> ## Documentation Index
> Fetch the complete documentation index at: https://turnkey-0e7c1f5b-9-digit-updates.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a User Passkey Session

> A passkey session is an expiring session enabled by an initial passkey authentication. You could think of this as a 

By calling `createPasskeySession()`, the SDK stores the resulting auth bundle in local storage for later retrieval, and also returns it to the caller. If you don't want to rely on `getActiveClient()` (a helper method within `@turnkey/sdk-react` to retrieve active Turnkey clients) and instead want to manage the stampers yourself, you can inject the auth bundle into the iframe — see the [code](https://github.com/tkhq/sdk/blob/b04de6258b2617b4c303c2b9797d4b30322461a3/packages/sdk-react/src/contexts/TurnkeyContext.tsx#L47-L74) for specifics.

## Steps using `@turnkey/sdk-react`

This process is made the most seamless by leveraging our [React package](/sdks/react). Read on for a non-React implementation.

<Steps>
  <Step title="Initialize the React Provider">
    ```js theme={"system"}
    import { TurnkeyProvider } from "@turnkey/sdk-react";
    const turnkeyConfig = {
      apiBaseUrl: "https://api.turnkey.com",
      defaultOrganizationId: process.env.TURNKEY_ORGANIZATION_ID, // prefix with NEXT_PUBLIC for NextJS
      rpId: process.env.RPID, // your application's domain
      iframeUrl: "https://auth.turnkey.com"
    }

    ...

    <div className="App">
      <TurnkeyProvider config={turnkeyConfig}>
      // Rest of app ...
      </TurnkeyProvider>
    </div>
    ```
  </Step>

  <Step title="Call the createPasskeySession function">
    ```js theme={"system"}
    import { useTurnkey } from "@turnkey/sdk-react";
    const { turnkey, passkeyClient, authIframeClient } = useTurnkey();
    const currentUser = await turnkey?.getCurrentUser(); // this assumes the user has already logged in via passkeyClient?.login()`}
    const authBundle = await passkeyClient?.createPasskeySession(
      currentUser?.userId!,
      authIframeClient?.iframePublicKey!,
      "900", // seconds. 900 == 15 minutes, but can be configured to any value
    );
    ```
  </Step>

  <Step title="Use the passkey session for read and write requests">
    ```js theme={"system"}
    const { getActiveClient } = useTurnkey();
    const currentClient = await getActiveClient();
    // make arbitrary requests
    const whoami = await currentClient.getWhoami({ organizationId: <your org ID> })
    ```

    Note: `getActiveClient()` is a helper method designed to abstract away the need to check if a passkey session is still valid. If it has expired, this will default to the `passkeyClient`, in which case users will sign each request using their passkey.
  </Step>
</Steps>

## Alternative Steps (non-React)

<Steps>
  <Step title="Initialize the Passkey Client">
    ```js theme={"system"}
    import { Turnkey } from "@turnkey/sdk-browser";
    const turnkey = new Turnkey({
      apiBaseUrl: "https://api.turnkey.com",
      defaultOrganizationId: process.env.TURNKEY_ORGANIZATION_ID,
    });
    const passkeyClient = turnkey.passkeyClient();
    ```
  </Step>

  <Step title="Call the createPasskeySession function">
    ```js theme={"system"}
    const currentUser = await turnkey.getCurrentUser(); // this assumes the user has already logged in via passkeyClient.login()`}
    const authIframeClient = await turnkey.iframeClient({
      iframeContainer: document.getElementById("<iframe container id>"),
      iframeUrl: "https://auth.turnkey.com",
    });
    const authBundle = await passkeyClient.createPasskeySession(
      currentUser?.userId!,
      authIframeClient?.iframePublicKey!,
      "900", // seconds. 900 == 15 minutes, but can be configured to any value
    );
    ```
  </Step>

  <Step title="Use the passkey session for read and write requests">
    ```js theme={"system"}
    if (authBundle) { // authBundle was generated in Step 2
      const injected = await authIframeClient.injectCredentialBundle(
        authBundle
      );
      if (injected) {
        const whoamiResponse = await authIframeClient.getWhoami({
          organizationId:
            currentUser?.organization.organizationId ??
            turnkey?.config.defaultOrganizationId!,
        });
        // if whoamiResponse is valid, you now have a working passkey session in the authIframeClient
        await authIframeClient... // perform arbitrary requests
      }
    }
    ```
  </Step>
</Steps>