Skip to content

Passkey Unavailable On Origin

URI: https://docs.ankatech.co/errors/passkey-unavailable-on-origin
HTTP Status: 409 Conflict

When you see this

A passkey ceremony was asked for while the console is open on an address of the deployment that is not its Management host name, such as the host's IP address. Nothing was issued or changed.

A passkey is bound to its WebAuthn relying party, whose identifier is the Management host name; a browser refuses an IP address as a relying party identifier (W3C WebAuthn Level 3, RP ID). On the IP origin the platform therefore offers no passkey: the sign-in answer states passkey_available: false with passkey_unavailable_reason: origin-not-relying-party, and offers password + TOTP where the authentication posture admits it. A passkey ceremony asked for anyway is refused with this type, before any challenge is issued.

The answer carries no Retry-After: it stays the same until the console is opened on the Management host name, where the same request succeeds. The same answer ends a sign-in, an activation, a recovery enrolment or an invitation whose remaining requirement only a passkey can meet, when it runs on such an address; no credential was refused.

Common Causes

  • The console was opened at https://<host-ip>/, the Management IP origin, and a passkey was chosen (sign-in, or a passkey registration on the Security page).
  • The person's tenant or the platform requires a passkey, and the console is open on the IP origin.

Response Example

{
  "type": "https://docs.ankatech.co/errors/passkey-unavailable-on-origin",
  "title": "Passkey Unavailable On This Address",
  "status": 409,
  "detail": "Passkeys cannot be used on this address of the deployment. Open the console on the deployment's host name to use a passkey, or sign in with a password and an authenticator app.",
  "instance": "/api/v3/auth/account/authenticators/passkeys/registration-options",
  "timestamp": 1792236600
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details. This is an Auth API body, so it carries no correlation member: correlate through the X-Correlation-Id response header. See Error Index & Overview.

How to Resolve

  1. Open the console on the deployment's Management host name (https://admin-<env>.<domain>/admin/ by default, or the name the environment was created with) and use the passkey there.
  2. On the IP origin, sign in with a password and an authenticator app where the authentication posture admits it.
  3. If the deployment has no Management host name that resolves yet, add the DNS record (or a hosts entry) first; see Network configuration*.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.

* restricted content — see higher-tier documentation