Signing

Every 1auth signature uses a signing dialog to prepare and verify the payload, then a browser WebAuthn prompt that the user must approve. Choose who shows the human-readable review before that prompt:

• Blind signing (default): the signing dialog stays hidden and your app is the review UI.
• Clear signing: a visible 1auth review iframe appears before the passkey prompt.

Blind signing

By default, the signing dialog is invisible; 1auth renders no review UI. The browser WebAuthn prompt is always shown, and nothing is signed without a user gesture.

Before invoking the SDK, show the recipient, amount, token, chain, fees, and risk context in your UI. See Checkout.

"Blind" describes the review UX, not the security model. The server still binds and verifies the exact prepared intent, WebAuthn challenge, browser origin, RP ID, account, and credential before submitting anything on-chain, so your app cannot swap the payload after the user approves.

Choosing a mode

Use blind signing when your app owns the review UI. Use clear signing to show the authoritative 1auth-prepared action before approval.

Clear signing

Shows a 1auth transaction, message, or EIP-712 review iframe before the passkey prompt. This experimental API can change while the review UX and integration contract are validated.

Enable

Set experimental_clear_signing: true on OneAuthClient:

import { OneAuthClient } from "@rhinestone/1auth";
 
export const client = new OneAuthClient({
  providerUrl: "https://passkey.1auth.app",
  clientId: "wallet-dashboard",
  experimental_clear_signing: true,
  sponsorship: {
    accessTokenUrl: "/api/sponsorship/access-token",
    extensionTokenUrl: "/api/sponsorship/extension-token",
  },
});

Supported signing calls show the review iframe before WebAuthn starts. Authentication, signup, recovery, and permission grants are unchanged.

Supported methods

• sendIntent()
• sendBatchIntent()
• createPasskeyWalletClient() sendTransaction() and sendCalls() flows

signMessage(), signTypedData(), and signWithModal() always show the review iframe before WebAuthn, whatever this option says.

App-origin sendIntent() also supports the experiment: the 1auth iframe shows the authoritative review, then WebAuthn still runs on the integrating application's own origin after approval. See App-origin passkeys.

Per-call overrides

Disable it for one request on a client that enabled it globally:

await client.sendIntent({
  accountAddress,
  targetChain: 8453,
  calls: [paymentCall],
  experimental_clear_signing: false,
});

For viem wallet-client integrations, enable it on the factory because the factory creates its own internal OneAuthClient:

const walletClient = createPasskeyWalletClient({
  accountAddress,
  clientId: "wallet-dashboard",
  chain,
  transport,
  experimental_clear_signing: true,
});

What users see

The review iframe renders the signable action before WebAuthn:

• verified actions from 1auth's clear-signing registry,
• decoded ERC-20 transfers and approvals when possible,
• app-supplied ABI labels marked as app supplied,
• raw contract calls when no safe decode exists,
• chain, amount, recipient, and policy details when available.

Verified badges only come from 1auth's registry. App-supplied ABI metadata can make a custom contract readable, but it is not marked verified.

Signing vs Headless Mode

Blind and clear signing both use 1auth's passkey signer.

Headless Mode instead accepts signatures from another validator or signer and does not run the passkey dialog.