Prerequisites
- Node.js 18 or later
- A browser with WebAuthn support
- A passkey-capable device or hardware security key
Create the app
src/main.ts with:
What happened
connect() returns the selected key’s address, keyId, and keyType.
signMessage() uses that keyId and returns the signature plus the signing
address. The default iframe mode falls back to a popup if the app’s content
security policy blocks the frame.
Sign out
signOut() clears local state, cancels any open OpenKey flows, and asks OpenKey
to end the session. It resolves to { requestId, revoked }: revoked: true
means OpenKey confirmed the old session no longer works.
Since 0.10.2 the embedding page never receives an OpenKey session token:
getSessionToken() always returns null. Server-side signing needs an OAuth
access token; see OAuth.