Key Features
OAuth Wallets
Your OAuth account IS your wallet. Same login = same wallet across all devices. No seed phrases.
JWT Verification
On-chain RSA signature verification of JWT tokens. Ephemeral keys registered via cryptographic proof.
Gasless Transactions
Users can transact without holding ETH. All gas fees are sponsored via AVNU Paymaster.
Cross-Platform
SDKs for both web (React) and mobile (React Native) with unified APIs.
How OAuth Wallets Work
Cavos creates self-custodial wallets tied to your OAuth identity:- User authenticates with Google, Apple, Firebase email/password, or Passkey
- Provider issues JWT token with user identity (sub claim)
- Wallet address derived deterministically:
addressSeed = Poseidon(sub, salt)→ contract address - Ephemeral session key generated for transaction signing (~24 hour lifetime)
- Nonce computed:
Poseidon(eph_pubkey_lo, eph_pubkey_hi, max_block, randomness)— embedded in JWT - First transaction deploys account + registers session key via on-chain JWT verification
- All transactions signed automatically with session key — no prompts needed
[!NOTE] Your wallet address is computed from your OAuth identity. There are no private keys to manage - your Google/Apple/Firebase account IS your wallet.
Choose Your Platform
Web SDK
For React web applications. Uses WebAuthn for passkey authentication.
React Native SDK
For iOS and Android apps. Uses native passkeys with platform authenticators.
Authentication Methods
Cavos supports multiple ways to authenticate:- Google OAuth: Login with Google account
- Apple OAuth: Login with Apple ID
- Email/Password: Traditional auth with Firebase (email verification required)
- Passkey-Only: Anonymous wallets for privacy-focused apps
Quick Example
How It Works Under the Hood
First Transaction:- SDK generates session key and computes nonce (Poseidon of pubkey + max_block + randomness)
- After OAuth, JWT contains that nonce in its
nonceclaim - SDK submits calldata including the JWT bytes and Garaga RSA-2048 hint (≈864 felt252 values)
- Account contract deploys itself via AVNU Paymaster (gasless)
- Contract fetches the RSA public key from the on-chain JWKS registry (managed by Argus)
- Garaga’s
is_valid_rsa2048_sha256_signatureverifies the JWT RSA-2048 signature (~11.8M gas) - Session key is registered; transaction executes
- SDK signs with session key (lightweight signature)
- No JWT needed - key already registered
- Much cheaper gas cost
- Ephemeral keys auto-renew when they expire
Key Benefits
| Feature | Benefit |
|---|---|
| No Seed Phrases | Your OAuth account IS your wallet |
| Cross-Device | Same login = same wallet everywhere |
| Self-Custodial | You control your wallet, not Cavos |
| Gasless | Never need to buy crypto to transact |
| On-Chain Security | JWT verified on-chain, not by backend |
| Auto-Renewal | Ephemeral keys renew automatically |

