@tempoxyz/id

Tempo ID

Auth and identity provider for Tempo.

Overview

Tempo ID provides one sign-in for every Tempo app. It issues each user an access token for offchain Tempo APIs and an access key for onchain Tempo actions.

• One sign-in: Users have one identity and one session across Tempo apps.
• Any Tempo app: Web, mobile, and CLI apps sign in through standard OAuth 2.0 and OpenID Connect, or through a headless API behind their own UI.
• Any Tempo API: Access tokens are standard JWTs that any API verifies against Tempo ID's signing keys.
• Use Tempo chain: Each user receives a Tempo Account, a configurable account that signs transactions on the Tempo chain.

The docs explain how Tempo ID works, and how apps and APIs build on it. The earlier WorkOS implementation stays on the workos-poc branch, and .agents/plans/rewrite.md holds the plan of the rewrite.

Architecture

flowchart LR
  Apps["Apps"]
  APIs["APIs"]
  ID["Tempo ID<br/>id.tempo.xyz"]
  DB[("Postgres")]
  Privy["Privy"]
  Chain["Tempo chain"]
  Apps -->|1 Sign in| ID
  ID -->|2 Users, sessions, and grants| DB
  ID -->|3 Token for Privy| Privy
  Privy -->|4 Owner signature| ID
  ID -->|5 Access token and access key| Apps
  Apps -->|6a Access token| APIs
  Apps -->|6b Access key| Chain
  APIs -->|Signing keys| ID

The architecture describes each component, and the data model shows each table.

Usage

Tempo ID is one package, @tempoxyz/id. An app calls Tempo's deployment, or runs its own in its own Cloudflare account.

Hosted

Tempo runs Tempo ID at https://id.tempo.xyz, and its development deployment at https://id.tehq.dev. A JavaScript app signs in through the client entry:

import { Actions, Auth } from '@tempoxyz/id/client'

const auth = Auth.create({ clientId: 'client_…' })
await Actions.email.sendCode(auth, { email: '[e-mail]' })

The client docs cover setup and each sign-in flow.

Self-hosted

A deployment is a Cloudflare Worker that runs Tempo ID through App.create, with Postgres as its store. The tempo-id CLI writes one:

npx tempo-id init my-id --from "Tempo ID <[e-mail]>" --url https://id.example.com

Self-hosting describes the database, secrets, migrations, and deploys.

Development

pnpm i             # install dependencies
pnpm dev           # start Tempo ID and the playgrounds on OrbStack
pnpm dev:app       # serve the app from src/app with Void, with HMR and the email inbox
pnpm dev:id        # build the app, and serve apps/id with wrangler dev
pnpm build         # build the package and the app
pnpm check         # format and lint
pnpm check:types   # type-check
pnpm test          # run the integration suite against apps/id
pnpm tempo-id      # run the CLI from source

The development docs cover setup, tests, and deploys. playgrounds/ holds one app per flow.