docs: update auth signed retry examples#477
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This stack of pull requests is managed by Graphite. Learn more about stacking. |
Greptile SummaryThis PR updates auth signed-retry documentation examples across MDX snippets and OpenAPI specs, replacing placeholder base64 payloads and bare-UUID request IDs with realistic Turnkey activity JSON payloads and
Confidence Score: 5/5All changes are documentation and example values only — no functional code paths are touched. Every changed line is an example payload, a header value in a curl snippet, or a shell line-continuation fix. The Turnkey activity JSON examples are internally consistent across MDX snippets and OpenAPI specs, the requestId format is uniformly updated to Request:, and the generated bundles match the source changes. The curl continuation fix in exporting-wallet.mdx corrects a real copy-paste failure that would have broken the example for readers. No files require special attention.
|
| Filename | Overview |
|---|---|
| mintlify/snippets/global-accounts/exporting-wallet.mdx | Fixed missing backslash line continuation in first curl call; updated payloadToSign and requestId examples to Turnkey format. |
| mintlify/snippets/global-accounts/authentication.mdx | Updated requestId format note, payloadToSign examples (EMAIL_OTP, PASSKEY) and Request-Id header values to use Request: and Turnkey activity payloads. |
| mintlify/snippets/global-accounts/managing-sessions.mdx | Updated payloadToSign and requestId examples for session revocation to use Turnkey ACTIVITY_TYPE_DELETE_API_KEYS format. |
| openapi/components/schemas/common/SignedRequestChallenge.yaml | Updated payloadToSign example from opaque base64 to generic Turnkey activity JSON placeholder. |
| openapi/paths/auth/auth_credentials.yaml | Updated payloadToSign examples for EMAIL_OTP, OAUTH, and PASSKEY credential challenges to canonical Turnkey activity payloads. |
| openapi/paths/customers/customers_{customerId}.yaml | Updated payloadToSign example for embedded wallet email update challenge to Turnkey ACTIVITY_TYPE_UPDATE_USER_EMAIL format. |
| openapi/paths/internal_accounts/internal_accounts_{id}.yaml | Updated payloadToSign example for internal account update challenge to ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2 Turnkey format. |
| openapi.yaml | Generated bundle — identical diff to mintlify/openapi.yaml, correctly produced by make build from updated source files. |
| mintlify/openapi.yaml | Generated bundle — mirrors changes from openapi/ source files after make build. |
Sequence Diagram
sequenceDiagram
participant C as Client
participant IB as Integrator Backend
participant G as Grid API
participant TK as Turnkey
IB->>G: "POST /internal-accounts/{id}/export { clientPublicKey }"
G-->>IB: "202 { payloadToSign (Turnkey JSON), requestId: Request:<uuid>, expiresAt }"
IB-->>C: "{ payloadToSign, requestId }"
C->>TK: stamp(payloadToSign, sessionPrivateKey)
TK-->>C: base64url-encoded stamp
C->>IB: "{ stamp }"
IB->>G: "POST /internal-accounts/{id}/export { clientPublicKey } + Grid-Wallet-Signature + Request-Id"
G-->>IB: "200 { id, encryptedWalletCredentials }"
IB-->>C: "{ encryptedWalletCredentials }"
C->>C: decrypt with client private key → mnemonic
Reviews (3): Last reviewed commit: "docs: update auth signed retry examples" | Re-trigger Greptile
c5dd101 to
9f62ede
Compare
45c22f7 to
4ff54fa
Compare
✱ Stainless preview builds for gridThis PR will update the cli csharp go kotlin openapi php python ruby typescript
|
4ff54fa to
e2cb685
Compare
9f62ede to
bd0067a
Compare
e2cb685 to
51d5493
Compare
bd0067a to
36bc92e
Compare
51d5493 to
f47f026
Compare
36bc92e to
b8de8b4
Compare
Show Request:<uuid> request IDs and canonical compact JSON payloadToSign examples for credential add/revoke, wallet export, and session revocation. Also fixes the export curl continuation while updating that snippet.
b8de8b4 to
1f8fc66
Compare
## Summary - Update Global Accounts sandbox docs to explain that OAuth no longer uses the fixed `sandbox-valid-oidc-token` value. - Document the sandbox OIDC token requirements: JWT-shaped token, supported issuer, `aud`/`sub`, fresh `iat`/`exp`, stored `iss`/`aud`/`sub` identity matching, and `nonce = sha256(clientPublicKey)` on verify. - Clarify that sandbox can use supported-provider ID tokens, while unsigned JWT-shaped tokens are only a sandbox test-token option. - Update the auth OpenAPI descriptions and rebuild the bundled `openapi.yaml` and `mintlify/openapi.yaml`. ## Stack - Base docs stack: #476 -> #477 -> #479 -> #481. - This PR is the first sandbox-auth docs PR on top of that auth cleanup stack. - Follow-up: #489 adds the sandbox email OTP inbox endpoint docs. ## Context This matches the Grid behavior from the OIDC auth-method identity stack: - `dp/grid-oidc-auth-method-identity` - `dp/grid-realistic-oidc-sandbox` - `dp/grid-verify-oauth-oidc-identity` The important customer-facing change is that sandbox no longer accepts a fixed OAuth magic token. It validates the same identity/freshness shape integrators need in production, while still skipping real IdP signature verification in the mock Turnkey path. ## Test Plan - `npm run lint`

Summary
Request:<uuid>request IDs.payloadToSignexamples with canonical compact JSON Turnkey activity payloads.Test Plan
make buildgit diff --checkrgscan for stale base64 payloads, bare UUIDRequest-Idheaders, and old signed-retry payload shapes.