Recover an account - Rhinestone

Start from authentication

Use the same client and authentication entry point as normal login:

const result = await oneAuth.authenticate({ flow: "login" });

if (!result.success) {
  if (result.error.code === "USER_CANCELLED") return;
  throw new Error(result.error.message);
}

const accountAddress = result.session.accountAddress;

flow: "login" selects the initial presentation; it is not an authorization boundary. The service decides from verified identity and account state whether to authenticate an existing passkey or enter recovery. A user can also choose Recover account after the passkey ceremony fails.

Recovery flow

The user verifies the account’s configured email or OAuth identity in Rhinestone’s identity UI.

Rhinestone resolves the existing account in the current app-origin namespace.

The user selects Create passkey, and WebAuthn registration runs in your application’s top-level page.

The configured guardian authorizes adding that exact new credential.

Rhinestone submits recovery across every required chain where the account is deployed.

After all required chains succeed, Rhinestone activates the new passkey and returns a fresh app-origin session.

The identity and recovery instructions are Rhinestone-owned UI. The final WebAuthn registration is browser-owned and remains bound to your app’s RP ID and exact origin. There is no fallback to the experimental cross-origin credential namespace.

Do not change the host name, configured RP ID, clientId, or WebAuthn mode during recovery. Recovery is namespace-specific; a credential from another app or the hosted provider RP cannot authorize this account.

After recovery

Recovery is additive. It does not silently revoke other active credentials. After authenticate() succeeds, use the returned session normally and let the user review any remaining passkeys through your app-owned account management.

If recovery fails before all required chains complete, do not treat the pending passkey as active. Retry from the same application namespace. A successful result is the signal that the new credential and session are ready.

For accounts whose guardians and owner rotation are managed directly through the Rhinestone SDK, follow Custom signer recovery instead.

​Start from authentication

​Recovery flow

​After recovery

Start from authentication

Recovery flow

After recovery