Struct KeylessAccount 

pub struct KeylessAccount { /* private fields */ }

Available on crate feature keyless only.

Account authenticated via OIDC.

Implementations

impl KeylessAccount

pub async fn from_jwt( jwt: &str, ephemeral_key: EphemeralKeyPair, pepper_service: &dyn PepperService, prover_service: &dyn ProverService, ) -> AptosResult<Self>

Creates a keyless account from an OIDC JWT token.

This method verifies the JWT signature using the OIDC provider’s JWKS endpoint before extracting claims and creating the account.

Network Requests

This method makes HTTP requests to:

• The OIDC provider’s JWKS endpoint to fetch signing keys
• The pepper service to obtain the pepper
• The prover service to generate a ZK proof

For more control over network calls and caching, use Self::from_jwt_with_jwks with pre-fetched JWKS.

Errors

This function will return an error if:

• The JWT signature verification fails
• The JWT cannot be decoded or is missing required claims (iss, aud, sub, nonce)
• The JWT nonce doesn’t match the ephemeral key’s nonce
• The JWT is expired
• The JWKS cannot be fetched from the provider (network timeout, DNS failure, connection errors, HTTP errors, or invalid JWKS response)
• The pepper service fails to return a pepper
• The prover service fails to generate a proof

pub async fn from_jwt_with_jwks( jwt: &str, jwks: &JwkSet, ephemeral_key: EphemeralKeyPair, pepper_service: &dyn PepperService, prover_service: &dyn ProverService, ) -> AptosResult<Self>

Creates a keyless account from a JWT with pre-fetched JWKS.

This method is useful when you want to:

• Cache the JWKS to avoid repeated network requests
• Have more control over HTTP client configuration
• Implement custom caching strategies based on HTTP cache headers

Errors

This function will return an error if:

• The JWT signature verification fails
• The JWT cannot be decoded or is missing required claims (iss, aud, sub, nonce)
• The JWT nonce doesn’t match the ephemeral key’s nonce
• The JWT is expired
• The pepper service fails to return a pepper
• The prover service fails to generate a proof

pub fn provider(&self) -> &OidcProvider

Returns the OIDC provider.

pub fn issuer(&self) -> &str

Returns the issuer.

pub fn audience(&self) -> &str

Returns the audience.

pub fn user_id(&self) -> &str

Returns the user identifier (sub claim).

pub fn proof(&self) -> &ZkProof

Returns the proof.

pub fn is_valid(&self) -> bool

Returns true if the account is still valid.

pub async fn refresh_proof( &mut self, jwt: &str, prover_service: &dyn ProverService, ) -> AptosResult<()>

Refreshes the proof using a new JWT.

This method verifies the JWT signature using the OIDC provider’s JWKS endpoint.

Network Requests

This method makes HTTP requests to fetch the JWKS from the OIDC provider. For more control over network calls and caching, use Self::refresh_proof_with_jwks.

Errors

Returns an error if:

• The JWKS cannot be fetched (network timeout, DNS failure, connection errors)
• The JWT signature verification fails
• The JWT cannot be decoded
• The JWT nonce does not match the ephemeral key
• The JWT identity does not match the account
• The prover service fails to generate a new proof

pub async fn refresh_proof_with_jwks( &mut self, jwt: &str, jwks: &JwkSet, prover_service: &dyn ProverService, ) -> AptosResult<()>

Refreshes the proof using a new JWT with pre-fetched JWKS.

This method is useful for caching the JWKS or using a custom HTTP client.

Errors

Returns an error if:

• The JWT signature verification fails
• The JWT cannot be decoded
• The JWT nonce does not match the ephemeral key
• The JWT identity does not match the account
• The prover service fails to generate a new proof

pub fn sign_keyless(&self, message: &[u8]) -> KeylessSignature

Signs a message and returns the structured keyless signature.

Trait Implementations

impl Account for KeylessAccount

fn address(&self) -> AccountAddress

Returns the account address.

fn authentication_key(&self) -> AuthenticationKey

Returns the authentication key.

fn sign(&self, message: &[u8]) -> AptosResult<Vec<u8>>

Signs a message and returns the signature bytes.

fn public_key_bytes(&self) -> Vec<u8>

Returns the public key bytes.

fn signature_scheme(&self) -> u8

Returns the scheme identifier for this account type.

impl Debug for KeylessAccount

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl From<KeylessAccount> for AnyAccount

fn from(account: KeylessAccount) -> Self

Converts to this type from the input type.