Skip to main content
Embedded wallets create and use passkeys on your application’s domain. The standard client setup uses this behavior without a separate opt-in. By default, each hostname has a separate passkey and smart-account namespace, even when the user signs in with the same email or OAuth identity.

​
How domains determine the account

  • RP ID (relying party ID) is the passkey’s hostname namespace, such as checkout.example.com. It contains no scheme or port.
  • Origin is the exact page origin that runs WebAuthn, such as https://checkout.example.com. It includes the scheme and any non-default port, but no path.
  • Account namespace is https://<rpId>. The RP ID determines which passkey, signer, and smart account the user accesses.
For https://checkout.example.com, the defaults are:
The browser supplies and signs the origin; the SDK cannot replace it. A different port changes the origin that must be authorized, but not the account namespace. A different hostname changes the default RP ID and therefore the account.

​
Share an account across subdomains

To let a user access the same passkey and account from app.example.com and checkout.example.com, choose their parent domain, example.com, as the RP ID before onboarding users.
  1. Follow the Dashboard RP configuration to verify the domains, register example.com as the RP ID, and authorize both exact origins.
  2. Add the matching option to the shared client initializer on both subdomains:
  1. Authenticate as the same user on each origin with the browsers and password managers you support. Confirm that both return the same account address before rollout.
Dashboard configuration authorizes the shared namespace; webauthn.rpId selects it in the client. Without that client option, each hostname keeps its own namespace. rpOrigins is server configuration, not an SDK option.

​
Changing domains

Changing the RP ID selects a different passkey, signer, and smart account. Existing balances do not move automatically. Treat this as an account migration, not a routine configuration update.
Moving to a new hostname changes the RP ID when you use the default hostname-based configuration. Moving between subdomains with the same explicitly configured parent RP ID keeps the namespace, but the new origin must still be verified and authorized in the Dashboard. An established RP ID cannot be changed or cleared in the Dashboard.

​
Troubleshoot domain configuration

clientId identifies the registered application; it does not override browser-origin verification. If authentication succeeds but a transaction fails, check sponsorship setup separately.