{"record":{"id":"0a369ca0bc365fdf","repo":"QuantumNous/new-api","slug":"failed-to-start-verification","errorCode":null,"errorMessage":"Failed to start verification","messagePattern":"Failed to start verification","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"web/src/features/auth/secure-verification/api.ts","lineNumber":139,"sourceCode":"  return res.data.data\n}\n\n/**\n * Perform Passkey verification flow.\n */\nasync function verifyPasskey(\n  scope: SecurityProofScope\n): Promise<SecurityProof> {\n  if (typeof navigator === 'undefined' || !navigator.credentials) {\n    throw new Error(\n      i18next.t('Passkey verification is not supported in this environment')\n    )\n  }\n\n  try {\n    const beginResponse = await beginPasskeyVerification(scope)\n    if (!beginResponse.success) {\n      throw new Error(\n        beginResponse.message || i18next.t('Failed to start verification')\n      )\n    }\n\n    const publicKey = prepareCredentialRequestOptions(\n      beginResponse.data?.options ?? beginResponse.data\n    )\n    const flowToken = beginResponse.data?.flow_token\n    if (!flowToken) {\n      throw new Error(i18next.t('Verification flow expired'))\n    }\n\n    const credential = (await navigator.credentials.get({\n      publicKey,\n    })) as PublicKeyCredential | null\n\n    if (!credential) {\n      throw new Error(i18next.t('Passkey verification was cancelled'))","sourceCodeStart":121,"sourceCodeEnd":157,"githubUrl":"https://github.com/QuantumNous/new-api/blob/e2c7aa7b102c2075eae2377df3508658d45e88dc/web/src/features/auth/secure-verification/api.ts#L121-L157","documentation":"Fallback thrown in verifyPasskey() when the call to beginPasskeyVerification(scope) (the begin endpoint) responds with success falsy and no message. The server refused to start the WebAuthn ceremony, so no credential request options were produced. The server's message, when present, replaces this generic string.","triggerScenarios":"POST to the passkey begin endpoint failing server-side: no passkey registered for the account, invalid/expired session, backend WebAuthn config (RP ID/origin) broken, or the scope has no pending operation.","commonSituations":"User tries passkey verification but never registered a passkey; backend relying-party origin changed after a domain migration so stored credentials no longer match; session cookie lost mid-flow.","solutions":["Inspect the begin request's response body — the message usually says whether it is 'no passkey registered' or a config error.","Confirm the user actually has a registered passkey (offer 2FA as fallback).","Check backend WebAuthn/RP ID and origin configuration matches the current domain and scheme.","Re-authenticate if the session expired, then retry."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  const proof = await verify('passkey', scope)\n  return proof.proof_token\n} catch (e) {\n  const msg = getErrorMessage(e)\n  if (/not registered|no passkey/i.test(msg)) {\n    switchTo2FAMethod() // graceful fallback\n  } else {\n    toast.error(msg)\n  }\n}","preventionTips":["Only offer passkey verification when the account has a registered passkey (query status first)","Keep backend RP ID/origin config in sync with the serving domain","Propagate server messages so users see the real reason, not the fallback"],"tags":["passkey","webauthn","api-response","frontend"],"backgroundTag":null,"analyzedSha":"e2c7aa7b102c2075eae2377df3508658d45e88dc","analyzedAt":"2026-08-15T10:35:18.111Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}