Skip to main content

Passkey Authentication

Cat Wallet supports passkey-based login and transaction signing via Ritual Chain's TxPasskey transaction type (0x77) and the SECP256R1 precompile (0x0100).

Passkeys let you approve transactions with Face ID, Touch ID, a fingerprint reader, or Windows Hello. No seed phrase is required.

What is a Passkey?​

A passkey is a P-256 cryptographic credential stored on your device. On Apple devices it lives in the Secure Enclave and syncs through iCloud Keychain. On Android it is managed by Google Password Manager. On Windows it uses the TPM via Windows Hello.

The private key never leaves the device. Cat Wallet stores only the public key and credential ID.

Setup​

You must sign in with email before registering a passkey.

  1. Open Cat Wallet and sign in with email.
  2. Open the menu and go to Security.
  3. Tap Register Passkey.
  4. Complete the biometric prompt your device shows.

From that point, the login screen shows a Face ID / Touch ID button that signs in directly without entering an email.

Logging in​

  1. Tap Open wallet.
  2. Tap Face ID / Touch ID.
  3. Complete the biometric prompt.
DeviceMethod
iPhone / iPadFace ID or Touch ID
MacTouch ID
AndroidFingerprint or face unlock
WindowsWindows Hello (PIN, fingerprint, or face)

Approving transactions​

Once a passkey is registered, transactions can be approved without a seed phrase.

  1. Initiate a transaction (send, swap, stake).
  2. The transaction approval sheet appears showing recipient, amount, and estimated fee.
  3. Tap Approve — the device shows the biometric prompt.
  4. On success the transaction is submitted as a TxPasskey (type 0x77).
  5. The SECP256R1 precompile at 0x0100 verifies the P-256 signature on-chain.

How it works​

computeTxChallenge(chainId=1979, nonce, to, value, data)
  → SHA-256 of ABI-encoded tx parameters

signWithPasskey(challenge)
  → device signs with the P-256 key stored in secure enclave

buildTxPasskeyFields(sig, txParams)
  → wraps authenticatorData, clientDataJSON, r, s

encodeTxPasskey(fields)
  → RLP encodes everything with type prefix 0x77

eth_sendRawTransaction → Ritual Chain RPC
  → SECP256R1 precompile (0x0100) verifies on-chain

Security​

  • The P-256 private key never leaves the device secure enclave.
  • The challenge is derived from chainId, nonce, recipient, value, and calldata — so a signature cannot be replayed against a different transaction.
  • Server-issued challenges expire after 90 seconds and are single-use.
  • Verification happens on-chain via the SECP256R1 precompile, not in a trusted backend.

Re-registering​

If you get a new device or delete the passkey from iCloud Keychain:

  1. Go to Security.
  2. Remove the old passkey entry.
  3. Tap Register Passkey to register the new device.

Troubleshooting​

SymptomFix
Button shows "Setup required"Register a passkey in Security settings first
iOS shows "no passkeys saved"The passkey was removed from iCloud — re-register
Face ID button missingYour browser does not support WebAuthn
Transaction approval failsFall back to email login; re-register the passkey