HTTPS is required in all production environments. WebAuthn (the standard underlying passkeys) will not operate on pages served over plain HTTP. You can use
localhost without HTTPS during local development.Web SDK — @socketfi/react
The web SDK targets React applications running in modern browsers. It handles authentication via a hosted popup flow and exposes authenticate(), requestTransaction(), and readContract().
Supported frameworks
Installation
Initialization
Supported browsers
The web SDK requires a browser with WebAuthn support. The following table lists the minimum confirmed versions.Server-side rendering (SSR)
SocketFi works with SSR frameworks like Next.js and Remix. Authentication and transaction flows must run on the client — use dynamic imports or client-only guards where necessary.React Native SDK — @socketfi/react-native
The React Native SDK brings SocketFi authentication and transactions to iOS and Android apps. Authentication opens in the device’s system browser and returns to your app via deep link.
Supported runtimes
Supported platforms
Installation
Deep link configuration (Expo)
Add your app’s custom URL scheme toapp.json. This scheme is required for the authentication flow to return to your app after the user approves in the system browser.
Session storage on mobile
Use secure device storage rather thanlocalStorage. expo-secure-store encrypts values using the platform’s native keystore.
Server SDK — @socketfi/server
The server SDK is a lightweight Node.js package that exposes verifyAuth() for server-side token verification. It is framework-agnostic — use it with any Node.js server runtime.
Supported runtimes
Supported frameworks
The server SDK works with any framework that can receive HTTP requests and read headers. The following have been tested:Installation
Usage
WebAuthn and passkey requirements
SocketFi’s authentication layer is built on WebAuthn (FIDO2). The following conditions must be met for passkeys to work:Secure context
The page or app must be served over HTTPS in production.
localhost is treated as a secure context for development.Enrolled authenticator
The user’s device must have at least one biometric method or security key enrolled (Face ID, Touch ID, Windows Hello, or a FIDO2 hardware key).
Browser WebAuthn support
The browser must support the WebAuthn API. All browsers in the supported table above qualify; IE and very old browser versions do not.
Domain-scoped credentials
Passkeys are scoped to a specific domain. A passkey registered on
app.example.com cannot be used on a different domain.