Console and passkey wallet

The Tenzro console at /console is the quickest way onto Network 1. You sign in with a passkey, and that one step creates your identity and your wallet. There is nothing to download, no key file and no seed phrase.

Sign in

1. Open the console wallet and choose to create an account.
2. Your browser asks you to create a passkey for Tenzro. Approve it with your fingerprint, face or device PIN.
3. The console creates your account and shows your DID, your account address and your balance.

Behind that single prompt, three things happen:

• An identity. Your human DID, did:tenzro:human:<id>, is derived from the passkey's public key. The same passkey always gives the same DID.
• A wallet. A smart account is deployed for you, with the passkey installed as its primary signer. The account address stays the same when you add or replace devices later.
• A published account record. The account's DID, address, allowed device credentials, policy and guardians are published as public keys and ids only. Nothing in the record can sign.

To sign in again on the same device, choose sign in and approve the passkey prompt. On a new device, choose sign in and use the phone that holds your passkey: the browser shows a QR code, you scan it and approve on the phone.

User verification is required

Every signature needs user verification: a biometric or the device PIN, checked by the authenticator itself. An assertion made with user presence alone (a tap without verification) is refused. This applies to signing in, sending funds and every change to who can sign for the account.

Passkey tiers

Not all passkeys are equal, and Network 1 treats them differently.

The tier is read from the authenticator's backup flags when the passkey is created, and recorded with the device. If your first passkey is a synced one, add a device-bound passkey or guardians before the account can send. See Device linking and recovery.

Every operation is hybrid

Every operation the passkey approves carries two signatures over the same operation hash:

• a P-256 WebAuthn assertion from the authenticator, and
• an ML-DSA-65 signature from a post-quantum key for that same credential.

The ML-DSA-65 key is derived from the passkey on demand during the ceremony, used in memory and wiped. It is never stored, so there is nothing extra to back up. The account's validator checks both legs as one composite signature bound to the account; an operation missing either leg is rejected. See Hardware-rooted keys and Cryptography.

Changes to who can sign

Adding a device, removing a device, changing the signing policy, granting a session key, setting a spending limit, adding a hardware signer and adding a guardian are custody changes. Each one needs a fresh passkey ceremony from a device already on the account:

1. The node issues a challenge bound to the account, the operation and its target.
2. A device already enrolled on the account signs the challenge (P-256 and ML-DSA-65, with user verification).
3. The node checks the signature and applies the change. The challenge is single-use and expires after a few minutes.

The account address is public and is never treated as proof of anything. A signed-in console session lets you read and send within your limits; it never authorises a custody change on its own.

Get TNZO from the faucet

TNZO pays every network fee. To try things out, open the faucet in the console, pick your account (or one of your agents' accounts) and request TNZO. The console shows the transaction and your new balance once it lands. Requests are rate limited per address.

You can also call the faucet directly:

curl -s -X POST https://api.tenzro.xyz/faucet \
  -H 'content-type: application/json' \
  -d '{"address":"0xYourAccount"}'

What else the console does

• Wallet: your TNZO and stablecoin balances, sends and linked devices. See Wallet.
• Agents: create agents that act for you under a delegation scope and spending limits. See Agents.
• Scan, status and hub: blocks, transactions, network status, models and providers.

From the command line

The CLI runs the same ceremony in your browser and waits for the result:

# Create an account with a passkey
tenzro passkey login --display-name "Alice"

# List the devices enrolled on an account
tenzro passkey list --account-address 0xYourAccount

# Approve an operation hash with a passkey
tenzro passkey sign --account-address 0xYourAccount --op-hash-hex 0x...

If the machine running the CLI has no authenticator, the ceremony page shows a QR code so you can complete it on your phone.

Build it into your own app

The same flow is available to any application through tenzro-sdk. See Hardware signer SDK.