Authentication assurance
Security
Passkeys, sessions, linked wallets, recovery, and alerts are modelled as separate security controls.
Authentication is not yet implemented
Connected is not authenticated. No production SIWS challenge, WebAuthn credential, durable session, recovery method, or wallet ownership proof exists.
Developer acceptance aidLOCAL FIXTURE · passkey flow simulator
OFFThis is not a passkey or production authentication
The demo creates no WebAuthn credential and uses no authenticator, wallet, private key, seed, signature, chain, or financial function. It derives a deliberately fake test assertion from public challenge data for the API's in-memory fixture adapter.
Disabled. Enable the explicit local fixture flags and a loopback API origin.
Requires development mode, NEXT_PUBLIC_DATA_MODE=fixture, NEXT_PUBLIC_PASSKEY_FIXTURE_DEMO_ENABLED=true, and an explicitly configured loopback API. Fixture identity and server session state are disposable.Phishing resistant
Passkeys
0 enrolled
Real passkey-first signup still requires WebAuthn RP/origin binding and durable, protected credential storage. The local simulator above does not satisfy this.
Device visibility
Active sessions
0 sessions
No authenticated session exists. Device metadata shown in a future list must be privacy bounded.
Ownership proof
Linked wallets
0 proved
External wallets will require single-use, domain-bound SIWS challenges. Connection alone will never count.
Account recovery
Recovery state
Not configured
Recovery policy and provider boundaries require explicit approval before implementation.