Prevent Failed Passkey Logins

​

1. Why predict before the prompt

• Prompts that cannot or rarely succeed: a device-bound passkey created with Windows Hello on a Windows PC is offered on an iPhone, where it cannot work, or an Apple passkey is offered on an Android phone, where the login has a very low success probability.
• In-app browsers: the login page opens inside an app such as Google or Instagram, where the passkey prompt fails at once.
• Unexpected QR codes: the passkey lives on a phone and the computer shows a QR code without warning, or cannot reach a phone at all.
• Credential managers out of reach: a Google Password Manager passkey in Safari on an iPhone, or a password manager extension that is missing in this browser.
• Retry loops: users try the same failing passkey again and again before they give up or call support.

​

2. What the prediction uses

​

3. Four routes

​

4. Impact

• In-app browsers: the largest lever. Deployments with many logins from inside apps reach the upper end of the range.
• How users retry: where users repeat a failing passkey several times, stopping the loop saves the most.
• Passkeys from other ecosystems: many users with device-bound Windows Hello passkeys or with passkeys on a phone of another platform add impossible and phone-only combinations.
• Password and credential managers out of reach: passkeys saved in a third-party password manager or a credential manager that is not available on the current device or in this browser, for example a missing browser extension.
• Existing checks in your login: rules your login already applies before the prompt reduce what is left to prevent.

​

5. Integration

{
  "observeContext": "<Observe context of the login browser, unchanged>",
  "credentials": [
    { "credentialID": "kHn4X0eW2vM8pL3qRtYuIA" },
    {
      "credentialID": "pR7c1T9yQx2LmVb8NfKzJw",
      "transports": ["hybrid", "internal"],
      "registrationUserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) ..."
    }
  ]
}

{
  "verdict": "phone",
  "reason": "phone-needed",
  "retryPolicy": { "maxTries": 3, "switchAfterInstantFailure": true }
}

​

6. Example: PingAM and PingOne Advanced Identity Cloud

var OBSERVE_URL = 'https://api.cloud.corbado.io/v1/observe/passkeyIntelligence';
var OBSERVE_KEY = systemEnv.getProperty('esv.observe.api.key');

function credentialIds() {
  var identity = idRepository.getIdentity(nodeState.get('username'));
  var profiles = identity ? identity.getAttributeValues('webauthnDeviceProfiles') || [] : [];
  return profiles.map(function (p) { return JSON.parse(String(p)).credentialId; });
}

function observeContext() {
  // Alternative when the cookie does not reach the journey host: an earlier node sends a
  // HiddenValueCallback, the Observe snippet on the page fills it with the context and that
  // node stores it in nodeState. Then read it here with nodeState.get('observeContext').
  var raw = requestCookies.get('cbo_observe_context');
  var match = raw ? /[A-Za-z0-9_\-]{20,1024}/.exec(String(raw)) : null;
  return match ? match[0] : null;
}

function verdict() {
  try {
    var context = observeContext();
    var ids = credentialIds();
    if (!context || !ids.length) return null;
    var response = httpClient.send(OBSERVE_URL, {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      token: OBSERVE_KEY,
      body: JSON.stringify({
        observeContext: context,
        credentials: ids.map(function (id) { return { credentialID: id }; }),
      }),
    }).get();
    if (response.status !== 200) return null;
    var result = JSON.parse(response.text());
    return result.reason === 'session-not-ready' ? null : result.verdict;
  } catch (e) {
    return null; // never log the exception text, it can contain request headers
  }
}

var v = verdict();
if (v === 'fallback') {
  action.goTo('fallback');
} else {
  action.goTo('passkey'); // local, phone, try-once or no answer
}

• Script inputs: next-generation Scripted Decision nodes only see declared inputs. Declare * so the node can read the account lookup.
• API key: pass it with the token option of httpClient and keep it in a secret or ESV. A manual Authorization header is rejected.
• Cookie scope: the cookie is set on the host of the login page. It reaches the journey when the hosted login page and the journey run on the same host. Otherwise pass the context through a HiddenValueCallback into nodeState, as the comment in the script shows.
• Phone verdict: to announce the QR code, add a message node on the phone outcome before WebAuthn Authentication.

​

Next steps