OZSignerManager

public final class OZSignerManager : OZManagerHelpers, @unchecked Sendable

Manager for signer operations on OpenZeppelin Smart Accounts.

Manages the signer set bound to a context rule. Supported signer kinds:

WebAuthn passkeys (secp256r1, verified through a verifier contract)
Delegated signers (G… accounts or C… contracts via require_auth)
Ed25519 signers (32-byte keys verified by a verifier contract)

All state-changing methods accept an optional selectedSigners list. An empty list routes through the single-signer path (connected passkey); a non-empty list routes through the multi-signer ceremony coordinator.

The manager itself performs no on-chain state mutation; effects flow through the kit’s transaction operations or the multi-signer submitter.

Example:

let result = try await kit.signerManager.addDelegated(
    contextRuleId: 0,
    address: "GA7QYNF7SOWQ..."
)

Show on GitHub

Add Signers (high-level)


                    
                    
                    addNewPasskeySigner(contextRuleId:userName:selectedSigners:forceMethod:)

Asynchronous

Registers a new WebAuthn passkey and adds it as a signer to a context rule.

Performs the full end-to-end flow of creating a new passkey via the platform’s WebAuthn API, persisting the credential locally as pending, emitting an credentialCreated(credential:) event, and adding the resulting public key as a signer on the smart-account contract. Use addPasskey(contextRuleId:publicKey:credentialId:selectedSigners:forceMethod:) directly when the credential identifier and public key are already in hand.

Flow:

Validates that a wallet is connected and a WebAuthnProvider is configured (either through the kit or the manager override).
Generates cryptographically secure random challenge and user-id buffers (32 bytes each) using OZWalletOperations/secureRandomData(count:).
Triggers the platform WebAuthn registration ceremony (biometric prompt). Failures from the provider are wrapped in RegistrationFailed.
Base64URL-encodes the credential id for local storage.
Persists the new credential through OZCredentialManagerProtocol/createPendingCredential(credentialId:publicKey:contractId:nickname:transports:deviceType:backedUp:).
Emits credentialCreated(credential:).
Adds the passkey signer on-chain by delegating to addPasskey(contextRuleId:publicKey:credentialId:selectedSigners:forceMethod:).

The on-chain addition step requires authorization from an existing signer on the supplied context rule. The user is therefore prompted for biometric authentication twice in single-signer mode: once for the new passkey registration and once for the existing signer to authorize the signer-addition transaction.

Throws

NotConnected when no wallet is connected; NotSupported when no WebAuthn provider is configured; WebAuthnException when the registration ceremony fails or the user cancels; SmartAccountCredentialException when credential storage fails; SmartAccountTransactionException when the on-chain signer addition fails.

Declaration

Swift

public func addNewPasskeySigner(
    contextRuleId: UInt32,
    userName: String,
    selectedSigners: [OZSelectedSigner] = [],
    forceMethod: OZSubmissionMethod? = nil
) async throws -> OZAddPasskeySignerResult

Parameters

`contextRuleId`	Context-rule identifier the new signer is being added to (zero is the default rule).
`userName`	User-friendly name for the new passkey (displayed by the authenticator).
`selectedSigners`	Optional list of signers participating in the on-chain authorization ceremony. Empty (default) routes through single-signer submission with the connected passkey credential.
`forceMethod`	Optional submission-method override.

Return Value

An OZAddPasskeySignerResult carrying the credential id, the public key, and the on-chain transaction outcome.

Show on GitHub


                    
                    
                    addPasskey(contextRuleId:publicKey:credentialId:selectedSigners:forceMethod:)

Asynchronous

Adds a WebAuthn passkey signer to a context rule.

Creates a WebAuthn external signer via webAuthn(verifierAddress:publicKey:credentialId:) and submits an add_signer invocation against the connected smart-account contract. The verifier address is sourced from webauthnVerifierAddress.

The on-chain transaction requires authorization from an existing signer on the specified context rule.

Contract call: smart_account.add_signer(context_rule_id, signer) -> u32. The assigned numeric id surfaces on signerIds once the rule is refetched.

Throws

SmartAccountValidationException for invalid input; SmartAccountWalletException for missing connection; SmartAccountTransactionException for submission failures.

Declaration

Swift

public func addPasskey(
    contextRuleId: UInt32,
    publicKey: Data,
    credentialId: Data,
    selectedSigners: [OZSelectedSigner] = [],
    forceMethod: OZSubmissionMethod? = nil
) async throws -> OZTransactionResult

Parameters

`contextRuleId`	Context-rule identifier the new signer is being added to.
`publicKey`	Uncompressed secp256r1 public key (`secp256r1PublicKeySize` bytes starting with `uncompressedPubkeyPrefix`).
`credentialId`	WebAuthn credential identifier bytes; must not be empty.
`selectedSigners`	Optional multi-signer participants list.
`forceMethod`	Optional submission-method override.

Return Value

An OZTransactionResult describing the on-chain outcome.

Show on GitHub


                    
                    
                    addDelegated(contextRuleId:address:selectedSigners:forceMethod:)

Asynchronous

Adds a delegated signer (Stellar account or contract) to a context rule.

Creates an OZDelegatedSigner that authorises through the host’s built-in require_auth mechanism and submits an add_signer invocation against the connected smart-account contract. The supplied address may be either a G… Stellar account or a C… contract strkey.

The on-chain transaction requires authorization from an existing signer on the specified context rule.

Throws

InvalidAddress when the address strkey is malformed; NotConnected when no wallet is connected; SmartAccountTransactionException for submission failures.

Declaration

Swift

public func addDelegated(
    contextRuleId: UInt32,
    address: String,
    selectedSigners: [OZSelectedSigner] = [],
    forceMethod: OZSubmissionMethod? = nil
) async throws -> OZTransactionResult

Parameters

`contextRuleId`	Context-rule identifier the new signer is being added to.
`address`	Stellar account (`G…`) or contract (`C…`) strkey.
`selectedSigners`	Optional multi-signer participants list.
`forceMethod`	Optional submission-method override.

Return Value

An OZTransactionResult describing the on-chain outcome.

Show on GitHub


                    
                    
                    addEd25519(contextRuleId:verifierAddress:publicKey:selectedSigners:forceMethod:)

Asynchronous

Adds an Ed25519 signer to a context rule.

Creates an OZExternalSigner configured for Ed25519 verification via the supplied verifier-contract address and submits an add_signer invocation against the connected smart-account contract. The public key must be the canonical 32-byte Ed25519 encoding.

The on-chain transaction requires authorization from an existing signer on the specified context rule.

Throws

SmartAccountValidationException for invalid input; NotConnected when no wallet is connected; SmartAccountTransactionException for submission failures.

Declaration

Swift

public func addEd25519(
    contextRuleId: UInt32,
    verifierAddress: String,
    publicKey: Data,
    selectedSigners: [OZSelectedSigner] = [],
    forceMethod: OZSubmissionMethod? = nil
) async throws -> OZTransactionResult

Parameters

`contextRuleId`	Context-rule identifier the new signer is being added to.
`verifierAddress`	Verifier contract address (`C…` strkey).
`publicKey`	Ed25519 public key (`ed25519PublicKeySize` bytes).
`selectedSigners`	Optional multi-signer participants list.
`forceMethod`	Optional submission-method override.

Return Value

An OZTransactionResult describing the on-chain outcome.

Show on GitHub

Remove Signer


                    
                    
                    removeSigner(contextRuleId:signerId:selectedSigners:forceMethod:)

Asynchronous

Removes a signer from a context rule by its on-chain numeric id.

The id is assigned by the smart-account contract when the signer is added and surfaces on signerIds after the rule is fetched. Use removeSignerBySigner(contextRuleId:signer:selectedSigners:forceMethod:) when only the signer value is known — that overload performs one extra RPC round trip to resolve the id internally.

Important

A context rule cannot have its last signer removed unless the rule has policies that supply authorization. The smart-account contract rejects the removal (contract error NoSignersAndPolicies, code 3004) if the last signer is removed with no policies configured.

Contract call: smart_account.remove_signer(context_rule_id, signer_id).

Throws

NotConnected when no wallet is connected; SmartAccountTransactionException for submission failures.

Declaration

Swift

public func removeSigner(
    contextRuleId: UInt32,
    signerId: UInt32,
    selectedSigners: [OZSelectedSigner] = [],
    forceMethod: OZSubmissionMethod? = nil
) async throws -> OZTransactionResult

Parameters

`contextRuleId`	Context-rule identifier the signer is being removed from.
`signerId`	Numeric signer identifier assigned at addition time.
`selectedSigners`	Optional multi-signer participants list.
`forceMethod`	Optional submission-method override.

Return Value

An OZTransactionResult describing the on-chain outcome.

Show on GitHub


                    
                    
                    removeSignerBySigner(contextRuleId:signer:selectedSigners:forceMethod:)

Asynchronous

Removes a signer from a context rule by matching the signer value.

Convenience overload that resolves the on-chain numeric signer id internally before delegating to removeSigner(contextRuleId:signerId:selectedSigners:forceMethod:). Fetches the target context rule (single RPC call), parses it through the kit’s context-rule parser, locates the signer by equality, and uses the positionally-aligned identifier.

Throws

NotConnected when no wallet is connected; SmartAccountValidationException when the signer is not found on the supplied rule or the rule’s signers and signerIds arrays are misaligned; SmartAccountConfigurationException when the manager was constructed without a context-rule parser; SmartAccountTransactionException for simulation, signing, or submission failures.

Note

The Swift name differs from the underlying contract method to distinguish this overload at the call site from the id-based removeSigner(contextRuleId:signerId:selectedSigners:forceMethod:). The BySigner suffix keeps the call site self-documenting.

Declaration

Swift

public func removeSignerBySigner(
    contextRuleId: UInt32,
    signer: any OZSmartAccountSigner,
    selectedSigners: [OZSelectedSigner] = [],
    forceMethod: OZSubmissionMethod? = nil
) async throws -> OZTransactionResult

Parameters

`contextRuleId`	Context-rule identifier the signer is being removed from.
`signer`	The signer value to match against the rule’s signer list.
`selectedSigners`	Optional multi-signer participants list.
`forceMethod`	Optional submission-method override.

Return Value

An OZTransactionResult describing the on-chain outcome.

Show on GitHub