__check_auth verifies the secp256r1 signature on-chain.
When to use
Choosepasskey for the hero new-user flow: no seed phrase, no existing Stellar wallet, no
XLM balance required. The signer must be paired with a contract account (ozContractAccount)
because the secp256r1 verification runs inside the contract, not at the network layer.
Factory
passkey(opts) accepts a PasskeyOptions object:
rpId is bound permanently to the credential at registration time. If you change it, existing
users cannot authenticate - their credential is tied to the original domain. Use
window.location.hostname for consistency, or a stable parent domain for cross-subdomain apps.
This is the WebAuthn anti-phishing mechanism: a credential registered at app.example.com
cannot be used on evil.example.net.Required account type
passkey must be paired with ozContractAccount. The contract’s __check_auth method
verifies the WebAuthn signature on-chain; a classic G... account cannot accept secp256r1
signatures.
sponsorAddress is the facilitator’s public G... address, needed to derive the deterministic
C... address offline before the contract is deployed.
Example
The snippet below shows atomic batch transfers usingpasskey and ozContractAccount. A batch
of one call is equivalent to pay([call]).
Next
Native passkey
The same secp256r1 crypto on iOS and Android via the secure enclave.
Account models
When to use ozContractAccount vs. classicAccount.

