Various code cleanup/minor bug fixes/readme improvemnets #67

amircheikh · 2025-10-28T20:22:26Z

Cleanup and various fixes for sdk_flutter and demo app.

New features:

signMessage method added. Signs a plaintext message using the specified wallet account. Automatically determines the payload encoding and hash function based on the wallet account's address format, unless explicitly overridden
autoFetchWalletKitConfig can now be disabled in the TurnkeyProvider config
PasskeyConfig is now configurable in the TurnkeyProvider config. This allows you to set an rpId and rpName for all functions that need them
createClient and createPasskeyClient functions are now exposed
fetchOrCreateP256ApiKeyUser method added. Fetches an existing user by P-256 API key public key, or creates a new one if none exists.
fetchOrCreatePolicies method added. Fetches each requested policy if it exists, or creates it if it does not.

Bug fixes / minor improvements:

authProxyBaseUrl is now properly defaulted
sessionExpirationSeconds is now properly considered for passkey auth
handleAppleOauth now correctly uses Turnkey's OAuth Proxy url
Flutter lint-ing suggestions are solved in demo app
Various code + comment cleanup

…r oauth

moeodeh3

one big organizational note - Flutter/Dart supports a feature similar to Swift where you can define a single class across multiple files (via extension). If we can logically split things up instead of keeping everything in one large turnkey.dart file, that would be awesome

I'd recommend taking a look at our Swift SDK setup seen here - it’s a bit of a hassle to organize initially, but it improves readability a lot and I think this is worth it

moeodeh3 · 2025-11-13T14:09:21Z

examples/flutter-demo-app/README.md

-npm run build
-npm start
-```
+You can find your `ORGANIZATION_ID` and `AUTH_PROXY_CONFIG_ID` from the [Turnkey Dashboard](https://app.turnkey.com).


should link to this guide: https://docs.turnkey.com/getting-started/quickstart#create-an-account

moeodeh3 · 2025-11-13T14:12:57Z

examples/flutter-demo-app/lib/main.dart

+          ),
+          body: LoginScreen(),
+        );
+      // We'll have the `onSessionSelected` callback navigate to the dashboard screen. You can also add another case here for AuthState.authenticated if you want to handle it directly.


this feels a bit odd to me - I think we should just exhaust the switch statement and handle every AuthState, rather than relying on onSessionSelected here to take us to the dashboard screen

moeodeh3 · 2025-11-13T14:26:42Z

packages/sdk-flutter/lib/src/turnkey.dart

    }

-    final usingAuthProxy = (config.authProxyConfigId ?? '').isNotEmpty;
+    final usingAuthProxy = (config.authProxyConfigId ?? '').isNotEmpty &&


nit: this no longer tells us if they are just using authProxy, but instead tells us if they are using it and have the wallet-kit fetch enabled, so I think lets rename this

usingAuthProxy -> authProxyFetchEnabled

moeodeh3 · 2025-11-13T14:33:41Z

packages/sdk-flutter/lib/src/turnkey.dart

+    final usingAuthProxy = (config.authProxyConfigId ?? '').isNotEmpty &&
+        config.authConfig?.autoFetchWalletKitConfig == true;
    if (usingAuthProxy) {
      if (config.authConfig?.sessionExpirationSeconds != null) {


design choice: I know this was copied from JS, but in Swift we decided not to allow passing sessionExpirationSeconds in the config because:

the console warning is misleading, this value is only used for Passkeys (and wallets in JS)

it creates confusion for users who don’t have deep Turnkey infrastructure knowledge, since it’s unclear that it only applies to certain auth methods and is ignored for most

instead we removed it from the general config and require it to be passed directly into the relevant auth functions (e.g. loginWithPasskey())

this is one of the breaking changes I plan on making for js! So lets get ahead of it here

Don't think thats necessary, I think the warning is sufficient and it provides clarity on the frontend what your auth proxy config is if you ever need to access it in the app.

moeodeh3 · 2025-11-13T14:36:47Z

packages/sdk-flutter/lib/src/turnkey.dart

+                : config.authConfig?.sessionExpirationSeconds ??
+                    AUTH_DEFAULT_EXPIRATION_SECONDS);

    final otpAlphanumeric = proxyAuthConfig?.otpAlphanumeric ??


okay having otpAlphanumeric is useless I think in our mobile sdks?

In js we do this I think because we have UI components, and if someone wanted to use the authProxy with our UI components without having to fetch for wallet-kit config, they can

here that doesn't apple and I think there is literally no point of having this?

looking deeper here, we have a lot of stuff blindly copied over thats useless and cluttering our config. Can you copy what we do in swift seen here instead

while you're at it, want to also rename:

masterConfig -> runtimeConfig

The config includes everything for clarity, that way you don't have to query the auth proxy when you wan't to figure out what config it's running. It's also only clutter if you try to set it, which it specifically tells you not to...

moeodeh3 · 2025-11-13T15:07:12Z

packages/sdk-flutter/lib/src/turnkey.dart


    session = s;
-    _createClient(
+    createClient(


we also need to pass in authProxyId and authProxyUrl here so the client can make requests to the Auth Proxy. For example, an authenticated user might need to call the Auth Proxy when updating their email and keeping it verified - they’d use it to send and verify the OTP

can you check all createClient() calls and make sure they all have this passed in!

oh nvm our createClient() helper already does this I think?

Pulls from masterConfig

moeodeh3 · 2025-11-13T15:26:26Z

packages/sdk-flutter/lib/src/turnkey.dart

    bool? invalidateExisting,
-    void Function(String oidcToken)? onSuccess,
+    String? publicKey,
+    void Function(


one thing to flag is our onSuccess() in js returns any, I don't think this matters though

moeodeh3 · 2025-11-13T15:41:52Z

packages/sdk-flutter/lib/src/turnkey_helpers.dart

+
+String toUtf8String(Uint8List bytes) => utf8.decode(bytes);
+
+String bytesToHex(Uint8List bytes) {


I think we can remove this and use uint8ArrayToHexString() from turnkey_encoding

moeodeh3 · 2025-11-13T15:46:39Z

packages/sdk-flutter/lib/src/types.dart

+  const CreateP256UserParams({this.userName, this.apiKeyName});
+}
+
+class PolicyWithId extends v1CreatePolicyIntentV3 {


Policies have ids, its just in our fetchOrCreatePolicies() we basically have a v1Policy minus the created_at and updated_at timestamps, and we don't want to have to do another query to get those, so we just created another type

anyways I think we should call this just Policy

Here's to assuming this isn't breaking 🍻

net new function so we are okay!

moeodeh3 · 2025-11-13T15:50:53Z

packages/sdk-flutter/lib/src/turnkey.dart

+  /// [invalidateExisting] Optional flag to invalidate existing sessions when logging in or signing up.
+  /// [publicKey] Optional public key to use for the session. If null, a new key pair is generated.
+  /// [onSuccess] Optional callback function that receives the oidcToken, publicKey and providerName upon successful authentication, overrides default behavior.
  Future<void> handleXOAuth({


can we fix state validation here, we have state isn't acting as state. Lets do this for OAuth2 functions (X, Discord)

you can look at what we do here in Swift

…, made oauth state useful

…ed uneeded params from dev facing config

moeodeh3 · 2025-11-14T17:38:11Z

examples/flutter-demo-app/lib/main.dart

+          ),
+          body: LoginScreen(),
+        );
+      // We'll have the `onSessionSelected` callback navigate to the dashboard screen. You can also add another case here for AuthState.authenticated if you want to handle it directly.


no need for this anymore

you should be able to remove the onSessionSelected() from the example as well!

void onSessionSelected(Session session) { if (isValidSession(session)) { WidgetsBinding.instance.addPostFrameCallback((_) { navigatorKey.currentState?.pushReplacement( MaterialPageRoute(builder: (context) => const DashboardScreen()), ); final ctx = navigatorKey.currentContext; if (ctx != null) { ScaffoldMessenger.of(ctx).showSnackBar( const SnackBar( content: Text('Logged in! Redirecting to the dashboard.'), ), ); } }); } }

Nah that just shows a loading bar now when we are authenticated but we haven't heard from the onSessionSelected callback so we don't flash the login screen.

moeodeh3 · 2025-11-14T17:46:44Z

packages/sdk-flutter/lib/src/turnkey.dart

+  /// [rpId] The Relying Party ID to use for Passkey authentication. If null, the value from the config's PasskeyStamperConfig will be used.
+  /// [overrideExisting] Whether to override the existing client instance with the newly created one. If true, all helper functions within the TurnkeyProvider will be using this client and thus, will be stamping using a passkey. Defaults to false.
+  /// Returns the newly created TurnkeyClient instance configured for Passkey stamping.
+  TurnkeyClient createPasskeyClient(


can we move all the passkey stuff into its own extension as well 🙏

moeodeh3 · 2025-11-14T17:52:23Z

packages/sdk-flutter/lib/src/turnkey.dart

-    }
-
    // --- resolved methods ------------------------------------------------------
    final resolvedMethods = AuthMethods(


we can remove this

…nent

Various code cleanup/minor bug fixes/readme improvemnets

101ac29

amircheikh force-pushed the amir/v1-cleanup branch from 6495095 to 101ac29 Compare October 28, 2025 21:15

amircheikh added 2 commits October 30, 2025 11:27

Added delegated access helpers

aaee0bb

feat: Added authstate, disabling auto-refresh and better onSuccess fo…

a6345d8

…r oauth

amircheikh requested a review from moeodeh3 November 11, 2025 21:55

moeodeh3 reviewed Nov 13, 2025

View reviewed changes

ethankonk added 2 commits November 13, 2025 18:02

fixed comments, separated out all context methods into extended files…

c1f9e24

…, made oauth state useful

resolved extra comments, changed masterConfig to runtimeConfig, remov…

c03e7c4

…ed uneeded params from dev facing config

moeodeh3 reviewed Nov 14, 2025

View reviewed changes

ethankonk added 2 commits November 14, 2025 14:17

put passkeys in their own file

d49f0cc

removed resolved methods, not needed since we dont have an auth compo…

7321a24

…nent

moeodeh3 approved these changes Nov 14, 2025

View reviewed changes

moeodeh3 merged commit ea6e18a into main Nov 14, 2025
2 checks passed


		String toUtf8String(Uint8List bytes) => utf8.decode(bytes);

		String bytesToHex(Uint8List bytes) {

Various code cleanup/minor bug fixes/readme improvemnets #67

Various code cleanup/minor bug fixes/readme improvemnets #67

Uh oh!

Conversation

amircheikh commented Oct 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

moeodeh3 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

amircheikh commented Oct 28, 2025 •

edited

Loading