[grid] fix Global Account sandbox docs

[DhruvPareek]

Summary

• Fix the sandbox passkey verify curl example to echo the full Request:<uuid> header value.
• Remove the unused Request-Id header from the OAuth sandbox verify example.
• Update the scripts README to say the helper has four subcommands and clarify that bootstrap step 1.4 only issues the EMAIL_OTP challenge.
• Clarify the frontend sandbox comments: default sandbox mode uses legacy magic signatures as shortcuts, while production-shaped sandbox tests can use real decryptable bundles and stamps.

Validation

• npm run build in samples/frontend
• make build at the stack tip

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
grid-flow-builder	Ignored	Preview	Jun 10, 2026 6:38pm

[DhruvPareek]

• [grid] fix Global Account sandbox docs #567 👈 (View in Graphite)
• [grid] fix Global Account auth snippets #566
• [grid] fix passkey registration samples #565
• [grid] fix Global Account HPKE docs #564
• [grid] fix Global Account frontend auth sample #563
• [grid] clarify email OTP registration bundle docs #562
• [grid] fix passkey reauth challenge docs #561
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[greptile-apps]

Greptile Summary

Documentation-only fixes to the Global Account sandbox guides: corrects a malformed Request-Id header value in the passkey curl example, removes an inapplicable header from the OAuth example, fixes the subcommand count in the scripts README, and clarifies comment language in the frontend sample.

• sandbox-global-account-magic.mdx: Passkey Request-Id now echoes the full Request:<uuid> format; OAuth example no longer includes an unneeded Request-Id header.
• scripts/README.md: Subcommand count corrected to four (gen-keypair, encrypt-otp, decrypt-bundle, stamp); section 1.4 heading and body now accurately describe issuing the EMAIL_OTP challenge rather than completing the full verify.
• AuthenticateAndSign.tsx: Comments updated to distinguish the default sandbox shortcut path from a production-shaped sandbox test.

Confidence Score: 5/5

All three files contain only documentation and comment corrections — no logic, runtime behaviour, or data handling is touched.

Every change is a copy fix: a malformed header value corrected, a stale header removed, a wrong count updated, and comment wording tightened. None of the changes affect compiled code, API contracts, or runtime paths.

No files require special attention.

Important Files Changed

Filename	Overview
mintlify/snippets/sandbox-global-account-magic.mdx	Fixed two curl examples: added the Request: prefix to the passkey Request-Id header, and removed the unused Request-Id header from the OAuth verify example.
samples/frontend/src/steps/embeddedWallet/AuthenticateAndSign.tsx	Comment-only update clarifying that default sandbox mode uses intentional shortcuts, and that the wallet signature value is a legacy magic value.
scripts/README.md	Corrected subcommand count from three to four (matching gen-keypair, encrypt-otp, decrypt-bundle, stamp), and reworded section 1.4 to clarify the bootstrap step issues a challenge rather than performing a full verify.

Sequence Diagram

sequenceDiagram
    participant Client
    participant Grid as Grid API (Sandbox)

    Note over Client,Grid: Passkey verify (corrected docs)
    Client->>Grid: "POST /auth/credentials/{id}/challenge"
    Grid-->>Client: "{ requestId: "Request:uuid", challenge }"
    Client->>Grid: "POST /auth/credentials/{id}/verify + Request-Id: Request:uuid"
    Grid-->>Client: "{ encryptedSessionSigningKey }"

    Note over Client,Grid: OAuth verify (header removed from docs)
    Client->>Grid: "POST /auth/credentials/{id}/verify + { oidcToken, clientPublicKey }"
    Grid-->>Client: "{ encryptedSessionSigningKey }"

    Note over Client,Grid: scripts/README.md bootstrap (section 1.4)
    Client->>Grid: "POST /auth/credentials/{id}/challenge"
    Grid-->>Client: OTP email sent (sandbox: use 000000)

Loading

_{Reviews (4): Last reviewed commit: "[grid] fix Global Account sandbox docs" | Re-trigger Greptile}

[restamp-bot]

fce4599 is a pure rebase onto 7da0598. Approving based on @carsonp6's previous approval of dce3110.

[restamp-bot]

62b4494 is a pure rebase onto 460893f. Approving based on @carsonp6's previous approval of dce3110.

[restamp-bot]

c93756e is a pure rebase onto f856ba9. Approving based on @carsonp6's previous approval of dce3110.

[restamp-bot]

c93756e is a pure rebase onto f856ba9. Approving based on @carsonp6's previous approval of dce3110.

[restamp-bot]

01c6cc1 is a pure rebase onto 536a5ac. Approving based on @carsonp6's previous approval of dce3110.

[restamp-bot]

01c6cc1 is a pure rebase onto 536a5ac. Approving based on @carsonp6's previous approval of dce3110.

The base branch was changed.

[restamp-bot]

01c6cc1 is a pure rebase onto 536a5ac. Approving based on @carsonp6's previous approval of dce3110.

[restamp-bot]

979710e is a pure rebase onto 536a5ac. Approving based on @carsonp6's previous approval of dce3110.

[DhruvPareek]

Merge activity

• Jun 10, 6:40 PM UTC: @DhruvPareek merged this pull request with Graphite.