# `Provider` Creates a Provider that bootstraps account access from the terminal via the Wata device-code flow (OAuth 2.0 Device Authorization Grant, RFC 8628 with PKCE). When `wallet_connect` or `wallet_authorizeAccessKey` runs, the provider: * registers a device code at the configured `host` and opens the verification page in the user's default browser * prompts them to approve the access key * persists the resulting key in provider storage for re-use across CLI invocations Subsequent transaction signing happens locally with the managed key — no further browser round-trip is required until the key expires. ## Usage ```ts twoslash [cli.ts] import { Provider } from 'accounts/cli' const provider = Provider.create() ``` ### Authorizing an Access Key The CLI adapter requires `capabilities.authorizeAccessKey` on `wallet_connect` — the user must explicitly grant a scoped access key during the device-code ceremony. ```ts twoslash [cli.ts] // @noErrors import { Expiry } from 'accounts' import { Provider } from 'accounts/cli' import { parseUnits } from 'viem' import { connect } from 'viem/experimental/erc7846' const provider = Provider.create() const client = provider.getClient() await connect(client, { // [!code focus] capabilities: { // [!code focus] authorizeAccessKey: { // [!code focus] expiry: Expiry.days(7), // [!code focus] limits: [{ // [!code focus] token: '0x20c0000000000000000000000000000000000001', // [!code focus] limit: parseUnits('100', 6), // [!code focus] }], // [!code focus] scopes: [{ // [!code focus] address: '0x20c0000000000000000000000000000000000001', // [!code focus] selector: 'transfer(address,uint256)', // [!code focus] }], // [!code focus] }, // [!code focus] }, // [!code focus] }) // [!code focus] ``` ## Parameters ### auth * **Type:** `string | { url?: string; challenge?: string; verify?: string; logout?: string; returnToken?: boolean }` * **Optional** Default Server Authentication configuration for `wallet_connect`. See [`Provider.auth`](/docs/api/provider#auth) for full semantics. ```ts twoslash [cli.ts] import { Provider } from 'accounts/cli' const provider = Provider.create({ auth: '/auth', // [!code focus] }) ``` ### chains * **Type:** `readonly [Chain, ...Chain[]]` * **Default:** `[tempo, tempoModerato, tempoDevnet]` Supported chains. The first chain is the default. ```ts twoslash [cli.ts] import { Provider } from 'accounts/cli' import { tempo } from 'viem/tempo/chains' const provider = Provider.create({ chains: [tempo], // [!code focus] }) ``` ### feePayer * **Type:** `string | false | { url: string; precedence?: 'fee-payer-first' | 'user-first' }` * **Optional** Fee payer configuration. See [`Provider.feePayer`](/docs/api/provider#feepayer) for full semantics. ```ts twoslash [cli.ts] import { Provider } from 'accounts/cli' const provider = Provider.create({ feePayer: 'https://myapp.com/fee-payer', // [!code focus] }) ``` ### host * **Type:** `string` * **Default:** `'https://wallet.tempo.xyz/api/auth/device'` Base URL of the host's device-code endpoints. The CLI registers at `${host}/register`, opens the browser at `${host}/verify?user_code=`, and polls `${host}/token` for completion. Designed to point at a host mounting the [`wata`](https://github.com/wevm/wata) device-code transport. ```ts twoslash [cli.ts] import { Provider } from 'accounts/cli' const provider = Provider.create({ host: 'https://myapp.com/auth/device', // [!code focus] }) ``` ### maxAccounts * **Type:** `number` * **Optional** Maximum number of accounts to persist. Oldest accounts are evicted when exceeded (LRU). ```ts twoslash [cli.ts] import { Provider } from 'accounts/cli' const provider = Provider.create({ maxAccounts: 5, // [!code focus] }) ``` ### mpp * **Type:** `boolean | Provider.mpp.Options` * **Default:** `true` Enable [Machine Payment Protocol](https://mpp.dev) (mppx) support. Enabled by default — pass `false` to disable, or an options object to configure. :::info For CLI tools that need to control the payment mode, use `mpp: { mode: 'pull' }` so the CLI signs transactions locally and forwards the serialized payload to the server. ::: ```ts twoslash [cli.ts] import { Provider } from 'accounts/cli' const provider = Provider.create({ mpp: false, // [!code focus] }) ``` ```ts twoslash [cli.ts] import { Provider } from 'accounts/cli' const provider = Provider.create({ mpp: { // [!code focus] mode: 'pull', // [!code focus] }, // [!code focus] }) ``` ### name * **Type:** `string` * **Default:** `'Tempo CLI'` Display name of the provider. ```ts twoslash [cli.ts] import { Provider } from 'accounts/cli' const provider = Provider.create({ name: 'My CLI', // [!code focus] }) ``` ### open * **Type:** `(url: string, prompt: DeviceCode.Prompt) => Promise | void` * **Default:** `open`/`xdg-open`/`start` depending on platform Browser opener override. Useful for headless environments, CI, or to intercept the URL before opening (e.g. to print it to the terminal). The second argument carries the full pairing prompt (`userCode`, `verificationUri`, expiry, poll interval). ```ts twoslash [cli.ts] import { Provider } from 'accounts/cli' const provider = Provider.create({ open: (url, prompt) => { // [!code focus] console.log(`Open ${url} and confirm code ${prompt.userCode}.`) // [!code focus] }, // [!code focus] }) ``` ### persistCredentials * **Type:** `boolean` * **Default:** `true` Whether to persist credentials and access keys to storage. When `false`, only account addresses are persisted. ```ts twoslash [cli.ts] import { Provider } from 'accounts/cli' const provider = Provider.create({ persistCredentials: false, // [!code focus] }) ``` ### pollingInterval * **Type:** `number` * **Default:** the host-advertised `interval` (5000 when the host omits one) How often (in milliseconds) the CLI polls the device-code token endpoint while waiting for the user to approve the request in the browser. ```ts twoslash [cli.ts] import { Provider } from 'accounts/cli' const provider = Provider.create({ pollingInterval: 1000, // [!code focus] }) ``` ### rdns * **Type:** `string` * **Default:** `'xyz.tempo.cli'` Reverse DNS identifier. ```ts twoslash [cli.ts] import { Provider } from 'accounts/cli' const provider = Provider.create({ rdns: 'com.example.cli', // [!code focus] }) ``` ### relay * **Type:** `string` * **Optional** Base URL for a wallet relay endpoint. See [`Provider.relay`](/docs/api/provider#relay) for full semantics. ```ts twoslash [cli.ts] import { Provider } from 'accounts/cli' const provider = Provider.create({ relay: 'https://myapp.com/relay', // [!code focus] }) ``` ### storage * **Type:** `Storage` * **Default:** `Storage.filesystem({ path: '~/.tempo/wallet/store.json' })` Storage adapter for provider persistence. The CLI default stores connected accounts, active chain state, and managed access keys in one filesystem-backed provider store. ```ts twoslash [cli.ts] import { Provider, Storage } from 'accounts/cli' const provider = Provider.create({ storage: Storage.filesystem({ // [!code focus] path: '~/.config/myapp/tempo-store.json', // [!code focus] }), // [!code focus] }) ``` ### testnet * **Type:** `boolean` * **Default:** `false` Use testnet. When `true`, the default chain will be the first testnet chain in `chains`. ```ts twoslash [cli.ts] import { Provider } from 'accounts/cli' const provider = Provider.create({ testnet: true, // [!code focus] }) ``` ### timeout * **Type:** `number` * **Default:** `300000` (5 minutes) How long (in milliseconds) the CLI waits for the user to complete the device-code ceremony before throwing a timeout error. ```ts twoslash [cli.ts] import { Provider } from 'accounts/cli' const provider = Provider.create({ timeout: 60_000, // [!code focus] }) ``` ### transports * **Type:** `Record` * **Optional** Per-chain transports keyed by chain ID. Layered on top of `relay`. See [`Provider.transports`](/docs/api/provider#transports) for full semantics. ```ts twoslash [cli.ts] import { Provider } from 'accounts/cli' import { http } from 'viem' import { tempo } from 'viem/tempo/chains' const provider = Provider.create({ transports: { // [!code focus] [tempo.id]: http('https://myapp.com/relay/' + tempo.id), // [!code focus] }, // [!code focus] }) ```