Accounts

Embedded wallets give each user a passkey-controlled smart account for your application. The account has the same address on every supported EVM chain, but it is isolated from accounts the same person creates in other applications.

Before you start

Use Node.js and a browser application served over HTTPS. The hosted provider does not accept plain http://localhost; use local HTTPS for development.
Register your application and domains in the Dashboard.
Configure sponsorship token endpoints before calling intent or asset methods. Authentication itself does not require a funded account.

Install the SDK

npm install @rhinestone/1auth

pnpm add @rhinestone/1auth

yarn add @rhinestone/1auth

The examples on this page are supported by the public @rhinestone/1auth 0.10.1 release.

Initialize the client

Create one client and reuse it throughout your application:

oneauth.ts

import { OneAuthClient } from "@rhinestone/1auth"

export const oneAuth = new OneAuthClient({
  providerUrl: "https://passkey.1auth.app",
  clientId: "my-app",
  sponsorship: {
    accessTokenUrl: "/api/sponsorship/access-token",
    extensionTokenUrl: "/api/sponsorship/extension-token",
  },
})

Replace my-app with the client ID of your registered application. The sponsorship URLs are same-origin backend endpoints; follow Sponsorship setup to implement them.

Authenticate and obtain an account

import { oneAuth } from "./oneauth"

const auth = await oneAuth.authenticate()

if (!auth.success) {
  throw new Error(auth.error.message)
}

const accountAddress = auth.session.accountAddress
console.log(accountAddress)

accountAddress is a typed 0x${string} address. Authentication creates an account when the verified identity has none in your application’s namespace, or signs in to the existing account. To restore a current wallet session without opening the dialog, call getSession():

const session = await oneAuth.getSession()
const accountAddress = session.success
  ? session.session.accountAddress
  : undefined

Account isolation

Passkeys are created and used on your application’s domain. By default, each hostname has its own passkey and account namespace, even when the user verifies the same email or OAuth identity. Funding and recovery configuration remain isolated to that namespace. See Passkeys and domains before sharing accounts across subdomains or changing your production hostname. Changing the RP ID selects a different account; existing balances do not move automatically.

Account management

Build account management in your application. Account-management popups, redirect signing, inline-embed signing, and openAccountDialog() are not supported for these wallets and return APP_ORIGIN_FLOW_UNSUPPORTED.

Try an account

Create or use a passkey for this docs hostname, then check the session or send a test transaction. The test intent mints 0.1 mUSD on Base Sepolia with sponsored fees. It uses clear signing: review the prepared action before approving the passkey prompt.

Getting started

Authentication

External wallets

Signing

Integration

Security

Before you start

Install the SDK

Initialize the client

Authenticate and obtain an account

Account isolation

Account management

Try an account

​Before you start

​Install the SDK

​Initialize the client

​Authenticate and obtain an account

​Account isolation

​Account management

​Try an account

Before you start

Install the SDK

Initialize the client

Authenticate and obtain an account

Account isolation

Account management

Try an account