Issue with webauthn_verify_attestation_response Returning 401 in Android

[krunaldaveazilen]

Hi Team,

I'm testing the Flow API for registration on native Android. I’ve set up the Hanko server locally and exposed the backend port using ngrok. I also added the Android key hash under:

yaml

webauthn:
  relying_party:
    origins:
      - "http://localhost:8888"
      - "android:apk-key-hash:TyBHH9maupZHjVknwsim6o7SjRTAtqI5mZ-jTUc9-hE"

The registration flow completes successfully until the final step, webauthn_verify_attestation_response, which consistently returns a 401 Unauthorized error.

Request (cURL)

curl --location 'https://e016-14-98-189-6.ngrok-free.app/registration?action=webauthn_verify_attestation_response%40525a5c2e-15e7-4e90-9230-f0311dce5cb1' \
--header 'Content-Type: application/json' \
--header 'Cookie: hanko=...' \
--data '{ "input_data": { "public_key": { ... } }, "csrf_token": "qZ8sJc0fzmOQmTcVuQocoE1gxyy4DfEz" }'

Response

{
  "name": "success",
  "status": 401,
  "error": {
    "code": "passkey_invalid",
    "message": "The passkey is invalid."
  }
}

Note:
I'm executing all steps via Postman. After receiving the public key in webauthn_generate_creation_options, I use that value to get the PublicKeyCredentialAttestationResponse from the mobile app and pass it to webauthn_verify_attestation_response via Postman.

Any insights on why the passkey might be considered invalid?

[FreddyDevelop]

Since you are running the Hanko backend on your local machine you should see an error in the backend logs. It should look something like this:

{"level":"info","time_unix":"1741169623","id":"oyXrsoHoPHJuwOrtvTghqKYQCLqBexLU","remote_ip":"192.168.65.1","host":"localhost:8000","method":"POST","uri":"/login?action=webauthn_verify_attestation_response%402a4a9389-4151-4adb-83e3-4291e4b5e41a","user_agent":"PostmanRuntime/7.42.0","status":500,"referer":"","error":"technical_error","error_internal":"the action failed to handle the request: failed to verify attestation response: failed to parse credential creation response; Error parsing attestation response","time":"2025-03-05T10:13:43.234286248Z"}

And under the error_internal key you should have a more detailed error message.

[krunaldaveazilen]

The issue is fixed, what i was missing is, the rp id was used to be a localhost, I have added ngrok provided domain like below

webauthn:
relying_party:
id:<<ngrok_domain>>
origins:
- "http://localhost:8888"
- "android:apk-key-hash:TyBHH9maupZHjVknwsim6o7SjRTAtqI5mZ-jTUc9-hE"