRedirectUrl(url$1, redirectUri, config.OAUTH_PROVIDER_CONFIGS[provider].expectedResponseMode)) {
             const result = url.parseOAuthResponse(url$1, provider);
             if (result) {
               authWindow.close();
               clearInterval(interval);
+              // Set the attested stamper with the oidcToken
+              if (result.idToken) {
+                await client?.overrideAttestedStamper({
+                  oidcToken: result.idToken,
+                  publicKey
+                });
+              }
               completion.completeOAuthPopup({
                 provider,
                 publicKey,
@@ -2379,7 +2442,7 @@ const ClientProvider = ({
     }
     authWindow.location.href = authUrl;
     return new Promise((resolve, reject) => {
-      const interval = setInterval(() => {
+      const interval = setInterval(async () => {
         try {
           if (authWindow.closed) {
             clearInterval(interval);
@@ -2387,7 +2450,7 @@ const ClientProvider = ({
             return;
           }
           const url$1 = authWindow.location.href || "";
-          if (url$1.startsWith(window.location.origin)) {
+          if (url.isExpectedOAuthRedirectUrl(url$1, redirectUri, config.OAUTH_PROVIDER_CONFIGS[provider].expectedResponseMode)) {
             const result = url.parseOAuthResponse(url$1, provider);
             if (result) {
               authWindow.close();
@@ -2414,7 +2477,15 @@ const ClientProvider = ({
                 onOauthSuccess: params?.onOauthSuccess,
                 exchangeCodeForToken: async codeVerifier => {
                   const tokenData = await pkce.exchangeFacebookCodeForToken(clientId, redirectUri, result.authCode, codeVerifier);
-                  return tokenData.id_token;
+                  const oidcToken = tokenData.id_token;
+                  // Set the attested stamper with the oidcToken
+                  if (oidcToken) {
+                    await client?.overrideAttestedStamper({
+                      oidcToken,
+                      publicKey
+                    });
+                  }
+                  return oidcToken;
                 }
               }).then(() => resolve()).catch(reject);
             }
@@ -3975,12 +4046,12 @@ const ClientProvider = ({
         let clientParams;
         const promises = [];
         if (shouldFetchWalletKitConfig) {
-          promises.push(core.getAuthProxyConfig(config.authProxyConfigId, config.authProxyUrl).then(result => {
+          promises.push(core.getAuthProxyConfig(config$1.authProxyConfigId, config$1.authProxyUrl).then(result => {
             proxyAuthConfig = result;
           }));
         }
-        if (config.authProxyConfigId) {
-          promises.push(core.getClientParams(config.authProxyConfigId, config.authProxyUrl).then(result => {
+        if (config$1.authProxyConfigId) {
+          promises.push(core.getClientParams(config$1.authProxyConfigId, config$1.authProxyUrl).then(result => {
             clientParams = result;
           }));
         }
@@ -4010,7 +4081,7 @@ const ClientProvider = ({
     // If shouldFetchWalletKitConfig is false, we'll never have a proxyAuthConfig to build the master config with, so this useEffect should always run.
     if (!proxyAuthConfigRef.current && shouldFetchWalletKitConfig) return;
     setMasterConfig(buildConfig(proxyAuthConfigRef.current ?? undefined, clientParamsRef.current ?? undefined));
-  }, [config, proxyAuthConfigRef.current]);
+  }, [config$1, proxyAuthConfigRef.current]);
   /**
    * @internal
    * We create `debouncedRefreshWallets()` so that multiple rapid wallet events
@@ -4059,8 +4130,8 @@ const ClientProvider = ({
     }
   }, [session]);
   react.useEffect(() => {
-    // This will handle any redirect based oAuth. It then initializes the session. This is the last step before client is considered "ready"
     if (!client || !masterConfig) return;
+    // This will handle any redirect based oAuth. It then initializes the session. This is the last step before client is considered "ready"
     completeRedirectOauth().finally(() => {
       clearSessionTimeouts();
       // if auth or wallet connecting features are enabled, we want to fetch
@@ -4073,6 +4144,13 @@ const ClientProvider = ({
         setClientState(base.ClientState.Ready);
       });
     });
+    // Only set the onMfaRequired handler if we have a mfaHandler set.
+    const mfaHandler = mfaHandlerRef.current;
+    if (mfaHandler) {
+      client.httpClient.config.onMfaRequired = async ctx => {
+        await mfaHandler(ctx);
+      };
+    }
     return () => {
       clearSessionTimeouts();
     };
@@ -4091,6 +4169,7 @@ const ClientProvider = ({
       createHttpClient,
       overrideApiKeyStamper,
       overridePasskeyStamper,
+      overrideAttestedStamper,
       createPasskey,
       logout,
       loginWithPasskey,
@@ -4186,6 +4265,7 @@ const ClientProvider = ({
       handleOnRamp,
       handleSendTransaction,
       handleSendErc20Transfer,
+      setMfaHandler,
       getTurnstileToken,
       setTurnstileToken
     },