Skip to main content
In short: you create a passkey (Face ID, Touch ID or a security key) when you first sign in, and your wallet signs one message that links it to you. When you press Start, the console asks for the passkey once and then approves runs for 24 hours. Today those approvals are recorded and checked, but they are not required. A run without one still starts. A passkey does not sign you in and it does not own your account. Google, or email and password, still sign you in. Your wallet still owns the account.

​
How you set it up

The console walks you through it the first time you use a wallet.
  1. Create a passkey. The browser asks for Face ID, Touch ID or a security key. The passkey stays on your device and works only on app.defiloops.com.
  2. Connect your wallet and sign once. That single signature names your passkey. It links the passkey to your wallet, so nothing else can claim to be you.
  3. Add a backup passkey. This step is optional. A second device or a security key covers the loss of the first.
If you lose every passkey, your wallet signs again to name a new one. Without the wallet, nobody can add a passkey for you.

​
What happens when you press Start

The first press in a browser asks for your passkey. That certifies a key held in the browser for 24 hours. Every approval in those 24 hours is silent. Only a press approves. Opening a chat, loading a page or letting an agent arm something signs nothing. An item the agent armed shows an Approve button, and your press approves that one item. If you change a plan, the console asks you to approve it again.
An approval covers what you pressed. It does not carry a per-operation prompt. You approve a plan or a standing order, not each transaction inside it.

​
What the approvals do today

The console sends each approval to the enclave. The enclave checks the whole chain: your wallet’s link, the passkey, the browser key and the approval. It records whether a run was approved.
The enclave does not yet refuse a run you did not approve. It runs in a watching mode. If you cancel the passkey prompt, or the check fails, the run still starts and the console shows a hint. Until the mode changes, an approval is evidence that you asked. It is not a lock.

​
Why it exists

The enclave bounds what our side can sign, but it cannot tell whether you asked for a run. An approval you made with your own passkey closes that gap once the enclave requires it. We are building toward that. We have not switched it on, because every run path has to carry an approval first, including saved strategies, resting orders and runs started by an outside agent. When it is required, a run without your approval will stop to ask instead of being destroyed. Cancels and unwinds will stay allowed.

​
Under the hood

For integrators.
  • The passkey is checked as WebAuthn with user verification required. A challenge works once. A signature counter that does not advance is refused and the credential is flagged.
  • The wallet signs one typed message (EIP-712) that names the passkey. Further passkeys are endorsed by an active one.
  • The browser key is a P-256 key certified by a passkey assertion for 24 hours. It signs each approval, and the enclave verifies the chain without trusting our servers.
  • Wallet-based agents and outside agents carry no passkey. Their consent follows a separate path.