stellar-sdk/com.soneso.stellar.sdk.smartaccount.oz/OZWalletOperations/authenticatePasskey

authenticatePasskey

suspend fun authenticatePasskey(challenge: ByteArray? = null, credentialIds: List<String>? = null): AuthenticatePasskeyResult

Authenticates with a passkey without connecting to a wallet.

Use this when you need to authenticate the user before deciding which contract to connect to, or for signing operations that don't require a connected wallet state.

This method performs a WebAuthn authentication ceremony and returns the credential ID, signature, and public key without modifying the kit's connection state.

Typical usage patterns:

Authenticate first, then discover contracts via indexer
Authenticate for multi-signer operations
Pre-authenticate before contract selection

Flow:

Check for WebAuthn provider
Generate random challenge (32 bytes)
Call WebAuthn authentication (no credential filter - allow all)
Extract signature from authentication result
Normalize signature (DER to compact, low-S)
Build WebAuthnSignature from normalized signature
Look up stored credential for public key (best effort)
Return result without modifying kit state

IMPORTANT: Requires a WebAuthnProvider to be configured in the kit config. Throws WEBAUTHN_NOT_SUPPORTED if no provider is configured.

Return

AuthenticatePasskeyResult with credential ID, signature, and public key

Parameters

challenge

Optional challenge bytes to sign. If null, generates random 32 bytes. Use this for specific transaction authorization flows.

credentialIds

Optional list of allowed credential IDs (Base64URL-encoded). If provided, only these credentials can be used for authentication.

Throws

WebAuthnException

if authentication fails or no provider configured

ValidationException

if signature normalization fails

Example:

// Step 1: Authenticate to get credential ID
val authResult = walletOps.authenticatePasskey()
println("Authenticated with credential: ${authResult.credentialId}")

// Step 2: Discover contracts via indexer
val response = kit.indexerClient?.lookupByCredentialId(authResult.credentialId)

// Step 3: Connect to the first contract found
val firstContract = response?.contracts?.firstOrNull()
if (firstContract != null) {
    val connected = walletOps.connectWallet(
        ConnectWalletOptions(
            credentialId = authResult.credentialId,
            contractId = firstContract.contractId
        )
    )
}