Authenticate

Live Demo

Overview

This demo showcases two core SDK features:

1. Authentication - Connect a user with their passkey using authWithModal()
2. Message Signing - Sign arbitrary messages using signMessage()
3. Verification - Verify signatures using verifyMessageHash()

Authentication

Open a modal for users to sign in or create an account:

const client = new PasskeyProviderClient({
  providerUrl: 'https://auth.example.com',
  clientId: 'my-app',
});

const result = await client.authWithModal();

if (result.success) {
  console.log('Connected as:', result.username);
}

Message Signing

After authentication, sign arbitrary messages for verification:

const result = await client.signMessage({
  username: 'alice',
  message: `Sign in to MyApp\nTimestamp: ${Date.now()}`,
  description: 'Verify your identity',
});

if (result.success) {
  console.log('Signature:', result.signature);
  console.log('Signed Hash:', result.signedHash);
}

Signature Verification

Messages are signed with a domain separator to prevent replay attacks. Use the SDK's verification utilities to confirm the hash matches:

import { verifyMessageHash, hashMessage } from '@1auth/sdk';

const message = 'Sign in to MyApp';
const result = await client.signMessage({ username: 'alice', message });

if (result.success) {
  // Verify the signedHash matches what we expect
  const isValid = verifyMessageHash(message, result.signedHash);
  console.log('Hash verified:', isValid);

  // Or compute the expected hash manually
  const expectedHash = hashMessage(message);
  console.log('Expected:', expectedHash);
  console.log('Received:', result.signedHash);
}

The domain separator format is: keccak256("\x19Passkey Signed Message:\n" + len + message)

This ensures message signatures cannot be replayed for transaction signing.

SignMessageOptions

SignMessageResult

Use Cases

• Login verification - Sign a challenge to prove identity
• Terms acceptance - Sign acknowledgment of terms/conditions
• Off-chain signatures - Any scenario requiring proof of ownership

Security

The message is hashed with a domain separator before signing, which:

1. Prevents signature replay attacks across different apps
2. Ensures message signatures cannot be used for transaction signing
3. Follows a similar pattern to EIP-191 personal sign