Sign in on a phone
Add QR sign-in from desktop to phone, push approval with number matching, trusted devices, recovery and native passkeys.
Status Status is where the work is: Planned (in a milestone, not started), Building (tickets in progress), Preview (usable, may change), then the stability it ships at.
Stability The promise an interface ships with.
- Stable Follows semantic versioning; breaking changes need a new major, 12 months of overlap and a codemod.
- Beta Usable in production; may change before it becomes stable.
- Experimental May change or go away; needs an explicit opt-in in main.yaml.
You will add the phone-side sign-in flows to an app that already has passkeys. It takes about 30 minutes.
You need
- The mobile target from Build a mobile app with Expo, with
auth.passkeys.rpIdset.
1. Sign in a desktop from a phone with a QR code
QrSignIn starts a one-time code that lives 60 seconds. The desktop shows it as a QR code; the signed-in phone scans it, describe shows what is being approved, approve binds it to the person, and the desktop redeems it once. A malformed, expired or reused code fails with MAIN-AUTH-0102.
2. Ask the phone to approve a sign-in
PushApproval sends a prompt with a two-digit number. The person must pick the same number on the sign-in page; a wrong number or a deny raises an mfa-fatigue event in OCSF form, and too many prompts in the window fail with MAIN-AUTH-0103.
3. Trust devices and recover accounts
TrustedDevices lists devices, ties sessions to them and revokes them; a revoked device fails with MAIN-AUTH-0105. Recovery accepts a recovery code, a second passkey or a verified email or WhatsApp, then waits before it finishes so the owner can cancel (MAIN-AUTH-0104).
4. Use the passkey from the app
signInNative asks the platform for an assertion and accepts the web origin and the Android app's android:apk-key-hash origin for the same credential. mainsdk sync writes assetlinks.json and apple-app-site-association from targets.mobile.signing; mainsdk check fails with MAIN-AUTH-0101 when they disagree.
Check that it works
- Scan a code twice: the second scan fails.
- Answer a push prompt with the wrong number: the sign-in fails and an event is logged.
Was this page helpful?