QuantumNous/new-api · error · Error

Passkey verification is not supported in this environment

Error message

Passkey verification is not supported in this environment

What it means

Thrown by verifyPasskey() when navigator is undefined or navigator.credentials is missing, i.e. the WebAuthn API is not available in the current browsing context. WebAuthn requires a secure context and a reasonably modern browser, so this fires before any network or credential operation.

Source

Thrown at web/src/features/auth/secure-verification/api.ts:131

  })

  if (!res.data?.success) {
    throw new Error(res.data?.message || i18next.t('Verification failed'))
  }
  if (!res.data.data?.proof_token) {
    throw new Error(i18next.t('Verification proof was not returned'))
  }
  return res.data.data
}

/**
 * Perform Passkey verification flow.
 */
async function verifyPasskey(
  scope: SecurityProofScope
): Promise<SecurityProof> {
  if (typeof navigator === 'undefined' || !navigator.credentials) {
    throw new Error(
      i18next.t('Passkey verification is not supported in this environment')
    )
  }

  try {
    const beginResponse = await beginPasskeyVerification(scope)
    if (!beginResponse.success) {
      throw new Error(
        beginResponse.message || i18next.t('Failed to start verification')
      )
    }

    const publicKey = prepareCredentialRequestOptions(
      beginResponse.data?.options ?? beginResponse.data
    )
    const flowToken = beginResponse.data?.flow_token
    if (!flowToken) {
      throw new Error(i18next.t('Verification flow expired'))

View on GitHub (pinned to e2c7aa7b10)

Solutions

1. Serve the site over HTTPS (or use http://localhost, which is a secure context).
2. Feature-detect WebAuthn before showing the passkey option and hide/disable it when unsupported.
3. Upgrade to a browser that supports WebAuthn (all evergreen browsers since ~2018-2020).
4. If embedded in an iframe, add allow="publickey-credentials-get" to the iframe element.

Example fix

// before
<button onClick={() => verify('passkey', scope)}>Use Passkey</button>

// after
const passkeySupported =
  typeof navigator !== 'undefined' &&
  !!navigator.credentials &&
  !!window.PublicKeyCredential

{passkeySupported && (
  <button onClick={() => verify('passkey', scope)}>Use Passkey</button>
)}

const passkeyAvailable =
  typeof navigator !== 'undefined' &&
  !!navigator.credentials &&
  !!window.PublicKeyCredential
if (!passkeyAvailable) {
  hidePasskeyOption() // fall back to 2FA code UI
}

const supportsWebAuthn = (): boolean =>
  typeof navigator !== 'undefined' &&
  'credentials' in navigator &&
  typeof window.PublicKeyCredential !== 'undefined'

When it happens

Trigger: Running the app over plain http on a non-localhost host; very old browsers without WebAuthn; non-browser JS environments (SSR, webview shells) where navigator.credentials is absent; incognito/embedded browsers that disable the API.

Common situations: Dev deployment accessed via http://192.168.x.x from a phone; corporate webviews; testing in an old Evergreen/Safari version; iframe embedding without allow='publickey-credentials-get'.

Related errors

• Failed to start verification
• Verification flow expired
• Passkey verification was cancelled
• Unable to build Passkey assertion
• Passkey verification failed

AI-assisted analysis of QuantumNous/new-api@e2c7aa7b10 (2026-08-15). Data as JSON: /api/errors/57e5381fe3b7ba5b. Report an issue: GitHub.