QuantumNous/new-api · error · Error

Missing user data from Passkey login response

Error message

Missing user data from Passkey login response

What it means

Thrown in the Passkey sign-in flow when finishPasskeyLogin returns success:true but finish.data fails the isAuthBundle check — the server verified the credential yet did not return a complete auth bundle (token, session, user). It is the Passkey analogue of the password-login bundle guard and prevents storing a half-formed session.

Source

Thrown at web/src/features/auth/sign-in/components/user-auth-form.tsx:295

      if (!credential) {
        toast.info(t('Passkey login was cancelled'))
        return
      }

      const assertion = buildAssertionResult(credential)
      if (!assertion) {
        throw new Error(t('Invalid Passkey response'))
      }

      const finish = await finishPasskeyLogin(flowToken, assertion)
      if (!finish.success) {
        if (getServerErrorMessageKey(finish)) return
        throw new Error(finish.message || t('Failed to complete Passkey login'))
      }

      if (!isAuthBundle(finish.data)) {
        throw new Error(t('Missing user data from Passkey login response'))
      }

      await handleLoginSuccess(finish.data, redirectTo)
      toast.success(t('Signed in with Passkey'))
    } catch (error: unknown) {
      if (getServerErrorMessageKey(error)) return
      if (error instanceof DOMException && error.name === 'NotAllowedError') {
        toast.info(t('Passkey login was cancelled or timed out'))
      } else if (error instanceof Error) {
        toast.error(error.message)
      } else {
        toast.error(t('Passkey login failed'))
      }
    } finally {
      setIsPasskeyLoading(false)
    }
  }

View on GitHub (pinned to e2c7aa7b10)

Solutions

1. Capture the finish response body and diff its data against isAuthBundle's required fields.
2. Fix the backend finish handler to emit the full AuthBundle on success (same shape as password login).
3. Verify no interceptor rewrites the response; deploy frontend/backend together.
4. User workaround: sign in with password (which exercises the same bundle path) to confirm whether it is passkey-specific.

// reuse isAuthBundle as the single authority for post-login payloads
if (finish.success && !isAuthBundle(finish.data)) { /* contract violation path */ }

try {
  if (!isAuthBundle(finish.data)) throw new Error(t('Missing user data from Passkey login response'))
} catch (error) {
  if (getServerErrorMessageKey(error)) return
  toast.error(error instanceof Error ? error.message : t('Passkey login failed'))
}

When it happens

Trigger: Finish-passkey-login responds {success:true} with data missing required bundle fields (null data, no session, no user, no access_token).

Common situations: Backend bug or contract drift on the passkey finish endpoint; partial deploy mismatching frontend bundle expectations; response mangled by an interceptor or proxy.

Related errors

• Login failed
• Passkey verification is not supported in this environment
• Failed to start verification
• Verification flow expired
• Passkey verification was cancelled

AI-assisted analysis of QuantumNous/new-api@e2c7aa7b10 (2026-08-15). Data as JSON: /api/errors/03fcf1cfc83b9878. Report an issue: GitHub.