`accessKey.signAuthorization`

Signs a key authorization for an access key. The action resolves any required chain state before signing, but does not send a transaction. For a coordinated configurable account, each call stores one owner approval and returns the signed authorization with the current operation under operation.

Usage

import { ,  } from 'viem/tempo'
import {  } from './viem.config'
 
// 1. Define root account
const  = .('0x...')
 
// 2. Define access key attached to the root account
const  = .(.(), {
  : ,
})
 
// 3. Sign the key authorization
const  = await ..({
  ,
  ,
})

import { ,  } from 'viem/tempo'
 
export const  = .({
  : .('0x...'),
})

Coordinated Owner Approvals

Pass a configurable account with the first owner's approval. Later owners continue the operation using its hash.

import { ,  } from 'viem/tempo'
import {  } from './viem.config'
 
const  = .(
  '0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80'
)
const  = .(
  '0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d'
)
const  = .({
  : 'infer',
  : [., .],
  : 2,
})
const  = .(.(), {
  : ,
})
 
const  = await ..({
  ,
  ,
  : ,
})
 
const  = await ..({
  : .,
  : ,
})

import { , , , type ,  } from 'viem/tempo'
 
// Supply an atomic store shared by every coordinating process.
declare const : .
 
export const  = .({
  : ((), { : [.({  })] }),
})

With Periodic Spending Limits

Use the period field on limits to set a recurring spending cap that resets after the given number of seconds:

import {  } from 'viem/utils'
import { , ,  } from 'viem/tempo'
import {  } from './viem.config'
 
const  = .('0x...')
const  = .(.(), {
  : ,
})
 
const  = await ..({
  ,
  ,
  : [
    {
      : '0x20c0000000000000000000000000000000000001',
      : .('1000', 6),
      : .(1), // resets every month
    },
  ],
})

With Call Scopes

Use scopes to restrict which contracts and functions the access key can call:

import {  } from 'viem/utils'
import { ,  } from 'viem/tempo'
import {  } from './viem.config'
 
const  = .('0x...')
const  = .(.(), {
  : ,
})
 
const  = await ..({
  ,
  ,
  : [
    {
      : '0x20c0000000000000000000000000000000000001',
      : .('10000', 6),
    },
  ],
  : [
    {
      : '0x20c0000000000000000000000000000000000001',
      : 'transfer(address,uint256)', // or "0xa9059cbb"
      : ['0xcafebabecafebabecafebabecafebabecafebabe'], // optional
    },
  ],
})

import {  } from 'viem/utils'
import { , ,  } from 'viem/tempo'
import {  } from './viem.config'
 
const  = .('0x...')
const  = .(.(), {
  : ,
})
 
const  = await ..({
  ,
  ,
  : [
    {
      : '0x20c0000000000000000000000000000000000001',
      : .('10000', 6),
    },
  ],
  : [
    .('0x20c0000000000000000000000000000000000001')
      .({
        : ['0xcafebabecafebabecafebabecafebabecafebabe'],
      }),
  ],
})

import { ,  } from 'viem/tempo'
 
export const  = .({
  : .('0x...'),
})

Authorize Public Keys

Instead of passing an AccessKeyAccount, you can sign an authorization for a key by its public key or address directly:

import { ,  } from 'viem/tempo'
import {  } from './viem.config'
 
const  = .('0x...')
 
// Sign authorization by public key
const  = await ..({
  ,
  : {
    : '0x...',
    : 'p256',
  },
})

You can also sign by address:

import {  } from 'viem/tempo'
import {  } from './viem.config'
 
const  = .('0x...')
 
// Sign authorization by address
const  = await ..({
  ,
  : {
    : '0x...',
    : 'p256',
  },
})

Submitting the Authorization

The signed keyAuthorization can be attached to any write action.

// Authorize the key alongside a transfer, sent with the access key
const { receipt } = await client.token.transferSync({
  account: accessKey,
  token: '0x20c0000000000000000000000000000000000001',
  to: '0xcafebabecafebabecafebabecafebabecafebabe',
  amount: 100n,
  keyAuthorization,
})

Return Type

type ReturnType =
  | KeyAuthorization.Signed
  | (KeyAuthorization.Signed & {
      hash: Hex
      operation: AccountOperation.KeyAuthorizationOperation
      status: 'pending' | 'success'
    })

Local signing returns a signed key authorization that can be passed to any write action. Coordinated signing also returns the operation hash, status, and operation details. A successful result can be passed directly to any write action as its keyAuthorization.

Parameters

account

Type: RootAccount | ConfigurableAccount

The account authorizing the access key. For coordinated signing, pass the configurable account here.

accessKey

Type: { accessKeyAddress: Address; keyType: string } | { address: Address; type: string } | { publicKey: Hex; type: string }

The access key to authorize. Accepts an AccessKeyAccount, or an object with { address, type } or { publicKey, type }.

admin (optional)

Type: boolean

Whether to authorize the key as an admin key. Admin keys are unrestricted and can manage the account's other access keys; expiry, limits, and scopes are ignored. Requires the T6 hardfork (TIP-1049).

expiry (optional)

Type: number

Unix timestamp when the key expires.

hash

Type: Hex

The operation hash returned by the first coordinated approval. Pass it instead of the initial authorization fields when adding another owner approval.

limits (optional)

Type: { token: Address; limit: bigint; period?: number }[]

Spending limits per token. Optionally include period (in seconds) to make the limit periodic. It resets after each period.

owner

Type: RootAccount | ConfigurableAccount

The local owner adding a coordinated approval. Passing owner with a configurable account starts a coordinated operation. Later owners pass owner with the operation hash.

scopes (optional)

Type: { address: Address; selector?: Hex | string; recipients?: Address[] }[]

Call scopes restricting which contracts/selectors this key can call.

witness (optional)

Type: Hex

Optional 32-byte witness bound into the authorization's signing hash. Can be burned onchain via accessKey.burnWitness to invalidate the authorization before it is submitted (TIP-1053).

Suggest changes to this page