Set up - Rhinestone

Configure recovery when an app-origin account is created. Verified-identity recovery in the public @rhinestone/1auth 0.10.1 release lets a user who loses every passkey prove the same email or OAuth identity and add a new passkey to that application’s existing smart account. This managed-wallet flow is separate from SDK guardian recovery, where your application installs and operates its own onchain guardian accounts.

Configure account creation

Add the verified-identity fallback to the same client used for sign-up and login. clientConfig is your provider, client ID, and sponsorship configuration from the shared client initialization:

export const oneAuth = new OneAuthClient({
  ...clientConfig,
  recovery: {
    fallback: { type: "verified-identity" },
  },
});

During account creation, the embedded wallet SDK first attempts passkey-based recovery using the passkey provider’s PRF capability. The configured fallback applies only when passkey-based recovery is unavailable. recovery.fallback is an account-creation policy. Adding it to a client later does not retrofit recovery onto an already-created account.

Keep the account namespace unchanged. clientId selects registered application metadata; it does not move recovery to the hosted provider’s centralized WebAuthn namespace. Changing the host name, RP ID, or WebAuthn mode selects another credential, signer, and smart account.

Validate the app-origin session

Call setupRecovery() after a successful login or account creation when you need to validate the current app-origin session and namespace:

const auth = await oneAuth.authenticate();
if (!auth.success) throw new Error(auth.error.message);

const sessionValidation = await oneAuth.setupRecovery();
if (!sessionValidation.completed) {
  throw new Error(sessionValidation.error.message);
}

For an app-origin account, the method calls the SDK’s app-origin session requirement and then returns completed: true. It does not inspect the account’s guardian or recovery configuration. An already-created account without a recovery guardian can therefore return completed: true. Do not use this result to gate a “recovery ready” state. It proves only that the current origin, RP ID, and account namespace have a valid session. It does not perform lost-passkey recovery, create a guardian, or open the centralized recovery-passphrase and backup-file flow.

On a client explicitly using webauthn: { mode: "experimental_cross_origin" }, setupRecovery() has different behavior: it opens the provider-owned backup flow. Do not switch modes to reach that UI because the modes use different accounts.

Continue with Recover an account for the flow after every usable passkey is lost.

​Configure account creation

​Validate the app-origin session

Configure account creation

Validate the app-origin session