Console and passkey wallet

The Tenzro console at /console is the quickest way onto Tenzro Network. You sign in with a passkey, and that one step creates your identity and your wallet. There is nothing to download, no key file and no seed phrase.

Sign in

1. Open the console wallet and choose to create an account.
2. Your browser asks you to create a passkey for Tenzro. Approve it with your fingerprint, face or device PIN.
3. The console creates your account and shows your DID, your account address and your balance.

Behind that single prompt, three things happen:

• An identity. Your human DID, did:tenzro:human:<id>, is derived from the passkey's public key. The same passkey always gives the same DID.
• A wallet. A smart account is deployed for you, with the passkey installed as its primary signer. The account address stays the same when you add or replace devices later.
• A published account record. The account's DID, address, allowed device credentials, policy and guardians are published as public keys and ids only. Nothing in the record can sign.

To sign in again on the same device, choose sign in and approve the passkey prompt. On a new device, choose sign in and use the phone that holds your passkey: the browser shows a QR code, you scan it and approve on the phone.

User verification is required

Every signature needs user verification: a biometric or the device PIN, checked by the authenticator itself. An assertion made with user presence alone (a tap without verification) is refused. This applies to signing in, sending funds and every change to who can sign for the account.

Passkey tiers

Not all passkeys are equal, and Tenzro Network treats them differently.

The tier is read from the authenticator's backup flags when the passkey is created, and recorded with the device. If your first passkey is a synced one, add a device-bound passkey or guardians before the account can send. See Device linking and recovery.

Every operation is hybrid

Every operation the passkey approves carries two signatures over the same operation hash:

• a P-256 WebAuthn assertion from the authenticator, and
• an ML-DSA-65 signature from a post-quantum key for that same credential.

The ML-DSA-65 key is derived from the passkey on demand during the ceremony, used in memory and wiped. It is never stored, so there is nothing extra to back up. The account's validator checks both legs as one composite signature bound to the account; an operation missing either leg is rejected. See Hardware-rooted keys and Cryptography.

Changes to who can sign

Adding a device, removing a device, changing the signing policy and naming recovery signers are keystore changes. Each one is a KeystoreUpdate transaction approved by a passkey already on the account, sent from the account and paid from its balance; until the account holds TNZO, a wallet provider's sponsor can send it and pay. Custody operations that are not keystore changes, such as creating an agent, need a fresh passkey ceremony:

1. The node issues a challenge bound to the account, the operation and its target.
2. A device already enrolled on the account signs the challenge (P-256 and ML-DSA-65, with user verification).
3. The node checks the signature and applies the change. The challenge is single-use and expires after a few minutes.

The account address is public and is never treated as proof of anything. A signed-in console session lets you read and send within your limits; it never authorises a custody change on its own.

Fund your account

TNZO pays every network fee. To fund your account, or one of your agents' accounts, transfer TNZO to its address from another wallet or account. The console shows your new balance once the transfer lands.

What else the console does

• Wallet: your TNZO and stablecoin balances, sends and linked devices. See Wallet.
• Agents: create agents that act for you under a delegation scope and spending limits. See Agents.
• Scan, status and hub: blocks, transactions, network status, models and providers.

From the command line

The CLI runs the same ceremony in your browser and waits for the result:

# Create an account with a passkey
tenzro passkey login --display-name "Alice"

# Show the account's keystore: its passkeys, policy and recovery signers
tenzro passkey keystore 0xYourAccount

If the machine running the CLI has no authenticator, the ceremony page shows a QR code so you can complete it on your phone.

Build it into your own app

The same flow is available to any application through tenzro-sdk. See Hardware signer SDK.