Getting started

What mera does:

Create a passkey and get 32 secret bytes from it through the PRF extension.
Derive accounts from those bytes.
Sign with a signing session.

Prerequisites:

A secure context: HTTPS, or localhost during development.
An authenticator that supports the PRF extension. Authenticator support lists the combinations known to work. 1Password and iCloud Keychain are good first choices.

Install

npm install @category-labs/mera

Create a passkey

createPasskeyWithPrfOutput creates a passkey and evaluates its PRF in one call.

import { 
function createPasskeyWithPrfOutput({ rp, user, timeout, prfSalt, webAuthnClient, }: createPasskeyWithPrfOutput.Options): Promise<createPasskeyWithPrfOutput.Result>
Creates a discoverable, user-verified passkey that requires WebAuthn PRF
support and returns the first PRF output.
@param ― options - Passkey creation inputs.
@returns ― Credential metadata and the first PRF output.
@remarks ― 
Runs one creation ceremony and shows one user-verification prompt. On
authenticators that do not evaluate PRF during creation, a fallback
assertion evaluates the same salt and shows a second prompt.
WebAuthn challenges and the credential's user handle (user.id) are
generated internally, 32 random bytes each. An authenticator overwrites a
discoverable credential that has the same rp.id and user.id, so a fresh
handle per call adds a passkey instead of replacing one.
The credential is requested with fixed parameters: ES256 or RS256 key types,
attestation "none", a required resident key, and required user
verification (getPasskeyPrfOutput explains the requirement).
Any failure after the creation ceremony completes leaves the passkey on the
authenticator, but the thrown error does not carry its metadata.
@throws ― MeraError with code PRF_UNAVAILABLE when the authenticator reports no PRF support and returns no create-time output, returns an output that is not 32 bytes, or returns none on the fallback ceremony.
@throws ― MeraError with code INPUT_INVALID when an explicit prfSalt is not 32 bytes.
@throws ― MeraError with code CRYPTO_UNAVAILABLE when crypto.getRandomValues is unavailable.
@throws ― MeraError with code PASSKEY_CANCELLED when the person dismisses a prompt, it times out, or no passkey answers.
@throws ― MeraError with code PASSKEY_OPERATION_FAILED when WebAuthn is unavailable, fails for another reason, or returns an unexpected credential.
createPasskeyWithPrfOutput } from "@category-labs/mera";

// The relying party ID, the domain the passkey is bound to.
const 
const rpId: "account.example.com"
rpId = "account.example.com";

const { 
const prfOutput: Uint8Array<ArrayBuffer>
First WebAuthn PRF output for prfSalt. Always 32 bytes.
prfOutput } = await 
function createPasskeyWithPrfOutput({ rp, user, timeout, prfSalt, webAuthnClient, }: createPasskeyWithPrfOutput.Options): Promise<createPasskeyWithPrfOutput.Result>
Creates a discoverable, user-verified passkey that requires WebAuthn PRF
support and returns the first PRF output.
@param ― options - Passkey creation inputs.
@returns ― Credential metadata and the first PRF output.
@remarks ― 
Runs one creation ceremony and shows one user-verification prompt. On
authenticators that do not evaluate PRF during creation, a fallback
assertion evaluates the same salt and shows a second prompt.
WebAuthn challenges and the credential's user handle (user.id) are
generated internally, 32 random bytes each. An authenticator overwrites a
discoverable credential that has the same rp.id and user.id, so a fresh
handle per call adds a passkey instead of replacing one.
The credential is requested with fixed parameters: ES256 or RS256 key types,
attestation "none", a required resident key, and required user
verification (getPasskeyPrfOutput explains the requirement).
Any failure after the creation ceremony completes leaves the passkey on the
authenticator, but the thrown error does not carry its metadata.
@throws ― MeraError with code PRF_UNAVAILABLE when the authenticator reports no PRF support and returns no create-time output, returns an output that is not 32 bytes, or returns none on the fallback ceremony.
@throws ― MeraError with code INPUT_INVALID when an explicit prfSalt is not 32 bytes.
@throws ― MeraError with code CRYPTO_UNAVAILABLE when crypto.getRandomValues is unavailable.
@throws ― MeraError with code PASSKEY_CANCELLED when the person dismisses a prompt, it times out, or no passkey answers.
@throws ― MeraError with code PASSKEY_OPERATION_FAILED when WebAuthn is unavailable, fails for another reason, or returns an unexpected credential.
createPasskeyWithPrfOutput({
  
rp: PasskeyRelyingParty
Relying party identity passed to WebAuthn. id is required so the
fallback assertion can target the same relying party.
rp: { 
id: string
Relying party ID: the host the passkey is scoped to.
id: 
const rpId: "account.example.com"
rpId, 
name: string
Relying party name the authenticator may show.
name: "Example" },
  
user: {
    name: string;
    displayName: string;
}
User identity passed to WebAuthn.
user: { 
name: string
User name displayed or stored by the authenticator.
name: "account@example.com", 
displayName: string
Human-readable display name for the authenticator UI.
displayName: "Example account" },
});

mera uses a stable PRF salt for this call, so a later sign-in reproduces the same 32 bytes.

Derive an account

The PRF output is the root of every account. deriveEvmPrivateKey turns it into the private key of an EVM account, numbered from 0.

import { 
function deriveEvmPrivateKey({ prfOutput, accountIndex, }: DerivePrivateKeyOptions): Uint8Array<ArrayBuffer>
Derives the private key of an EVM account from a PRF output.
@param ― options - PRF output and account index.
@returns ― A 32-byte secp256k1 private key.
@remarks ― 
The PRF output is the entropy of a 24-word BIP-39 phrase from the English
wordlist, and the phrase's seed uses an empty passphrase. The key is the
BIP-32 key at m/44'/60'/0'/0/{accountIndex} under that seed. Wallet apps
such as MetaMask use the same path, so importing the phrase into one shows
the same accounts.
The phrase exists as a JavaScript string, which cannot be zeroed, and
@scure/bip32 leaves the intermediate keys and chain codes unzeroed.
@see ― https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki BIP-39
@see ― https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki BIP-32
@see ― https://github.com/bitcoin/bips/blob/master/bip-0044.mediawiki BIP-44
@throws ― MeraError with code INPUT_INVALID when prfOutput is not 32 bytes, or accountIndex is not an integer from 0 to 2^31 - 1.
deriveEvmPrivateKey } from "@category-labs/mera";

const 
const privateKey: Uint8Array<ArrayBuffer>
privateKey = 
function deriveEvmPrivateKey({ prfOutput, accountIndex, }: DerivePrivateKeyOptions): Uint8Array<ArrayBuffer>
Derives the private key of an EVM account from a PRF output.
@param ― options - PRF output and account index.
@returns ― A 32-byte secp256k1 private key.
@remarks ― 
The PRF output is the entropy of a 24-word BIP-39 phrase from the English
wordlist, and the phrase's seed uses an empty passphrase. The key is the
BIP-32 key at m/44'/60'/0'/0/{accountIndex} under that seed. Wallet apps
such as MetaMask use the same path, so importing the phrase into one shows
the same accounts.
The phrase exists as a JavaScript string, which cannot be zeroed, and
@scure/bip32 leaves the intermediate keys and chain codes unzeroed.
@see ― https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki BIP-39
@see ― https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki BIP-32
@see ― https://github.com/bitcoin/bips/blob/master/bip-0044.mediawiki BIP-44
@throws ― MeraError with code INPUT_INVALID when prfOutput is not 32 bytes, or accountIndex is not an integer from 0 to 2^31 - 1.
deriveEvmPrivateKey({ 
prfOutput: Uint8Array<ArrayBufferLike>
PRF output used as the BIP-39 entropy. Must be exactly 32 bytes.
prfOutput, 
accountIndex: number
Account number in the derivation path, an integer from 0 to 2^31 - 1.
accountIndex: 0 });

Sign

import {
  
function createSecp256k1SigningSession({ privateKey, }: CreateSigningSessionOptions): Secp256k1SigningSession
Creates a signing session from a secp256k1 private key.
@param ― options - Signing session inputs.
@returns ― A live secp256k1 signing session.
@throws ― MeraError with code INPUT_INVALID when privateKey is not a valid secp256k1 scalar.
createSecp256k1SigningSession,
  
function getEvmAddress(publicKey: Uint8Array): EvmAddress
Derives the EIP-55 checksummed EVM address for a secp256k1 public key.
@param ― publicKey - A compressed or uncompressed secp256k1 public key.
@returns ― The EIP-55 mixed-case checksummed EVM address.
@throws ― MeraError with code INPUT_INVALID when publicKey is not valid secp256k1.
getEvmAddress,
} from "@category-labs/mera";

const 
const session: Secp256k1SigningSession
session = 
function createSecp256k1SigningSession({ privateKey, }: CreateSigningSessionOptions): Secp256k1SigningSession
Creates a signing session from a secp256k1 private key.
@param ― options - Signing session inputs.
@returns ― A live secp256k1 signing session.
@throws ― MeraError with code INPUT_INVALID when privateKey is not a valid secp256k1 scalar.
createSecp256k1SigningSession({ 
privateKey: Uint8Array<ArrayBufferLike>
Curve private key. Must be exactly 32 bytes and, for secp256k1, a valid
scalar.
privateKey });

const 
const address: `0x${string}`
address = 
function getEvmAddress(publicKey: Uint8Array): EvmAddress
Derives the EIP-55 checksummed EVM address for a secp256k1 public key.
@param ― publicKey - A compressed or uncompressed secp256k1 public key.
@returns ― The EIP-55 mixed-case checksummed EVM address.
@throws ― MeraError with code INPUT_INVALID when publicKey is not valid secp256k1.
getEvmAddress(
const session: Secp256k1SigningSession
session.
publicKey: Uint8Array<ArrayBuffer>
65-byte uncompressed secp256k1 public key for the session.
publicKey);

const 
const digest: Uint8Array<ArrayBuffer>
digest = new 
var Uint8Array: Uint8ArrayConstructor
new (length: number) => Uint8Array<ArrayBuffer> (+6 overloads)
Uint8Array(32);
const 
const signature: Secp256k1Signature
signature = 
const session: Secp256k1SigningSession
session.
function signDigest(digest32: Uint8Array): Secp256k1Signature
Signs a 32-byte digest without prehashing it.
@param ― digest32 - The digest to sign.
@returns ― A compact secp256k1 ECDSA signature with its recovery ID.
@throws ― MeraError with code INPUT_INVALID when digest32 is not 32 bytes.
@throws ― MeraError with code SESSION_ENDED after end has been called.
signDigest(
const digest: Uint8Array<ArrayBuffer>
digest);

const session: Secp256k1SigningSession
session.
function end(): void
Zeroes the session-owned private-key copy; later signing throws
SESSION_ENDED.
end();

Sign back in

A later visit reproduces the same account.

import { 
function getPasskeyPrfOutput({ rpId, credential: allowCredential, prfSalt, timeout, immediate, webAuthnClient, }: getPasskeyPrfOutput.Options): Promise<getPasskeyPrfOutput.Result>
Requests a passkey PRF evaluation and returns the first output.
@param ― options - Passkey PRF request inputs.
@returns ― The selected credential ID and first WebAuthn PRF output.
@remarks ― 
Runs one assertion ceremony and shows one user-verification prompt.
With immediate, Chrome 148 and later (as of 2026-10) and the React Native
client show nothing when the device holds no passkey for rpId. Browsers
without immediate mode ignore the option and show their usual prompt.
Without a user gesture, or in Incognito, Chrome rejects an immediate request
with the same error even when a passkey exists.
The WebAuthn challenge is generated internally.
The default salt is sha256("mera.prf.salt.v1") and will not change across
library versions. The PRF output is a deterministic function of the
credential, rpId, and salt; a different salt yields an unrelated output.
The assertion requires user verification, and the requirement is not
configurable. User verification is the authenticator's local check; the
gesture depends on the platform (a biometric, a device PIN, or a password).
Authenticators built on CTAP's hmac-secret keep two PRFs per credential,
one for user-verified requests and one for the rest; WebAuthn exposes only
the user-verified PRF and overrides a weaker userVerification setting
when evaluating it, so a configurable setting could neither change the PRF
output nor skip the check.
@see ― https://www.w3.org/TR/webauthn-3/#prf-extension WebAuthn: the PRF extension
@see ― https://www.w3.org/TR/webauthn-3/#enumdef-userverificationrequirement WebAuthn: UserVerificationRequirement
@throws ― MeraError with code PRF_UNAVAILABLE when the authenticator does not return a usable 32-byte PRF output.
@throws ― MeraError with code INPUT_INVALID when an explicit prfSalt is not 32 bytes, credential.credentialId is empty or not canonical base64url, or immediate is combined with credential.
@throws ― MeraError with code CRYPTO_UNAVAILABLE when crypto.getRandomValues is unavailable.
@throws ― MeraError with code PASSKEY_CANCELLED when the person dismisses the prompt, it times out, or no passkey answers, including an immediate request that finds none.
@throws ― MeraError with code PASSKEY_OPERATION_FAILED when WebAuthn is unavailable, fails for another reason, or returns an unexpected credential.
getPasskeyPrfOutput } from "@category-labs/mera";

const { 
const prfOutput: Uint8Array<ArrayBuffer>
First PRF output from WebAuthn. Always 32 bytes.
prfOutput } = await 
function getPasskeyPrfOutput({ rpId, credential: allowCredential, prfSalt, timeout, immediate, webAuthnClient, }: getPasskeyPrfOutput.Options): Promise<getPasskeyPrfOutput.Result>
Requests a passkey PRF evaluation and returns the first output.
@param ― options - Passkey PRF request inputs.
@returns ― The selected credential ID and first WebAuthn PRF output.
@remarks ― 
Runs one assertion ceremony and shows one user-verification prompt.
With immediate, Chrome 148 and later (as of 2026-10) and the React Native
client show nothing when the device holds no passkey for rpId. Browsers
without immediate mode ignore the option and show their usual prompt.
Without a user gesture, or in Incognito, Chrome rejects an immediate request
with the same error even when a passkey exists.
The WebAuthn challenge is generated internally.
The default salt is sha256("mera.prf.salt.v1") and will not change across
library versions. The PRF output is a deterministic function of the
credential, rpId, and salt; a different salt yields an unrelated output.
The assertion requires user verification, and the requirement is not
configurable. User verification is the authenticator's local check; the
gesture depends on the platform (a biometric, a device PIN, or a password).
Authenticators built on CTAP's hmac-secret keep two PRFs per credential,
one for user-verified requests and one for the rest; WebAuthn exposes only
the user-verified PRF and overrides a weaker userVerification setting
when evaluating it, so a configurable setting could neither change the PRF
output nor skip the check.
@see ― https://www.w3.org/TR/webauthn-3/#prf-extension WebAuthn: the PRF extension
@see ― https://www.w3.org/TR/webauthn-3/#enumdef-userverificationrequirement WebAuthn: UserVerificationRequirement
@throws ― MeraError with code PRF_UNAVAILABLE when the authenticator does not return a usable 32-byte PRF output.
@throws ― MeraError with code INPUT_INVALID when an explicit prfSalt is not 32 bytes, credential.credentialId is empty or not canonical base64url, or immediate is combined with credential.
@throws ― MeraError with code CRYPTO_UNAVAILABLE when crypto.getRandomValues is unavailable.
@throws ― MeraError with code PASSKEY_CANCELLED when the person dismisses the prompt, it times out, or no passkey answers, including an immediate request that finds none.
@throws ― MeraError with code PASSKEY_OPERATION_FAILED when WebAuthn is unavailable, fails for another reason, or returns an unexpected credential.
getPasskeyPrfOutput({
  
rpId: string
Relying party ID for the WebAuthn assertion.
rpId,
});

Without credential, the browser offers any discoverable passkey it holds for the relying party. The Create passkey accounts recipe shows the app storing the credential ID at create time and passing it back to pin later sign-ins.

Where next

Send a transaction with viem: from sign-in to a sent transaction.
Passkey accounts: how the same passkey reproduces the same accounts.
Secret vaults: use passkey PRF output to encrypt a secret, useful for cases where the secret must come from elsewhere.
Security model: what mera protects, and the risks left to the app.