App-origin live demo

The live demo calls ordinary EIP-1193 wallet_connect on the shared docs client. It authorizes and returns the docs-hostname passkey account; it does not open experimental cross-origin passkey-or-EOA selection.

Explicit experimental cross-origin connection

createExperimentalCrossOriginOneAuthConnection is the separate experimental passkey-or-wallet connection surface. It always uses the cross-origin 1auth identity namespace and does not read, replace, or impersonate an app-origin passkey account.

The returned session names both decisions:

• webAuthnMode: 'experimental_cross_origin' — the browser and identity boundary used by this API.
• signerType: 'passkey' | 'eoa' — the signer selected by the user.

A cross-origin passkey is a 1auth smart account and sends through intents. An EOA is the traditional wallet address itself and sends directly through that wallet's native RPC. The SDK never represents an EOA as a passkey account.

eoaConnect is opt-in. With eoaConnect: false (the default), this surface offers only a cross-origin passkey. With eoaConnect: true, the same cross-origin dialog also offers WalletConnect and injected wallets.

Usage

import { createExperimentalCrossOriginOneAuthConnection } from '@rhinestone/1auth';
import { createWalletClient, custom } from 'viem';
import { base } from 'viem/chains';
 
const connection = createExperimentalCrossOriginOneAuthConnection({
  clientId: 'my-app',
  eoaConnect: true,
});
 
const session = await connection.connect();
// session.webAuthnMode is always 'experimental_cross_origin'.
// session.signerType is the selected 'passkey' or 'eoa'.
 
const walletClient = createWalletClient({
  account: session.accountAddress,
  chain: base,
  transport: custom(session.provider),
});
 
await walletClient.sendTransaction({ to: '0x…', value: 1n });

Branch on signerType when behavior differs:

if (session.signerType === 'eoa') {
  // Traditional wallet: native RPC, single-chain, no 1auth intents.
} else {
  // Cross-origin 1auth passkey smart account: intent routing is available.
}

App-origin clients

Do not pass an app-origin OneAuthClient to this helper. It throws NAMESPACE_MISMATCH before opening a dialog:

const appOriginClient = new OneAuthClient({
  clientId: 'my-app',
  webauthn: { mode: 'app_origin' },
});
 
createExperimentalCrossOriginOneAuthConnection({ client: appOriginClient });
// throws NAMESPACE_MISMATCH

To use both account types in one application, keep them as separate connections:

const appOriginClient = new OneAuthClient({
  clientId: 'my-app',
  webauthn: { mode: 'app_origin' },
});
 
const walletConnection = createExperimentalCrossOriginOneAuthConnection({
  clientId: 'my-app',
  eoaConnect: true,
  storageKey: '1auth-cross-origin-wallet',
});

App-origin passkey auth continues through appOriginClient.authenticate() with an optional flow hint. Traditional wallet selection continues through walletConnection.connect(). No silent fallback crosses those namespaces.

Switching and disconnecting

Calling connect() again replaces the active signer before it resolves. The provider emits accountsChanged for the newly selected address, and every later signing or transaction request routes only to that signer.

disconnect() clears the bound session and persisted connection state, then emits accountsChanged([]) and disconnect. A later connect() starts a fresh deterministic selection.

If an EOA request supplies an address that differs from the selected wallet, the provider rejects it with ACCOUNT_MISMATCH instead of forwarding the request.

Config

Accepts OneAuthClient config except app-origin WebAuthn, plus:

Returns

interface OneAuthConnectionSession {
  webAuthnMode: 'experimental_cross_origin';
  signerType: 'passkey' | 'eoa';
  accountAddress: `0x${string}`;
  provider: OneAuthProvider;
  chainId: number;
  autoConnected: false;
}

connect() always authenticates and therefore returns autoConnected: false; it no longer performs a silent auto-connect.

Cross-chain intents are unavailable for EOA sessions. Use the cross-origin passkey signer when the application needs 1auth chain abstraction.