ReadonlyapprovalNegotiated approval format: bareGrant or signedApprovalV1.
ReadonlybaseBase HTTP relay inbox URL used by this auth request.
ReadonlycapabilitiesCapabilities requested by the application.
ReadonlyclientApplication identifier shown in the user's grant/session list.
ReadonlyclientPublic key for the Proof-of-Possession client created by the application.
ReadonlyephemeralThe 32-byte ephemeral HPKE public key from epk, or undefined
for a shared-secret link. The relay channel ID is the unpadded
base64url encoding of BLAKE3("pubky-grant-relay-channel-v1" || 0x00 || epk),
where || concatenates bytes and epk is the raw 32-byte public key.
ReadonlysecretShared relay secret, or undefined for an HPKE link.
Keep this secret confidential until the flow completes or is abandoned.
ReadonlyxOptional x-callback-url metadata carried by this deep link.
Serialize this parsed deeplink back to its URL form.
Staticparse
Parsed grant-based signin deeplink.
This is useful for tools, tests, and signer UIs that need to inspect a
pubky://signin-grantauthorization URL before approving it.