Passkey Signer

Use a passkey signer to let users sign transactions with biometric authentication — Face ID, Touch ID, fingerprint, or Windows Hello. Passkeys are built on the WebAuthn standard and are synchronized across devices via providers like Apple Keychain, Google Password Manager, and 1Password.

Supported Chains

Chain	Operational signer	Recovery method
EVM	✅	✅
Stellar	✅	✅
Solana	✅	❌

Configuration

Configure the wallet to use a passkey as the operational signer at creation time. The SDK handles WebAuthn registration during the first wallet creation.

React
React Native
Swift
Kotlin

Using createOnLogin on the provider:

import {
    CrossmintProvider,
    CrossmintAuthProvider,
    CrossmintWalletProvider,
} from "@crossmint/client-sdk-react-ui";

function App({ children }) {
    return (
        <CrossmintProvider apiKey="YOUR_CLIENT_API_KEY">
            <CrossmintAuthProvider loginMethods={["email", "google"]}>
                <CrossmintWalletProvider
                    createOnLogin={{
                        chain: "base-sepolia",
                        recoveryMethods: [{ type: "email" }],
                        signers: [{ type: "passkey" }],
                    }}
                >
                    {children}
                </CrossmintWalletProvider>
            </CrossmintAuthProvider>
        </CrossmintProvider>
    );
}

Or create the wallet explicitly:

import { useWallet } from "@crossmint/client-sdk-react-ui";

const { createWallet } = useWallet();

const wallet = await createWallet({
    chain: "base-sepolia",
    recoveryMethods: [{ type: "email", email: "user@example.com" }],
    signers: [{ type: "passkey" }],
});

The same configuration works on Stellar and Solana: set chain to "stellar" or "solana". On Stellar a passkey can also be a recovery method (recoveryMethods: [{ type: "passkey" }]); on Solana it can only be an operational signer.Each transaction triggers a biometric authentication prompt.

React Native uses the platform passkey APIs (iOS AuthenticationServices, Android Credential Manager) through the react-native-passkey package.

Install the native module

Install react-native-passkey and rebuild the app. Passkeys need a development build; Expo Go cannot run native modules.

npx expo install react-native-passkey

Associate the app with the relying party domain

Associate the app with the domain you use as the relying party ID (rpId):

iOS: add the associated domain webcredentials:app.example.com to the app, and serve an apple-app-site-association file from the domain that lists the app.
Android: serve /.well-known/assetlinks.json from the domain with the delegate_permission/common.get_login_creds relation for the app’s package name and signing certificate.

Configure passkeys on the wallet provider

Pass passkeys to CrossmintWalletProvider. Pass Passkey from react-native-passkey so your bundler links the native module:

import { Passkey } from "react-native-passkey";
import {
    CrossmintProvider,
    CrossmintAuthProvider,
    CrossmintWalletProvider,
} from "@crossmint/client-sdk-react-native-ui";

function App({ children }) {
    return (
        <CrossmintProvider apiKey="YOUR_CLIENT_API_KEY">
            <CrossmintAuthProvider loginMethods={["email", "google"]}>
                <CrossmintWalletProvider
                    passkeys={{ rpId: "app.example.com", rpName: "Example", passkey: Passkey }}
                    createOnLogin={{
                        chain: "base-sepolia",
                        recoveryMethods: [{ type: "email" }],
                        signers: [{ type: "passkey" }],
                    }}
                >
                    {children}
                </CrossmintWalletProvider>
            </CrossmintAuthProvider>
        </CrossmintProvider>
    );
}

Keep rpId fixed once users have created passkeys. A passkey only works for the domain it was created for.

Without the passkeys prop, the React Native SDK rejects passkey signers. Every passkey operation requires user verification (biometrics or a device PIN).

The Swift SDK uses the iOS passkey APIs (AuthenticationServices) and shows the system prompts for you. The steps below need a signed-in user; see the Swift quickstart to configure the SDK and sign the user in.

Associate the app with the relying party domain

Add the associated domain webcredentials:app.example.com to the app, and serve an apple-app-site-association file from the domain that lists the app. The SDK uses this domain (host) as the relying party ID.

Create the wallet with a passkey signer

Pass a passkey in signers. The SDK asks the user to create the passkey, then creates the wallet:

import CrossmintClient

CrossmintSDK.configure(apiKey: "YOUR_CLIENT_API_KEY")
let sdk = CrossmintSDK.shared

let passkey = SignerConfig.passkey(name: "user@example.com", host: "app.example.com")

let wallet = try await sdk.crossmintWallets.createWallet(
    chain: EVMChain.baseSepolia,
    recoveryMethods: [EVMSigners.email("user@example.com")],
    signers: [passkey]
)
try await wallet.useSigner(passkey)

name is the account name that the passkey prompt shows.

Sign with the passkey on later launches

Set passkeyHost when you get the wallet. The SDK then signs with the passkey:

// Uses the SDK configured in the create step
import CrossmintClient

let wallet = try await CrossmintSDK.shared.crossmintWallets.getWallet(
    chain: EVMChain.baseSepolia,
    options: WalletOptions(passkeyHost: "app.example.com")
)

The same configuration works on Stellar and Solana: use StellarChain.stellar or SolanaChain.solana. On Stellar a passkey can also be a recovery method (StellarSigners.passkey(name:host:)); on Solana it can only be a signer.

The Kotlin SDK uses Android Credential Manager through the sdk-passkeys module. The steps below need a configured SDK and a signed-in user; see the Kotlin quickstart.

Add the passkeys module

The crossmint-sdk artifact does not include passkey support. Add sdk-passkeys with the same version:

build.gradle.kts

dependencies {
    implementation(libs.crossmint.sdk)
    implementation(libs.crossmint.sdk.passkeys)
}

libs.versions.toml

[libraries]
crossmint-sdk-passkeys = { module = "com.crossmint:sdk-passkeys", version.ref = "crossmint-sdk" }

Associate the app with the relying party domain

Serve /.well-known/assetlinks.json from the domain you use as the relying party ID (rpId), with the delegate_permission/common.get_login_creds relation for the app’s package name and signing certificate.

Create the wallet with a passkey signer

Create the passkey with createPasskeyCredential, and pass it in signers. AndroidPasskeyProvider shows the passkey prompt each time the wallet signs:

import android.app.Activity
import androidx.credentials.CredentialManager
import com.crossmint.kotlin.CrossmintSDK
import com.crossmint.kotlin.passkeys.AndroidPasskeyProvider
import com.crossmint.kotlin.passkeys.createPasskeyCredential
import com.crossmint.kotlin.signers.DelegatedSigner
import com.crossmint.kotlin.signers.SignerType
import com.crossmint.kotlin.types.EVMChain
import com.crossmint.kotlin.types.getOrThrow

suspend fun createPasskeyWallet(activity: Activity) {
    val credential = createPasskeyCredential(
        name = "user@example.com",
        activityProvider = { activity },
        credentialManager = CredentialManager.create(activity),
        rpId = "app.example.com",
        rpName = "Example",
    ) ?: return

    val wallet = CrossmintSDK.shared.wallets.createWallet(
        chain = EVMChain.BaseSepolia,
        recoveryMethods = listOf(SignerType.Email("user@example.com")),
        signers = listOf(
            DelegatedSigner.Passkey(
                id = credential.id,
                name = credential.name,
                publicKeyX = credential.publicKeyX,
                publicKeyY = credential.publicKeyY,
            ),
        ),
        passkeyProvider = AndroidPasskeyProvider(rpId = "app.example.com"),
    ).getOrThrow()
}

createPasskeyCredential returns null when the user cancels or the passkey cannot be created.

Sign with the passkey on later launches

Pass an AndroidPasskeyProvider when you get the wallet. The SDK then signs with the passkey:

// Uses the SDK configured at app start, as in the create step
import com.crossmint.kotlin.CrossmintSDK
import com.crossmint.kotlin.passkeys.AndroidPasskeyProvider
import com.crossmint.kotlin.types.EVMChain
import com.crossmint.kotlin.types.getOrThrow

val wallet = CrossmintSDK.shared.wallets.getWallet(
    chain = EVMChain.BaseSepolia,
    passkeyProvider = AndroidPasskeyProvider(rpId = "app.example.com"),
).getOrThrow()

The same configuration works on Stellar and Solana: use StellarChain.Stellar or SolanaChain.Solana. On Stellar a passkey can also be a recovery method (SignerType.Passkey); on Solana it can only be a signer.

Adding a Passkey to an Existing Wallet

If the wallet already exists with a different signer, you can add a passkey with addSigner. See Add Signers for the full flow.

Introduction

Quickstarts ⚡

Concepts

Guides

API Reference

Supported Chains

Configuration

Adding a Passkey to an Existing Wallet

Next Steps

Add Signers

Configure Recovery

Device Signer

​Supported Chains

​Configuration

​Adding a Passkey to an Existing Wallet

​Next Steps

Add Signers

Configure Recovery

Device Signer

Supported Chains

Configuration

Adding a Passkey to an Existing Wallet

Next Steps