[yashovardhan]

Summary

Two Embedded Wallets docs passages give developers wrong guidance that can cost users their wallets.

Project settings: client secret

• The page said the client secret can be regenerated from the dashboard if compromised. It cannot.
• Rotating it changes every wallet on the project, which means starting a new project.
• The page now says to use the secret only when a backend needs it to create wallets programmatically.

React Native migration guide (v8 to v9)

• The guide said to delete both useCoreKitKey and useSFAKey.
• @web3auth/react-native-sdk 9.0.0 and 10.0.0 still implement useCoreKitKey. When it is true, getFinalCommonPrivKey() returns coreKitKey, which is the v8 wallet. Without it, the SDK returns privKey, a different wallet.
• Apps that set useCoreKitKey: true in v8 must keep it, or existing users lose access to their funds.
• useSFAKey is a Web SDK rename and is not a React Native option, so it stays removed.

Reported on Builder Hub:

• https://builder.metamask.io/t/how-can-i-rotate-a-project-client-secret/3587
• https://builder.metamask.io/t/react-native-sdk-v8-v9-existing-users-get-a-different-wallet-unless-usecorekitkey-is-set-removed-in-the-migration-guide/3590

Made with Cursor

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
metamask-docs	Ready	Preview	Oct 20, 2026 12:17pm UTC