Clear signing

Clear signing displays a Rhinestone review iframe before the browser asks the user to approve with a passkey. Use it when you want the review to come from the server-prepared payload instead of relying only on application-owned UI.

Clear signing is experimental. The experimental_clear_signing option and its review contract may change in a future release.

Enable clear signing

Add the option to your existing client initialization. clientConfig is your provider, client ID, and sponsorship configuration:

export const oneAuth = new OneAuthClient({
  ...clientConfig,
  experimental_clear_signing: true,
});

In the public @rhinestone/1auth 0.10.1 release, the option changes review behavior for embedded-wallet intent and batch flows:

Method	Review behavior
`sendIntent()` and `sendBatchIntent()`	Configurable; `true` shows review
`signMessage()` and `signTypedData()`	Always reviewed; the option is not forwarded
`signWithModal()`	Always reviewed

Sign-up, login, recovery, and permission grants are unchanged. For a viem wallet client, set the option on its factory because it creates its own internal SDK client:

const walletClient = createPasskeyWalletClient({
  accountAddress,
  clientId: "my-app",
  chain,
  transport,
  experimental_clear_signing: true,
});

The wrapper maps sendTransaction() and sendCalls() to sendIntent(), signMessage() and signTypedData() to their matching SDK methods, and transaction signing to signWithModal(). It therefore follows the same review behavior. Standard viem actions do not expose a per-call experimental_clear_signing option.

Keep review and WebAuthn separate

Clear signing adds a review step; it does not replace WebAuthn approval.

Stage	Owner	Result
Prepared-action review	Rhinestone iframe	The user accepts or rejects the decoded server-prepared action
WebAuthn approval	Browser and passkey provider	The user authorizes the bound signing challenge
Verification and submission	Rhinestone	The server verifies the exact payload, challenge, origin, RP ID, account, and credential before submission

Approval returns from the review iframe and WebAuthn runs in your application’s top-level page. Clear signing uses the same domain-bound passkey and account as authentication; it does not change the account namespace.

What the review shows

The iframe displays the best safe representation available:

verified actions from the Rhinestone clear-signing registry
decoded ERC-20 transfers and approvals when available
application-supplied ABI labels marked as unverified
raw contract calls when no safe decode exists
chain, amount, recipient, and policy details when available

Only registry metadata receives a verified badge. Application-supplied metadata can improve readability, but it does not become trusted registry data.

Override one configurable request

A per-call option overrides the client setting for intent and batch flows. For example, show review for one payment intent:

await oneAuth.sendIntent({
  accountAddress,
  targetChain: 8453,
  calls: [
    {
      to: merchantAddress,
      data: "0x",
      value: 10_000_000_000_000_000n,
      label: "Pay merchant",
      sublabel: "0.01 ETH on Base",
    },
  ],
  experimental_clear_signing: true,
});

Or use blind signing for one intent on a clear-signing client:

await oneAuth.sendIntent({
  accountAddress,
  targetChain: 8453,
  calls: [paymentCall],
  experimental_clear_signing: false,
});

Do not use this flag to control signMessage(), signTypedData(), or signWithModal(). Those methods always show review for embedded wallets.

Getting started

Authentication

External wallets

Signing

Integration

Security

Enable clear signing

Keep review and WebAuthn separate

What the review shows

Override one configurable request

​Enable clear signing

​Keep review and WebAuthn separate

​What the review shows

​Override one configurable request

Enable clear signing

Keep review and WebAuthn separate

What the review shows

Override one configurable request