Skip to content

Commit 9543060

Browse files
committed
chore: md lint
1 parent 91a4e15 commit 9543060

File tree

7 files changed

+192
-34
lines changed

7 files changed

+192
-34
lines changed

passkey-wallet-app/PASSKEY_REUSE.md

Lines changed: 46 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,13 @@
22

33
## Overview
44

5-
The app now saves your passkey and account data to browser localStorage, so you can reuse the same passkey and account across browser sessions without having to create a new one each time.
5+
The app now saves your passkey and account data to browser localStorage,
6+
so you can reuse the same passkey and account across browser sessions without having to create a new one each time.
67

78
## How It Works
89

910
### Automatic Save
11+
1012
When you create a passkey or deploy an account, the data is automatically saved to your browser's localStorage:
1113

1214
```javascript
@@ -16,11 +18,14 @@ localStorage:
1618
```
1719

1820
### Automatic Load
21+
1922
When you open the app, it automatically checks for saved passkey data:
23+
2024
- ✅ If found: Restores your passkey and account state
2125
- ❌ If not found: Shows the "Create Passkey" form
2226

2327
### What Gets Saved
28+
2429
1. **Passkey Data**:
2530
- Credential ID (base64url and hex formats)
2631
- Public key coordinates (x, y)
@@ -30,30 +35,37 @@ When you open the app, it automatically checks for saved passkey data:
3035
- Deployed account address (if deployed)
3136

3237
### What Doesn't Get Saved
33-
- **Private Key**: NEVER leaves your device! The private key is stored securely in your device's authenticator (Touch ID, Face ID, Windows Hello, etc.) and is never exposed to the app.
38+
39+
- **Private Key**: NEVER leaves your device! The private key is stored securely in your device's authenticator
40+
(Touch ID, Face ID, Windows Hello, etc.) and is never exposed to the app.
3441

3542
## Benefits
3643

3744
### No Need to Fund Multiple Accounts
45+
3846
- ✅ Create passkey once
3947
- ✅ Fund the account once
4048
- ✅ Reuse the same account every time you open the app
4149

4250
### Same Account, Same Funds
51+
4352
Since your account address is deterministic (based on the credential ID), you'll always get the same address:
53+
4454
- Same passkey → Same credential ID → Same account address
4555
- Your funds stay in the same account
4656

4757
## Using the App
4858

4959
### First Time
60+
5061
1. Open the app
5162
2. Create a passkey with your name
5263
3. Deploy account (get your address)
5364
4. Fund your account via faucet
5465
5. Send transactions
5566

5667
### Subsequent Visits
68+
5769
1. Open the app
5870
2.**Passkey and account automatically loaded!**
5971
3. Your balance is displayed
@@ -75,6 +87,7 @@ If you want to start over with a new passkey:
7587
### Where Are Passkeys Actually Stored?
7688

7789
The actual passkey (private key) is stored by your browser/OS:
90+
7891
- **Chrome**: Settings → Password Manager → Passkeys
7992
- **Safari**: Settings → Passwords → [Website]
8093
- **Windows**: Windows Hello
@@ -83,18 +96,21 @@ The actual passkey (private key) is stored by your browser/OS:
8396
### Why Does the App Save Data?
8497

8598
The app saves:
99+
86100
- **Public key** (not secret, needed for transactions)
87101
- **Credential ID** (not secret, identifies which passkey to use)
88102
- **Account address** (not secret, your smart account address)
89103

90104
This allows the app to:
105+
91106
1. Know which passkey to request when signing
92107
2. Calculate the correct account address
93108
3. Show your account state immediately
94109

95110
## Security Notes
96111

97112
### ✅ Safe to Store
113+
98114
- Public key coordinates (x, y)
99115
- Credential ID
100116
- Account address
@@ -103,11 +119,13 @@ This allows the app to:
103119
These are not secret values and cannot be used to access your account without the actual passkey authentication.
104120

105121
### 🔒 Never Stored
122+
106123
- Private key (stays in device authenticator)
107124
- Passkey authentication results
108125
- Transaction signatures (generated on-demand)
109126

110127
### Data Persistence
128+
111129
- Stored in browser localStorage
112130
- Persists across browser sessions
113131
- Cleared if you:
@@ -118,16 +136,21 @@ These are not secret values and cannot be used to access your account without th
118136
## Multi-Device Support
119137

120138
### Same Browser, Same Device
139+
121140
✅ Passkey and account data persist
122141

123142
### Different Browser, Same Device
143+
124144
⚠️ Need to authenticate with the same passkey
145+
125146
- The passkey exists on your device
126147
- But localStorage is per-browser
127148
- Just authenticate when prompted, and the app will reconstruct the state
128149

129150
### Different Device
151+
130152
❌ Passkey doesn't transfer automatically
153+
131154
- Passkeys are device-bound by default
132155
- You'd need to:
133156
1. Create a new passkey on the new device (will generate a different account)
@@ -151,6 +174,7 @@ These are not secret values and cannot be used to access your account without th
151174
```
152175

153176
### Address Calculation
177+
154178
The account address is deterministically calculated from the credential ID:
155179

156180
```javascript
@@ -159,11 +183,14 @@ accountAddress = CREATE2(factory, accountId, initCodeHash)
159183
```
160184

161185
This means:
186+
162187
- Same credential ID → Same account address
163188
- Different credential ID → Different account address
164189

165190
### Signing Transactions
191+
166192
Even though public key data is stored, signing still requires:
193+
167194
1. WebAuthn authentication (biometric/PIN)
168195
2. Device authenticator generates signature
169196
3. Signature is used once and discarded
@@ -173,29 +200,39 @@ The app cannot sign transactions without your explicit authentication each time.
173200
## FAQ
174201

175202
### Q: Is it safe to store passkey data in localStorage?
176-
**A**: Yes! The data stored is public information (public key, credential ID). The private key never leaves your device's secure authenticator.
203+
204+
**A**: Yes! The data stored is public information (public key, credential ID).
205+
The private key never leaves your device's secure authenticator.
177206

178207
### Q: What if I clear my browser data?
179-
**A**: The app's stored data is cleared, but your passkey still exists in your browser's password manager. Just authenticate again when prompted.
208+
209+
**A**: The app's stored data is cleared, but your passkey still exists in your browser's password manager.
210+
Just authenticate again when prompted.
180211

181212
### Q: Can I use the same passkey on multiple devices?
213+
182214
**A**: Depends on your passkey provider:
215+
183216
- iCloud Keychain: Syncs across Apple devices
184217
- Google Password Manager: Syncs across devices
185218
- Platform authenticator: Device-specific
186219

187220
### Q: What if someone accesses my localStorage?
221+
188222
**A**: They would see your public key and account address, but they cannot:
223+
189224
- Sign transactions (need your biometric/device authentication)
190225
- Access your private key (stored in secure enclave)
191226
- Steal your funds (need passkey authentication for every transaction)
192227

193228
### Q: Do I need to fund a new account every time?
229+
194230
**A**: No! With passkey reuse, you use the same account and funds persist.
195231

196232
## Example Flow
197233

198234
### Session 1: Initial Setup
235+
199236
```
200237
1. Open app → No saved data
201238
2. Create passkey → Saved to localStorage
@@ -207,6 +244,7 @@ The app cannot sign transactions without your explicit authentication each time.
207244
```
208245

209246
### Session 2: Return Later
247+
210248
```
211249
1. Open app → Loads saved passkey ✅
212250
2. Shows account address ✅
@@ -219,17 +257,21 @@ No need to recreate passkey or refund account!
219257
## Troubleshooting
220258

221259
### "Passkey not found" when signing
260+
222261
- The passkey was deleted from browser's password manager
223262
- Click "Reset Passkey" and create a new one
224263
- Note: New passkey = New account address
225264

226265
### "Stored data corrupted"
266+
227267
- App automatically clears corrupted data
228268
- Create a new passkey
229269

230270
### Want to start fresh
271+
231272
- Click "Reset Passkey" button
232273
- Or manually clear localStorage:
274+
233275
```javascript
234276
localStorage.removeItem('zksync_passkey_data');
235277
localStorage.removeItem('zksync_account_address');

0 commit comments

Comments
 (0)