Skip to main content

What Are Passkeys?

Passkeys use biometric authentication (Face ID, Touch ID, Windows Hello) to protect wallets. Instead of a PIN, a secure encryption key is derived from the biometric prompt. No passwords to remember, no PINs to leak. Dual-key architecture: Every passkey wallet also has a mandatory PIN backup. If biometrics fail (browser change, device reset), the PIN recovers the wallet. Two independent keys, same private key.

Platform Support

Installation

Create Wallet with Passkey + PIN

The recommended flow — passkey is primary, PIN is backup:

What happens internally

  1. usePasskey: true → calls createWalletPasskey(userId, userId) → biometric prompt
  2. Returns encryptKey (passkey-derived) + credentialId + prfSupported
  3. Since encryptKey (PIN) was also provided → dual-key mode:
    • Private key encrypted with passkey key → encryptedPrivateKey
    • Private key encrypted with PIN → encryptedPrivateKeyBackup
  4. Both sent to backend with authMethod: "passkey+pin"
Source: chipi-react/src/hooks/useCreateWallet.ts lines 62-100

Transfer with Passkey (Automatic PIN Fallback)

Transfer flow

  1. usePasskey: true → tries passkey authentication (biometric prompt)
  2. If passkey succeeds → decrypts encryptedPrivateKey with passkey key → signs tx
  3. If passkey fails (PRF unavailable, user cancelled, localStorage cleared):
    • Checks if wallet.encryptedPrivateKeyBackup exists
    • If yes → calls onPinRequired() → user enters PIN → decrypts backup key → signs tx
    • If no backup or no onPinRequired callback → throws descriptive error
Source: chipi-react/src/hooks/useTransfer.ts lines 65-110

UseTransferConfig

PIN-Only Mode (Backward Compatible)

Omit usePasskey: true for the same PIN-only flow as before:

Migrate from PIN to Passkey

For existing PIN-only wallets:

Check Passkey Status

Expo (Mobile) Passkeys

On mobile, the same usePasskey: true flag works automatically — the Expo ChipiProvider injects a native biometric adapter.
If biometrics fail (user unenrolled, cancelled), the onPinRequired callback in useTransfer handles the fallback — same as web.

Hooks Reference

Security

  • Dual-key wrapping: Same private key encrypted by two independent keys. Either recovers.
  • No silent fallback: If passkey was created with PRF, PBKDF2 fallback is blocked (prevents wrong-key decryption).
  • Backend credential recovery: credentialId stored server-side. If localStorage cleared, SDK recovers from backend.
  • Hardware-backed: Keys in Secure Enclave (iOS), Android Keystore, or WebAuthn authenticator.