<!-- tempo-docs-context -->
> Source: [/docs/zones/connect](https://tempo.xyz/developers/docs/zones/connect.md)
> Section: [Zones](https://tempo.xyz/developers/docs/zones.md). Connect to a Zone and work with private balances, deposits, and withdrawals. Zones is in limited preview; see the introduction for access. Earlier testnet sandbox guides describe a separate integration.
> [Documentation index](https://tempo.xyz/developers/llms.txt) · [Docs skill](https://tempo.xyz/developers/SKILL.md)

> Tempo MCP: Use `search`, `find_pages`, `read_page`, and `code` at `https://mcp.tempo.xyz` for Tempo and related documentation.
> If an indexed page is missing or reflects an older site, read this site’s [documentation index](https://tempo.xyz/developers/llms.txt) and Markdown pages directly.

<span id="connect-to-a-zone" />

# Connect

Start with access to a specific Zone deployment. Get its configuration from the operator or [contact Tempo](https://tempo.xyz/contact). A Zone uses its own network and chain ID; it is not a privacy setting on a public Tempo account.

<span id="confirm-the-integration-interfaces" />

[Try the connection demo](https://tempo.xyz/developers/docs/guide/private-zones/connect-to-a-zone) with test funds. It uses the earlier sandbox interface.

## Get connection details

Keep three controls separate when working with the Zone operator or your wallet provider:

| Control | Confirm before integrating |
| --- | --- |
| **Signing authority** | Which account keys or provider interface sign deposits and withdrawals. |
| **Read access** | Which credentials let your application read balances and activity, and which accounts they expose. |
| **Funding rules** | Which assets, depositors, withdrawal recipients, and callbacks the deployment permits. |

An RPC connection alone does not establish all three. If you use a hosted provider, confirm its authentication and data-scoping rules. The flow below uses the account-scoped, redacted Zone RPC; operator RPC is a separate interface.

## Configure the Zone connection

::::steps
### Get the deployment details

Ask for the RPC endpoint, chain ID, portal address, enabled assets, supported SDK or contract interfaces, and endpoint access credentials. Confirm the rules for depositors, withdrawal recipients, refunds, and callbacks.

<span id="authenticate-the-account" />

<span id="authenticate-rpc-requests" />

### Authorize access

For account-scoped Zone RPC, sign an authorization token with the account key and send it in the `X-Authorization-Token` header on every request. This token authenticates RPC requests; it does not replace signatures on transactions or credentials required to reach the endpoint.

With Viem, use your application's [Tempo account signer](https://tempo.xyz/developers/docs/accounts/keys) and the [Zone chain configuration](https://tempo.xyz/developers/docs/zones/examples). Set `ZONE_ID` to the operator-provided Zone ID. This signs locally; it does not submit a transaction.

```ts [Viem]
import { createClient } from 'viem/tempo'
import { zoneChain } from './zone.config'
const client = createClient({ account, chain: zoneChain })
const { token } = await client.zone.signAuthorizationToken({
  zoneId: Number(process.env.ZONE_ID),
  expiresAt: Math.floor(Date.now() / 1000) + 3600,
})
```

Use the returned `token` as `ZONE_AUTH_TOKEN`. Keep it private and renew it before expiry. Other signers must follow the [authorization token format](https://tempo.xyz/developers/docs/protocol/zones/rpc#authorization-tokens); confirm the operator's maximum lifetime.

<span id="confirm-the-network" />

### Check the connection

Set `ZONE_RPC_URL` to the deployment's endpoint and `ZONE_AUTH_TOKEN` to the signed token. TypeScript uses `viem` (`pnpm add viem`); Python uses `requests` (`pip install requests`). CLI examples use [Foundry](https://tempo.xyz/developers/docs/sdk/foundry). These examples run on your backend. Wagmi uses its core actions with the [authenticated Zone config](https://tempo.xyz/developers/docs/zones/examples); keep shared operator credentials out of browser code.

:::code-group
```ts [Viem]
import { createPublicClient, http } from 'viem'
import { tempoActions } from 'viem/tempo'
const zone = createPublicClient({
  transport: http(process.env.ZONE_RPC_URL, {
    fetchOptions: { headers: { 'X-Authorization-Token': process.env.ZONE_AUTH_TOKEN! } },
  }),
}).extend(tempoActions())
console.log(await zone.getChainId())
```

```ts [Wagmi]
import { getPublicClient } from '@wagmi/core'
import { zoneConfig } from './zone.config'
const chainId = await getPublicClient(zoneConfig)!.getChainId()
```

```python [Python]
import os, requests
zone_rpc_url = os.environ["ZONE_RPC_URL"]
zone = requests.Session()
zone.headers["X-Authorization-Token"] = os.environ["ZONE_AUTH_TOKEN"]
response = zone.post(zone_rpc_url, json={
    "jsonrpc": "2.0", "id": 1, "method": "eth_chainId", "params": []
})
response.raise_for_status()
print(response.json())
```

```bash [CLI]
cast chain-id --rpc-url "$ZONE_RPC_URL" \
  --rpc-headers "X-Authorization-Token: $ZONE_AUTH_TOKEN"
```
:::

Reuse `zone` in the TypeScript and Python [balance examples](https://tempo.xyz/developers/docs/zones/balances). For raw RPC responses, check for an `error` before using `result`; a successful HTTP request can contain a JSON-RPC error.

Compare the returned chain ID with the operator-provided configuration. Keep separate clients for public Tempo and the Zone. Use the correct chain ID when preparing signatures and calls.
::::

## Check supported operations

The current permissioned runtime restricts token movement to the inbox and outbox; general TIP-20 transfer calls and user contract deployment are disabled. Check the [execution rules](https://tempo.xyz/developers/docs/protocol/zones/execution) and deployment configuration before moving an existing application into a Zone.

The [testnet sandbox](https://tempo.xyz/developers/docs/guide/private-zones) uses earlier interfaces and supports operations that the current permissioned runtime does not enable. Use its guides only with the named sandbox deployment.

Continue with [Deposit](https://tempo.xyz/developers/docs/zones/deposit), then [read the private balance](https://tempo.xyz/developers/docs/zones/balances).