Skip to content

Passkey Unavailable On Origin

URI: https://docs.ankatech.co/errors/passkey-unavailable-on-origin
HTTP Status: 409 Conflict

When you see this

A passkey ceremony was asked for while the console is open on an address of the deployment that is not its Management host name, such as the host's IP address. Nothing was issued or changed.

A passkey is bound to its WebAuthn relying party, whose identifier is the Management host name; a browser refuses an IP address as a relying party identifier (W3C WebAuthn Level 3, RP ID). On the IP origin the platform therefore offers no passkey: the sign-in answer states passkey_available: false with passkey_unavailable_reason: origin-not-relying-party, and offers password + TOTP where the authentication posture admits it. A passkey ceremony asked for anyway is refused with this type, before any challenge is issued.

A deployment installed in quick-start mode has no Management host name at all until an operator sets one, and so no relying party: its console at https://localhost:9443 offers no passkey on any origin, the sign-in answer states passkey_unavailable_reason: no-relying-party, and this type is answered for every passkey ceremony. The body, from auth-api or admin-api, carries extensions.reason no-relying-party (origin-not-relying-party on another origin of a deployment that has a host name). The console receives auth-api's body, whose detail reads "Passkeys and single sign-on are not available yet. Passkeys and single sign-on become available after an administrator sets the deployment's Management host name."; admin-api's own detail, on the service-to-service call, reads "Passkeys are unavailable: no Management host name is set for this deployment. They become available once an operator sets one."

The answer carries no Retry-After: it stays the same until the console is opened on the Management host name (or, on a quick-start deployment, until a host name is set), where the same request succeeds. The same answer ends a sign-in, an activation, a recovery enrolment or an invitation whose remaining requirement only a passkey can meet, when it runs on such an address; no credential was refused.

Common Causes

  • The console was opened at https://<host-ip>/, the Management IP origin, and a passkey was chosen (sign-in, or a passkey registration on the Security page).
  • The person's tenant or the platform requires a passkey, and the console is open on the IP origin.
  • The deployment was installed in quick-start mode and no Management host name has been set yet.

Response Example

{
  "type": "https://docs.ankatech.co/errors/passkey-unavailable-on-origin",
  "title": "Passkey Unavailable On This Address",
  "status": 409,
  "detail": "Passkeys cannot be used on this address of the deployment. Open the console on the deployment's host name to use a passkey, or sign in with a password and an authenticator app.",
  "instance": "/api/v3/auth/account/authenticators/passkeys/registration-options",
  "timestamp": 1792236600,
  "extensions": {
    "reason": "origin-not-relying-party"
  }
}

On a deployment with no Management host name:

{
  "type": "https://docs.ankatech.co/errors/passkey-unavailable-on-origin",
  "title": "Passkey Unavailable On This Address",
  "status": 409,
  "detail": "Passkeys and single sign-on are not available yet. Passkeys and single sign-on become available after an administrator sets the deployment's Management host name.",
  "instance": "/api/v3/auth/account/authenticators/passkeys/registration-options",
  "timestamp": 1792236600,
  "extensions": {
    "reason": "no-relying-party"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details. This is an Auth API body: its one extension member is extensions.reason, and it carries no correlation member: correlate through the X-Correlation-Id response header. See Error Index & Overview.

How to Resolve

  1. Open the console on the deployment's Management host name (https://admin-<env>.<domain>/admin/ by default, or the name the environment was created with) and use the passkey there.
  2. On the IP origin, sign in with a password and an authenticator app where the authentication posture admits it.
  3. If the deployment has no Management host name that resolves yet, add the DNS record (or a hosts entry) first; see Network configuration*.
  4. On a quick-start deployment, an operator sets the host name with sudo envctl.sh <env> set-management-host <name>; passkeys are then available on it. Until then, sign in with a password and an authenticator app.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.

* restricted content — see higher-tier documentation