Automated OpenKey + TinyCloud E2E testing

Use this pattern when a browser app signs in through OpenKey and TinyCloud, but an end-to-end test must run unattended—whether from an agent, CI, or a local automation loop. It replaces the human passkey ceremony with a test-only EIP-1193 wallet. The application still uses its production OpenKey external-wallet path, requests a real SIWE signature, and initializes TinyCloud normally. This is a browser-test technique, not an application authentication mode. Do not add a test private key, a bypass flag, or a mock signer to production app code.

What the bootstrap covers

The test account bootstrap has two boundaries:

Before navigation, Playwright installs a test-only wallet provider that can answer account, chain, and personal_sign requests.
After the test selects that wallet in OpenKey, the application performs its usual TinyCloud initialization. With autoCreateSpace: true, that creates the app space when needed. If the app uses encrypted data, its initializer must also create or reuse the owner’s encryption network.

The browser never creates an OpenKey passkey and the test never approves a passkey prompt. It still verifies the integration points that matter: OpenKey widget selection, wallet-backed signing, TinyCloud session setup, and an authorized read or write.

Bootstrap a test account

Install the wallet before page.goto(). The example uses a deterministic Anvil development key so the account is reproducible; it must be used only for test data and must never hold funds, production data, or reusable credentials.

import { expect, test, type Page } from "@playwright/test";
import { Wallet, utils } from "ethers";

const TEST_PRIVATE_KEY =
  "0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80";
const TEST_ADDRESS = "0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266";
const TEST_WALLET_NAME = "TinyCloud E2E Wallet";

function exposeTestShadowRoots() {
  return () => {
    const attachShadow = Element.prototype.attachShadow;
    Element.prototype.attachShadow = function (init: ShadowRootInit) {
      return attachShadow.call(this, { ...init, mode: "open" });
    };
  };
}

function installTestWallet() {
  return ({
    address,
    walletName,
  }: {
    address: string;
    walletName: string;
  }) => {
    const provider = {
      selectedAddress: address,
      chainId: "0x1",
      async request({
        method,
        params = [],
      }: {
        method: string;
        params?: unknown[];
      }) {
        switch (method) {
          case "eth_requestAccounts":
          case "eth_accounts":
            return [address];
          case "eth_chainId":
            return "0x1";
          case "personal_sign": {
            const message = params[0];
            if (typeof message !== "string")
              throw new Error("personal_sign missing message");
            return (window as any).__openkeyE2ESignMessage(message);
          }
          case "wallet_getPermissions":
          case "wallet_requestPermissions":
            return [{ parentCapability: "eth_accounts" }];
          default:
            return null;
        }
      },
      on: () => provider,
      removeListener: () => provider,
      isConnected: () => true,
    };

    const announce = () =>
      window.dispatchEvent(
        new CustomEvent("eip6963:announceProvider", {
          detail: {
            info: {
              uuid: "8fd9b04a-e8a0-4c43-9d87-5af504aa1f0d",
              name: walletName,
              icon: 'data:image/svg+xml,%3Csvg xmlns="http://www.w3.org/2000/svg"/%3E',
              rdns: "xyz.tinycloud.e2e-wallet",
            },
            provider,
          },
        }),
      );

    Object.defineProperty(window, "ethereum", {
      value: provider,
      configurable: true,
    });
    window.addEventListener("eip6963:requestProvider", announce);
    announce();
  };
}

async function bootstrapTestAccount(page: Page) {
  const wallet = new Wallet(TEST_PRIVATE_KEY);
  await page.exposeFunction("__openkeyE2ESignMessage", (message: string) => {
    return wallet.signMessage(
      message.startsWith("0x") ? utils.arrayify(message) : message,
    );
  });
  await page.addInitScript(exposeTestShadowRoots());
  await page.addInitScript(installTestWallet(), {
    address: TEST_ADDRESS,
    walletName: TEST_WALLET_NAME,
  });
}

exposeFunction() installs the signer before navigation and avoids depending on the order of multiple browser init scripts. addInitScript() then installs the provider before the application’s scripts, so OpenKey’s widget can discover it through EIP-6963. Opening shadow roots makes the widget’s wallet picker visible to Playwright; keep that behavior in the test only.

Drive the real application flow

Use your application’s existing OpenKey entry point and select the injected external wallet. The selectors below are from TinyCloud Secret Manager; replace the button selector with your app’s stable test id.

test("creates and reads a record through OpenKey", async ({ page }) => {
  await bootstrapTestAccount(page);

  await page.goto("/app");
  await page.getByTestId("connect-openkey").click();
  await page
    .frameLocator('iframe[src*="/widget/embed/connect"]')
    .getByText(/or use an external wallet/i)
    .click();
  await page.getByText(TEST_WALLET_NAME).click();

  // Assert your app's completion state only after its normal TinyCloud
  // initializer has signed in and provisioned the required account resources.
  await expect(page.getByTestId("network-decrypt-ready")).toBeVisible();

  // Exercise one useful app operation, then read it back and remove it.
});

For Secret Manager, its normal initializer calls signIn(), creates its secrets space when absent, then creates or reuses the owner-scoped default encryption network before marking the UI as decrypt-ready. Other applications should keep the same shape: bootstrap the signer in the test, but provision spaces, schemas, networks, and other account resources in the app’s normal initialization path.

Keep runs isolated

Use a dedicated test account and test-only resources. A deterministic key is public test infrastructure, not a secret.
Use a distinct app or space prefix for E2E data; do not point a test account at user-owned production records.
Delete every record the test creates, including after a retry when practical.
Run tests serially when they share a deterministic account, or derive a unique resource name from the Playwright worker and test run.
Do not live-test provider credentials in this flow. Use a syntactically valid dummy value and disable provider calls, unless the provider integration is explicitly the subject of the test.

When to use a mock instead

Use this account bootstrap when the behavior under test includes OpenKey widget integration, SIWE signing, TinyCloud provisioning, or authorization. Use a module mock for fast component tests and for error states that the real service cannot reliably produce. Keep at least one smoke test on this real path.

Quickstarts

Authentication and data

Collaboration and extensions

Automated OpenKey + TinyCloud E2E testing

What the bootstrap covers

Bootstrap a test account

Drive the real application flow

Keep runs isolated

When to use a mock instead

​What the bootstrap covers

​Bootstrap a test account

​Drive the real application flow

​Keep runs isolated

​When to use a mock instead

​Related pages

What the bootstrap covers

Bootstrap a test account

Drive the real application flow

Keep runs isolated

When to use a mock instead

Related pages