# `Pkcs11ex.PIN`
[🔗](https://github.com/utaladriz/pkcs11ex/blob/v0.1.0/lib/pkcs11ex/pin.ex#L1)

PIN-handling helpers.

See `docs/specs/specs.md` §5.2 for the layered PIN model. The library's
primary API for PIN material is the per-slot `:pin_callback` config; this
module provides convenience helpers for one-shot scripts and tests where
registering a callback is overkill.

# `with_pin`

```elixir
@spec with_pin(atom(), binary(), (-> result)) :: result | {:error, term()}
when result: any()
```

Run `fun` with a slot logged in via `pin`, then log out.

Useful for scripts and tests where a registered `:pin_callback` isn't
appropriate. The PIN binary is passed once into `Pkcs11ex.Slot.login/2`,
which immediately forwards it to the NIF; it's not retained in any
GenServer state.

    Pkcs11ex.PIN.with_pin(:legal_proxy, System.get_env("TOKEN_PIN"), fn ->
      {:ok, jws} = SignCore.JWS.sign(payload,
        # ... slot-aware sign opts (Phase 2 step 3 will route via :signer)
      )
    end)

Always logs out afterwards, even if `fun` raises.

---

*Consult [api-reference.md](api-reference.md) for complete listing*