# Mission 8 — Permissions, Passkeys and the Web Authenticator

> Use Vaulta's permission system and the Blocksfinity Web Authenticator to add a convenient browser-based credential (passkey).

Canonical: https://help.blockzhub.io/articles/mission-8-permissions-passkeys-and-the-web-authenticator

[In Chapter 4](https://help.blockzhub.io/articles/chapter-4-your-vaulta-account-identity-keys-and-permissions), we learned that your Vaulta account does not live inside a wallet or Authenticator. The account and its permissions exist directly on the Vaulta blockchain. A wallet, Authenticator, private key or passkey is simply a way to provide the cryptographic authority required by one of those permissions.

In this mission, we going to continue to put that model into practice.

We will create a passkey, add its public key to the active permission of your Vaulta account, and then use the Blocksfinity Web Authenticator so that normal day-to-day access can happen directly through your browser instead of opening the Blocksfinity Authenticator app each time.

Before doing that, we need quickly revisit again what we are actually changing.

## Remember owner and active

Every standard Vaulta account has two important permissions: owner and active.

The owner permission is the highest standard authority on the account. It can be used to change lower permissions, including recovering control if an active credential is lost or compromised. Because of that power, the credential protecting owner should be kept highly secure and used rarely.

The active permission is intended for normal account activity such as transfers, staking, voting and smart-contract interactions.

If you want a refresher before continuing, revisit the following two chapters:

[Chapter 4 — Your Vaulta Account: Identity, Keys and Permissions](https://help.blockzhub.io/articles/chapter-4-your-vaulta-account-identity-keys-and-permissions)

[Chapter 5 — What Is a Wallet and an Authenticator? Hot vs. Cold](https://help.blockzhub.io/articles/chapter-5-what-is-a-wallet-and-an-authenticator-hot-vs-cold)

Key idea: A permission is an on-chain authority rule. A keypair or passkey is a credential that can satisfy that rule.

For this mission, we will add the passkey only to the active permission. Do not use this exercise to replace your owner credential with a passkey.

Your independently protected owner private key should remain your higher-security recovery path.

## Vaulta permissions can point to different keys

A Vaulta account is not permanently tied to one private key.

The blockchain records the public keys and authority rules associated with each permission. The corresponding private keys remain outside the blockchain.

That means you can change which keypair controls a permission.

As a first introductory step before we start the mission, lets discover the permission feature on Blocksfinity a bit deeper.

[In Blocksfinity, open Keys & Permissions](https://www.blocksfinity.com/wallet/permissions). The current interface provides both a Simple and an Advanced view.

In the Simple view, as you already know from [mission 7,](https://help.blockzhub.io/articles/mission-7-backup-recover-and-ensure-separate-permission-keys) you can generate a new keypair for owner or active. This can be useful when you deliberately want to rotate a normal keypair—for example, replacing an old active or owner  keypair with a new one that you will store and use through the Blocksfinity Authenticator app. Or it can be useful if you just want to create a new keypair:

If you want to practice again, click “Generate keys” to see how Blocksfinity creates a new keypair and take a moment to explore the information shown on screen.

For now, do not click “Change permission.” We are only exploring one more time how key generation works. The keypair created during this exercise will not be used, so you can safely discard it afterward.

If you have more than one keypair for a permission, use the Advanced view.

The Advanced view exposes more of Vaulta's permission system directly. A permission can contain multiple authorization entries, and those entries can have different weights and a required threshold.

For now, open “Change permission (only needed for linking)” and explore how the permission settings change when you select owner versus active.

Do not make or submit any changes yet. The goal is simply to become familiar with how the two permissions are displayed and configured on Blocksfinity.

In this mission, we are not replacing the existing active keypair. Instead, we will add another credential to the existing active permission: the public key belonging to a passkey.

That gives us another convenient way to satisfy the same active authority while keeping the existing key as an independent access path.

## What is a passkey?

A passkey is based on the Web Authentication standard, usually called WebAuthn.

Like the keypairs you already learned about, a WebAuthn credential uses public-key cryptography.

A public/private keypair is created by an authenticator or passkey provider. The public part can be registered with the service that needs to verify you. The private part remains under the control of the authenticator and is used to create signatures when you approve an authentication request.

The website does not need to receive your passkey private key. WebAuthn is specifically designed so the authenticator holds the credential while the web application receives cryptographic proof that the correct credential was used. [W3C](https://www.w3.org/TR/webauthn/)

With Blocksfinity, the public part of the passkey is represented as a Vaulta WebAuthn public key beginning with:

PUB_WA_...

Creating the passkey alone does not give it control over your Vaulta account.

First, that PUB_WA_... public key must be added to one of the account's on-chain permissions. In this mission, we will add it to active.

## Why use a passkey?

The main advantage is convenience.

With the private key you previously imported into the Blocksfinity Authenticator app, Blocksfinity sends a signing or authentication request to the Authenticator and you approve it there.

With the browser-based passkey setup in this mission, the Web Authenticator can use the passkey available to the current browser/device. For everyday use, this can be faster and more comfortable because you do not need to launch the separate Authenticator application each time.

But convenience changes the recovery model.

## A passkey is not your recovery key

For the specific Blocksfinity passkey flow used in this guide, you should treat the credential as local and non-exportable.

The current Blocksfinity guide states that this passkey cannot be copied, exported or recovered through Blocksfinity and is intended for the browser/profile and device where it was created. Losing the relevant device or local browser credential can therefore remove this method of access.

Passkey technology in general can also support synchronized credentials through operating-system or password-manager providers, so you should not assume that every WebAuthn implementation behaves identically.

For this mission, use the conservative security rule:

Important: Treat the passkey as a convenient active credential, not as your account's recovery mechanism.

Keep a separate private key that you control and have securely backed up.

Most importantly, retain and securely back up the private key controlling your owner permission.

When we [created our Vaulta account](https://help.blockzhub.io/articles/create-your-vaulta-account), we already generated and securely backed up our original private key. And later, in [Mission 7 — Back Up, Recover, and Ensure Separate Permission Keys](https://help.blockzhub.io/articles/mission-7-backup-recover-and-ensure-separate-permission-keys), we generated a new owner keypair to ensure that the owner and active permissions use separate keys. We also created and tested recovery certificates for both private keys, ensuring we can restore them if they are ever lost.

We will also keep the existing active key in place while adding the passkey. If the browser passkey later becomes unavailable, your existing active key pair stored in your Blocksfinity app or your separately protected owner authority still provides another path to control the account.

The goal is therefore not:

Passkey replaces my account keys

It is:

Existing owner keypair (highly protected owner authority, securely backed up) → recovery

Existing active keypair in your Authenticator app → independent everyday access

New Passkey keypair on active → Additional convenient browser-based everyday access

Now that you understand what the permission change means and why we are keeping another recovery path, we can start this mission.

## Add and Use a Passkey with Blocksfinity for Your Vaulta Account

How to create a passkey for a specific browser and device, add its public key to your Vaulta account, and use the passkey to log in to Blocksfinity Explorer.

Note for anyone who doesn’t have a Vaulta account yet: Before you can add a passkey to a Vaulta account, [create a Vaulta account](https://help.blockzhub.io/articles/create-your-vaulta-account) and [import your private key into the Blocksfinity Authenticator app](https://help.blockzhub.io/articles/how-to-import-a-private-key-into-the-blocksfinity-authenticator-app).

Important: The passkey created in this process is stored locally and tied to the specific browser/profile and device where it is created. It cannot be recovered if the local credential is lost.

If you clear the browser or site data associated with the Blocksfinity Authenticator application, reset or delete the browser profile, reinstall the browser, reset the device, or lose the device, access through this passkey will be permanently lost.

Do not rely on this passkey as the only key on an account permission. Keep another authorized key or recovery method available.

## Step 1 — Create or unlock your Blocksfinity Authenticator vault

Open Blocksfinity Authenticator at auth.blocksfinity.com in the browser and on the device where you want to use the passkey.

If this is your first time using Blocksfinity Authenticator in this browser, create a vault and set a master password. The master password cannot be recovered, so store it securely.

One vault can hold keys associated with multiple Vaulta blockchain accounts.

Create a strong master password of at least 16 characters, using a mix of uppercase and lowercase letters, numbers, and special characters. Enter it again under Confirm Password, then click “Create vault.”

This password protects access to the private keys stored inside your Authenticator.

Important: The master password cannot be reset or recovered. Blocksfinity does not know your password and cannot restore it for you. Store it securely before continuing.

Your master password is different from your blockchain private key. The master password unlocks the Authenticator vault on your browser on your device; the private key is the cryptographic credential used to authorize actions for your blockchain account.

## Step 2 — Select “Add passkey”

In the Blocksfinity Authenticator:

- Select Add from the menu.

- Select Add passkey.

This starts the process of creating a new device/browser passkey for a Vaulta account.

## Step 3 — Select the Vaulta account and permission

Configure the passkey:

- Network: Select Vaulta.

- Account: Enter the Vaulta account name the passkey will be associated with. In our example this is supportacc1h

- Permission: Select the permission the passkey should be allowed to sign for, such as active.

For normal account operations, the active permission is typically used rather than owner.

Before continuing, review the passkey warning carefully.

The passkey created here:

- cannot be exported, copied, or recovered;

- is intended for this device and browser only;

- may be lost if the browser/site data is cleared or the device is lost;

- should not be the only authorization method available for the account.

Check the confirmation box and select Create passkey.

## Step 4 — Save the passkey on the device

Your operating system will ask where the passkey should be stored.

On Windows for example, confirm that the passkey will be saved to the Windows device, then select Continue.

The operating system security will then ask you to verify your identity, for example in Windows with your Windows Hello PIN.

Enter the PIN to authorize creation of the passkey.

## Step 5 — Copy the new passkey public key

After the passkey is created, Blocksfinity Authenticator displays its public key, beginning with PUB_WA_.

At this stage, the passkey exists on the device bound to the specific browser you are using, but it is not yet authorized to sign for the Vaulta account.

The public key must first be added to the selected account permission on-chain.

Select Copy key to copy the PUB_WA_... public key:

The passkey now exists on the device, but it cannot sign for the Vaulta account until its PUB_WA_... public key is added to the account's permission on-chain.

For this example, the new passkey public key is the PUB_WA_... key created in Step 3-5.

You will use the an existing keypair already imported into Blocksfinity Authenticator to authorize this account-permission change.

Important: Updating account permissions changes which keys control the Vaulta account. Verify the account, permission, existing keys, new key, weights, and threshold carefully before signing. Do not remove the existing key while adding the passkey.

## Step 6 — Log in to Blocksfinity with the Authenticator app

Go to the Blocksfinity Keys & Permissions page:

https://www.blocksfinity.com/wallet/permissions

Click Login in the upper-right corner.

Select Blocksfinity Authenticator as the wallet you want to use to log in.

Blocksfinity will open an authentication request. Select Open in the Authenticator app.

If the Blocksfinity Authenticator app does not open automatically, open the app on your computer and then select Open in the Authenticator app again.

In the Blocksfinity Authenticator app:

- Under Sign as, select the Vaulta account and permission you want to use. In our example this is supportacc1h@active.

- Enter your Authenticator master password.

- Select Approve login.

You are now logged in to Blocksfinity with the existing keypair (here with supportacc1h with the active permission) stored in the Blocksfinity Authenticator app.

## Step 7 — Add the passkey public key to the active permission

On the Blocksfinity Explorer Keys & Permissions page, select the Advanced tab.

Under Change permission, select active.

You should see the public key we are using right now with the Authenticator App that already controls the account's active permission.

Select Add new permission to add another key to the existing active permission.

For the new entry:

- Permission type: Select Key.

- Public key: Paste the PUB_WA_... public key that you copied in Step 5.

- Weight: Enter 1.

Do not remove the existing public key. The goal is to add the passkey as an additional authorization method.

In our example, the active permission now contains two keys:

- the existing PUB_K1_... key; and

- the new PUB_WA_... passkey public key.

The threshold remains 1, and each key has a weight of 1. This means either key can independently satisfy the active permission.

After verifying the keys, weights, and threshold, select Update.

Important: Changing account permissions is security-sensitive. An incorrect threshold, weight, or key configuration can lock you out of the account. Verify that your existing key remains present before continuing.

## Step 8 — Confirm the permission update

Blocksfinity will display a warning asking you to confirm the permission change.

Review the change carefully.

If everything is correct, select Update keys.

This creates an on-chain transaction that updates the Vaulta account's authorization configuration.

## Step 9 — Sign the permission update with the Authenticator app

Blocksfinity now needs the existing authorized key to sign the permission update.

Select Open in the Authenticator app.

The Blocksfinity Authenticator app will display an Approve transaction request.

Confirm that the correct account is selected. In our example:

supportacc1h@active

Before signing, review the transaction details.

Scroll through the transaction and verify the eosio::updateauth action.

In our example, it shows:

- Account: supportacc1h

- Permission: active

- Parent: owner

- Threshold: 1

- Keys: 2

This confirms that the transaction is updating the active permission and that two keys will be associated with it.

If the transaction details are correct, select Sign.

After the transaction is successfully signed and submitted, Blocksfinity Authenticator displays Signed together with the transaction ID.

## Step 10 — Verify that the passkey was added on-chain

Return to Blocksfinity and open the account's Keys information: [https://www.blocksfinity.com/account](https://www.blocksfinity.com/account), scroll down to “Chain Data” and click “Keys”.

Under the active permission, you should now see both:

- the original PUB_K1_... public key; and

- the new PUB_WA_... passkey public key.

The presence of the PUB_WA_... key under the active permission confirms that the passkey is now authorized on-chain for this Vaulta account.

The passkey can now be used to authenticate as this account from the browser/profile and device where the passkey was created.

## Step 11 — Log out of the existing Authenticator session

Before testing the new passkey, log out of the session.

Open the account menu in Blocksfinity and select Logout All.

Blocksfinity should return to the logged-out state and show Login in the upper-right corner.

You are now ready to test logging in with the newly added passkey.

## Step 12 — Start a new Blocksfinity login

After logging out from the previous Authenticator-app session, return to Blocksfinity.

Select Login in the upper-right corner.

This time, the goal is to authenticate with the passkey stored in this browser/profile and on this device, rather than using the private key through the Blocksfinity Authenticator app.

## Step 13 — Select Blocksfinity Authenticator

In the wallet selection window, select Blocksfinity Authenticator.

Blocksfinity will open the authentication request.

## Step 14 — Choose “Sign in this browser instead”

The authentication window initially offers the option to sign using the Blocksfinity Authenticator app on another device.

Because you want to use the passkey stored in the current browser/device, do not select Open in the Authenticator app or Sign on my phone.

Instead, select:

Sign in this broswer instead

This switches the login flow to the Blocksfinity Authenticator stored locally in the current browser/profile.

## Step 15 — Unlock the Authenticator in this browser

Enter the master password for the Blocksfinity Authenticator vault in this browser.

Then select Unlock.

The master password unlocks the local Blocksfinity Authenticator environment so it can process the login request.

Important: Continue in the same browser/profile and on the same device where the passkey was created in Steps 1–5.

## Step 16 — Approve the login with the passkey-enabled account

The Approve login screen will appear.

Under Account, verify that the correct Vaulta account and permission are selected.

In our example:

supportacc1h@active

Because the PUB_WA_... passkey public key was added to the active permission in the previous steps, the browser-local passkey can now authorize this permission.

Select Approve login.

Important: Make sure you are using the same account permission to which you added the passkey. In our example, this is supportacc1h@active.

## Step 17 — Return to Blocksfinity and verify the login

After the login is approved, the authentication window displays:

Login approved. You can close this window.

Select Return to [www.blocksfinity.com](http://www.blocksfinity.com).

Back in Blocksfinity, verify that the account appears in the upper-right corner.

In our example, Blocksfinity shows:

supportacc1h — active

This confirms that the Vaulta account has been successfully logged in using the passkey available in this browser/device.

## Result

The passkey is now configured and working for the Vaulta account's active permission.

You have completed the full process:

- Created the passkey in a specific browser/profile and device.

- Copied its PUB_WA_... public key.

- Added that public key to the Vaulta account's active permission on-chain.

- Authorized the permission update using the existing private key in Blocksfinity Authenticator.

- Logged out of the existing session.

- Logged back in using the browser/device passkey for supportacc1h@active.

Remember: This passkey depends on the local credential stored for this browser/profile and device. If that credential is deleted or lost, this passkey access is lost. Keep another authorized account key or recovery method available.