Unable to sign in with a passkey without using biometrics.

[martijnvdwal]

Question

When signing in with a passkey, you can specify how the authenticator should verify the user. Setting this value to preferred will allow the user to use biometrics (face scan or fingerprint), or use the device passcode/pincode. Setting the value to required will block any requests not using biometrics.

Currently I am seeing this is set to required, this is the response when trying to sign in with a passkey without biometrics:

{
    "error": {
        "code": "bad_request",
        "message": "User verification required, but user could not be verified"
    }
}

This is of course a decision Vercel has made. On the one hand this is more secure, but on the other it restricts some users from signing in on devices that don't have biometrics, or the user didn't want to or couldn't use biometrics. If this trade off was made to increase security that's fine with me, but I think you can be more clear to the user about why the sign in has failed.

This is your current response:

Two things about this message:

1. "Passkey" doesn't need to be capitalised, the FIDO Alliance want it to be just like the word "password", its a noun and therefore doesn't need capitalisation mid sentence.
2. The user does not understand what went wrong to receive this message. On their end they got the promt to sign in with a passkey, authenticated using a password/pin, and then get an error. They will try again (because it says to do so) to find themselves in the same situation.

What I would recommend: set userVerification to preferred, or let the user know that the request failed because they did not use biometrics.

Here are some additional resources about userVerification:

• userVerification deep dive
• Passkey definition
• userVerification W3C specification

[swarnava]

Hi Martijn,

Thank you for sharing detailed feedback about passkey implementation. I have forwarded it to relevant team to make sure they can iterate this in future. Keep them coming! :)

[martijnvdwal]

Glad to help! :)

Also perhaps consider even google.com has userVerification set to preferred. You could maybe also only require userVerification if the login seems suspicious in any way (other IP address/location or something)

[swarnava]

Thank you!