Passkeys

Choose passkeys for consumer apps that should use Face ID, Touch ID, Windows Hello, or another WebAuthn authenticator instead of a seed phrase. The authenticator keeps the private key on the user’s device.

Create a passkey owner

Create the WebAuthn credential in a browser, convert it to a Viem account, and pass it as the owner:

import {
  createWebAuthnCredential,
  toWebAuthnAccount,
} from 'viem/account-abstraction'

const credential = await createWebAuthnCredential({
  name: 'Your app',
})
const passkeyOwner = toWebAuthnAccount({ credential })

Save the account configuration with the credential metadata. Follow account configuration for deployment and restoration before funding. Here, rhinestone is a configured RhinestoneSDK instance. Do not put an API key in browser code; route SDK requests through your backend or use an appropriate client authentication flow. Store credential.id and credential.publicKey so you can reconstruct the Viem account with toWebAuthnAccount. Creating another credential changes the smart account configuration and can change its address.

Passkey availability and synchronization depend on the browser, operating system, authenticator, and relying-party domain. Plan a recovery path instead of assuming a passkey will sync to every device.

Use more than one passkey

For EVM, use multisig for a passkey-per-device setup or when several passkeys must approve a transaction. Use multi-factor authentication to combine a passkey with another validator type.

Manage EVM passkeys

Use the SDK actions to change an account after deployment:

Manage Solana passkeys

Continue the Solana setup above with additionalPasskey, created or restored using the shared WebAuthn procedure. Add or remove one non-root authority per transaction:

import { addPasskey, removePasskey, solanaDevnet } from '@rhinestone/sdk/solana'

const addAuthority = {
  destination: {
    chain: solanaDevnet,
    authority: addPasskey(additionalPasskey, { permission: 'allButManageAuthority' }),
  },
}
const removeAuthority = {
  destination: {
    chain: solanaDevnet,
    authority: removePasskey(additionalPasskey),
  },
}

Use allButManageAuthority for spending and instructions without authority management. Use all for both spending and management, or manageAuthority for management without spending. Either management permission can grant all to another key, so both confer takeover power. The configured signer must hold all or manageAuthority to submit changes through the shared transaction lifecycle. Changes are always sponsored, including new-role rent; omit source and sponsored. Settle an existing submission before retrying; getAuthorityStatus(addAuthority) must return applied, not conflict, to confirm the exact permission. The root cannot be removed, nor can the last management role. Adding another passkey creates a role, not an EVM threshold validator or MFA policy. See Solana support.

Account setup

Recovery

Signing

Configuration

Integration

SDK reference

Create a passkey owner

Use more than one passkey

Manage EVM passkeys

Manage Solana passkeys

​Create a passkey owner

​Use more than one passkey

​Manage EVM passkeys

​Manage Solana passkeys

Create a passkey owner

Use more than one passkey

Manage EVM passkeys

Manage Solana passkeys