`accessKey.signAuthorization`

Signs a key authorization for an access key. The action resolves any required chain state before signing, but does not send a transaction. For a coordinated multisig, each call stores one owner approval and returns the signed authorization with the current operation under multisig.

Usage

import { Account, P256 } from 'viem/tempo'
import { client } from './viem.config'
 
// 1. Define root account
const account = Account.fromSecp256k1('0x...')
 
// 2. Define access key attached to the root account
const accessKey = Account.fromP256(P256.randomPrivateKey(), {
  access: account,
})
 
// 3. Sign the key authorization
const keyAuthorization = await client.accessKey.signAuthorization({
  account,
  accessKey,
})

import { Account, createClient } from 'viem/tempo'
 
export const client = createClient({
  account: Account.fromSecp256k1('0x...'),
})

Coordinated Multisig Approvals

Pass a multisig account with the first owner's approval. Later owners continue the operation using its hash.

import { Account, P256 } from 'viem/tempo'
import { client } from './viem.config'
 
const owner_1 = Account.fromSecp256k1(
  '0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80'
)
const owner_2 = Account.fromSecp256k1(
  '0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d'
)
const multisig = Account.fromMultisig({
  address: 'infer',
  owners: [owner_1.address, owner_2.address],
  threshold: 2,
})
const accessKey = Account.fromP256(P256.randomPrivateKey(), {
  access: multisig,
})
 
const pending = await client.accessKey.signAuthorization({
  accessKey,
  account: multisig,
  owner: owner_1,
})
 
const success = await client.accessKey.signAuthorization({
  hash: pending.hash,
  owner: owner_2,
})

import { createClient } from 'viem/tempo'
import { store } from './store.db'
 
export const client = createClient({
  experimental_multisig: { store },
})

With Periodic Spending Limits

Use the period field on limits to set a recurring spending cap that resets after the given number of seconds:

import { parseUnits } from 'viem'
import { Account, Period, P256 } from 'viem/tempo'
import { client } from './viem.config'
 
const account = Account.fromSecp256k1('0x...')
const accessKey = Account.fromP256(P256.randomPrivateKey(), {
  access: account,
})
 
const keyAuthorization = await client.accessKey.signAuthorization({
  account,
  accessKey,
  limits: [ 
    { 
      token: '0x20c0000000000000000000000000000000000001', 
      limit: parseUnits('1000', 6), 
      period: Period.months(1), // resets every month
    }, 
  ], 
})

With Call Scopes

Use scopes to restrict which contracts and functions the access key can call:

import { parseUnits } from 'viem'
import { Account, P256 } from 'viem/tempo'
import { client } from './viem.config'
 
const account = Account.fromSecp256k1('0x...')
const accessKey = Account.fromP256(P256.randomPrivateKey(), {
  access: account,
})
 
const keyAuthorization = await client.accessKey.signAuthorization({
  account,
  accessKey,
  limits: [ 
    { 
      token: '0x20c0000000000000000000000000000000000001', 
      limit: parseUnits('10000', 6), 
    }, 
  ], 
  scopes: [ 
    { 
      address: '0x20c0000000000000000000000000000000000001', 
      selector: 'transfer(address,uint256)', // or "0xa9059cbb"
      recipients: ['0xcafebabecafebabecafebabecafebabecafebabe'], // optional
    }, 
  ], 
})

import { parseUnits } from 'viem'
import { Account, P256, Scopes } from 'viem/tempo'
import { client } from './viem.config'
 
const account = Account.fromSecp256k1('0x...')
const accessKey = Account.fromP256(P256.randomPrivateKey(), {
  access: account,
})
 
const keyAuthorization = await client.accessKey.signAuthorization({
  account,
  accessKey,
  limits: [ 
    { 
      token: '0x20c0000000000000000000000000000000000001', 
      limit: parseUnits('10000', 6), 
    }, 
  ], 
  scopes: [ 
    Scopes.tip20('0x20c0000000000000000000000000000000000001') 
      .transfer({ 
        recipients: ['0xcafebabecafebabecafebabecafebabecafebabe'], 
      }), 
  ], 
})

Authorize Public Keys

Instead of passing an AccessKeyAccount, you can sign an authorization for a key by its public key or address directly:

import { Account, P256 } from 'viem/tempo'
import { client } from './viem.config'
 
const account = Account.fromSecp256k1('0x...')
 
// Sign authorization by public key
const keyAuthorization = await client.accessKey.signAuthorization({ 
  account, 
  accessKey: { 
    publicKey: '0x...', 
    type: 'p256', 
  }, 
})

You can also sign by address:

import { Account } from 'viem/tempo'
import { client } from './viem.config'
 
const account = Account.fromSecp256k1('0x...')
 
// Sign authorization by address
const keyAuthorization = await client.accessKey.signAuthorization({ 
  account, 
  accessKey: { 
    address: '0x...', 
    type: 'p256', 
  }, 
})

Submitting the Authorization

The signed keyAuthorization can be attached to any write action.

// Authorize the key alongside a transfer, sent with the access key
const { receipt } = await client.token.transferSync({
  account: accessKey,
  token: '0x20c0000000000000000000000000000000000001',
  to: '0xcafebabecafebabecafebabecafebabecafebabe',
  amount: 100n,
  keyAuthorization,
})

Return Type

type ReturnType =
  | KeyAuthorization.Signed
  | (KeyAuthorization.Signed & {
      hash: Hex
      multisig: MultisigOperation.KeyAuthorizationOperation
      status: 'pending' | 'success'
    })

Local signing returns a signed key authorization that can be passed to any write action. Coordinated signing also returns the operation hash, status, and multisig details. A successful result can be passed directly to any write action as its keyAuthorization.

Parameters

account

Type: RootAccount | MultisigAccount

The account authorizing the access key. For coordinated signing, pass the multisig account here.

accessKey

Type: { accessKeyAddress: Address; keyType: string } | { address: Address; type: string } | { publicKey: Hex; type: string }

The access key to authorize. Accepts an AccessKeyAccount, or an object with { address, type } or { publicKey, type }.

admin (optional)

Type: boolean

Whether to authorize the key as an admin key. Admin keys are unrestricted and can manage the account's other access keys; expiry, limits, and scopes are ignored. Requires the T6 hardfork (TIP-1049).

expiry (optional)

Type: number

Unix timestamp when the key expires.

hash

Type: Hex

The operation hash returned by the first coordinated approval. Pass it instead of the initial authorization fields when adding another owner approval.

limits (optional)

Type: { token: Address; limit: bigint; period?: number }[]

Spending limits per token. Optionally include period (in seconds) to make the limit periodic. It resets after each period.

owner

Type: RootAccount | MultisigAccount

The local owner adding a coordinated approval. Passing owner with a multisig account starts a coordinated operation. Later owners pass owner with the operation hash.

scopes (optional)

Type: { address: Address; selector?: Hex | string; recipients?: Address[] }[]

Call scopes restricting which contracts/selectors this key can call.

witness (optional)

Type: Hex

Optional 32-byte witness bound into the authorization's signing hash. Can be burned onchain via accessKey.burnWitness to invalidate the authorization before it is submitted (TIP-1053).

Suggest changes to this page