Architecture

Understanding how 1auth components work together to provide secure, gasless authentication and transactions.

Overview

1auth is built on top of the Rhinestone SDK, adding a passkey-based authentication layer to Rhinestone's chain abstraction and smart account infrastructure. The result: fully chain-abstracted accounts secured by passkeys.

1. Security through passkeys - WebAuthn provides hardware-backed, biometric authentication
2. Full chain abstraction - One account, one balance, works across all supported chains (one per app — see Per-App Accounts)
3. Simplicity through abstraction - Complex blockchain operations are hidden from users
4. Flexibility through standards - Built on ERC-7579 modular accounts with EIP-1193 compatibility for wide tooling support

System Components

1auth Service

The 1auth service runs at passkey.1auth.app and consists of two main parts:

Passkey Provider (iframe)

The passkey provider runs in a secure iframe embedded in your application and handles all WebAuthn operations:

• Passkey registration and authentication
• EIP-712 typed data signing
• Intent preparation and user approval
• Session persistence across origins

The iframe architecture ensures that passkey credentials are never exposed to the parent application, providing an additional layer of security.

Session Scope

Because the passkey provider runs on a dedicated domain (passkey.1auth.app), every 1auth passkey is stored by the browser and password manager under that one relying party, and credentials are never exposed to the embedding app.

Sessions and accounts are scoped to the app: a user signed in to one 1auth app is not signed in to another, and a passkey registered on one app cannot sign in to a different one. See Per-App Accounts.

1auth Backend

The backend integrates the Rhinestone Orchestrator SDK to handle onchain execution:

• Receives signed intents from the passkey provider
• Uses Rhinestone SDK to convert intents into executable transactions
• Submits transactions across multiple chains
• Handles gas sponsorship and transaction monitoring

Chain Abstraction

1auth accounts are fully chain abstracted, powered by the Rhinestone SDK. Users interact with a single account that works seamlessly across all supported chains:

Crosschain Keystore

The 1auth keystore maps a user's passkey-secured identity to their smart account ownership across supported chains. Instead of asking users to register and recover accounts chain-by-chain, 1auth keeps ownership changes coordinated so the same passkey and recovery configuration can apply wherever the account is used.

This is what lets a recovered account regain access across chains with one authorization. The passkey remains the user's signing root, while the onchain account configuration gives every supported chain the same view of who can sign and who can authorize recovery.

Smart Account

Each user gets a fully self-custodial smart contract account that supports modular functionality via ERC-7579. The account is controlled by a passkey validator module that verifies WebAuthn signatures onchain—only the user can authorize transactions.

Key features:

• Counterfactual deployment (account exists before first transaction)
• Modular architecture for extensibility
• Same address on EVM chains
• Address derived from your app's origin (per-app accounts)

Request Flow

1. User Action - User clicks PayButton or initiates transaction in your app
2. SDK Request - 1auth SDK sends the transaction request to the passkey provider iframe
3. Passkey Signing - User reviews and authenticates with Face ID/Touch ID
4. Backend Processing - Signed intent is sent to 1auth backend
5. Rhinestone Execution - Backend uses Rhinestone SDK to execute onchain
6. Confirmation - SDK receives confirmation, updates UI

Learn More

• Rhinestone Documentation - Deep dive into the underlying infrastructure
• Security - Threat model, origin isolation, and intent integrity
• Passkeys - How passkeys provide secure, non-custodial authentication