Understanding the login flow
When a wallet interface requests authentication, it issues a challenge to the client. The challenge is sent to the hardware device which signs it using a private key stored securely on the device. The signed response proves ownership without revealing the key material. This is sometimes called challenge-response or signed authentication. Because signing happens on-device, even a compromised host cannot fabricate signatures without physical access to the hardware.
Session tokens typically accompany this signing process. After the device proves ownership, the server issues a short-lived token to the browser to maintain the session. Keep sessions ephemeral; avoid long-lived tokens where possible, and use stringent refresh logic, especially for sensitive operations like withdrawals.
Passphrases add a layer of deniability and privacy. A passphrase combines with your recovery seed to derive a different set of keys. Use passphrases deliberately — losing them means losing access, and sharing them undermines their security value.
For mobile dApps, connectors (like WebUSB, WebHID, or dedicated native bridges) create secure channels between the host app and the Trezor device. Users should only approve connector requests from trusted domains and verify the origin in their browser before consenting.