Skip to main content
The hosted UI provides a production-ready passkey interface that handles all WebAuthn complexity. This guide covers implementation for web and mobile applications.
The appName determines how the passkey will be named when created on your user’s device. Use your application’s name or a clear identifier so users can easily recognize it.

Web Integration (React/Next.js) - Hosted UI

1

Initiate Passkey Session

Request a passkey session from your backend and receive a hosted UI URL. For creating new accounts, use the base /passkeys endpoint. For authentication with existing passkeys, use /passkeys/auth.
appName determines how the passkey will be named when it is created on your user’s device. Use your application’s name or a clear identifier so users can easily recognize it.
2

Embed Hosted UI

Add the hosted Passkey UI to your app using an iframe with the correct WebAuthn permissions.
3

Handle Authentication Result

Listen for messages from the iframe to receive the session token or handle errors, then use the session token as a signer in Grid account operations.
On successful authentication, the iframe will post a message of type authz_complete containing a sessionToken and the passkey address. For account creation, you’ll also receive smartAccountAddress. On error, a message of type authz_error will be sent with an error description.

React Native Integration - Hosted UI

1

Initiate Passkey Session

Request a passkey session from your backend and receive the hosted UI URL.
2

Open Hosted UI in Browser

Launch the Passkey UI in the device browser using WebBrowser.openAuthSessionAsync.
3

Process Redirect Result

Handle the redirect and extract the session token from the result for use as a signer in Grid operations.

Smart Account Creation

When using the create action, Grid automatically:
  1. Creates Passkey: Initiates WebAuthn ceremony on user’s device
  2. Deploys Smart Account: Creates a new 1/1 threshold smart account on Solana
  3. Sets Permissions: Configures passkey with full permissions (mask=7)
  4. Stores in Database: Registers account in Grid’s database
  5. Funds Account (Sandbox only): Adds 1 USDC to new sandbox accounts
The response includes both the passkey address and the smart account address that you can use immediately.

WebAuthn Configuration Requirements

Required Settings

The on-chain passkey program has specific requirements that must be met for successful registration and authentication: User Presence Required:
  • userPresent must be true in the WebAuthn authenticator response
  • This applies to both passkey creation and subsequent authentications
  • The authenticator must verify user presence through biometric, PIN, or physical interaction
Algorithm Requirement:
  • Only ES256 (algorithm -7) is supported
  • No other cryptographic algorithms are accepted by the on-chain program
WebAuthn Configuration Example:

Handling Registration Failures

If local passkey creation succeeds but submission fails:
  • The passkey exists locally but has no associated on-chain account
  • Solution: Re-request a new URL with the create endpoint and submit again
  • The existing local passkey will work with the new challenge
  • No need to recreate the local passkey
Common failure scenarios:
  • Challenge expired (60-second timeout)
  • Network issues during submission
  • Invalid WebAuthn response format

Timing Constraints

Understanding the timing constraints helps avoid confusing errors:
The passkey credential on the user’s device has no expiration. The timing constraint applies to the challenge (slot hash) used in API calls, not the credential itself. A passkey created months ago can sign fresh challenges.
Why this matters: If a user takes too long between requesting a passkey session and completing the flow, the slot hash becomes invalid. The solution is simple—request a new session URL with a fresh challenge.

Best Practices

  1. Challenge Handling:
    • Parse challenge from URL parameters
    • Use challenge directly - it’s already base64 encoded
    • Never re-encode the challenge
    • Return complete WebAuthn response objects
    • Complete WebAuthn ceremony within 60 seconds of URL generation
  2. Session Management:
    • Generate unique session keys for each authentication
    • Implement proper expiration handling
    • Securely store session tokens
    • Never expose session keys
  3. Error Handling:
    • Implement comprehensive error handling
    • Provide user-friendly error messages
    • Log errors for debugging
    • Handle both success and failure scenarios
  4. User Experience:
    • Use clear, recognizable app names
    • Provide loading states during authentication
    • Show clear feedback for success/failure
    • Explain passkey benefits to users
  5. Security:
    • Validate all inputs
    • Use HTTPS for all communications
    • Implement proper CORS policies
    • Never expose API keys in client-side code
    • Store account addresses securely
    • Never confuse sandbox and production addresses
  6. Environment Management:
    • Maintain separate accounts for sandbox and production
    • Never send real funds to sandbox addresses
    • Test thoroughly in sandbox before production deployment
For more details, see the API endpoint documentation:

Advanced Integration

Need Your Own Custom Domain? If you need to host passkey flows on your own domain (e.g., auth.yourcompany.com) for branding or compliance requirements, see Advanced Integration.