> ## Documentation Index
> Fetch the complete documentation index at: https://docs.agentcard.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# Skip the code with a passkey

> After a user adds a card, the wallet offers to save a passkey. From then on, that device opens expired wallet links with Face ID instead of a texted code.

Your users verify with a texted code the first time they use the wallet. They shouldn't have to keep doing it. After a user adds a card, the wallet offers to save a passkey. If they accept, their device remembers them: the next time your agent sends a wallet link and the user gets to it late, they unlock the wallet with Face ID or their device PIN instead of asking you for a fresh link.

You don't build any of this. It's the same hosted wallet page, being less annoying the second time.

## What the user sees

Right after their card is added, the wallet asks once: save a passkey to skip the code next time. One tap, Face ID, done. If they say "not now," the wallet doesn't ask again on that device.

Later, when they open a wallet link that has expired, the expired screen offers to unlock with the passkey instead of telling them to request a new link. One tap and they're in their wallet.

## What it changes for you

Less than you'd think, and all of it good:

* Fewer "the link expired, send me a new one" round trips through your agent.
* Nothing new to integrate. No API surface, no webhook, no flag. Passkey unlocks show up as the same session your links already produce.
* Your links work exactly as before. A passkey never extends what a link could do; it only skips the re-delivery when the same user comes back on the same device.

## What a passkey can and can't do

A passkey unlock grants exactly what opening a fresh link would have granted: a short-lived wallet session for that user, under your connection. It works only on the wallet's own domain, the browser requires Face ID or a PIN on every unlock, and the challenge behind each unlock is single-use.

It never overrides a decision you or we made. A revoked link stays dead. A disconnected user stays disconnected. Only plain time expiry is forgiven.

## If the user loses their passkey

Nothing is stranded. A user with no working passkey falls back to exactly where they started: your agent sends a fresh wallet link, and money-moving actions still verify with a texted code when we need them to. Passkeys reduce codes; they were never the only door. Users can also remove a passkey from their account at any time.

Next: [Hosted wallet link](/platforms/hosted-link)