{"record":{"id":"22052cab5adaf1ea","repo":"bitwarden/server","slug":"passkeys-cannot-be-created-for-your-account-sso-l","errorCode":null,"errorMessage":"Passkeys cannot be created for your account. SSO login is required.","messagePattern":"Passkeys cannot be created for your account\\. SSO login is required\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"src/Api/Auth/Controllers/WebAuthnController.cs","lineNumber":129,"sourceCode":"            throw new BadRequestException(\"The token associated with your request is expired. A valid token is required to continue.\");\n        }\n\n        var credential = await _createWebAuthnLoginCredentialCommand.CreateWebAuthnLoginCredentialAsync(user, model.Name, tokenable.Options, model.DeviceResponse, model.SupportsPrf, model.EncryptedUserKey, model.EncryptedPublicKey, model.EncryptedPrivateKey);\n        if (credential == null)\n        {\n            throw new BadRequestException(\"Unable to complete WebAuthn registration.\");\n        }\n\n        return new WebAuthnCredentialResponseModel(credential);\n    }\n\n    private async Task ValidateIfUserCanUsePasskeyLogin(Guid userId)\n    {\n        var requireSsoPolicyRequirement = await _policyRequirementQuery.GetAsyncVNext<RequireSsoPolicyRequirement>(userId);\n\n        if (!requireSsoPolicyRequirement.CanUsePasskeyLogin)\n        {\n            throw new BadRequestException(\"Passkeys cannot be created for your account. SSO login is required.\");\n        }\n    }\n\n    [Authorize(Policies.Application)]\n    [HttpPut()]\n    public async Task UpdateCredential([FromBody] WebAuthnLoginCredentialUpdateRequestModel model)\n    {\n        var tokenable = _assertionOptionsDataProtector.Unprotect(model.Token);\n        if (!tokenable.TokenIsValid(WebAuthnLoginAssertionOptionsScope.UpdateKeySet) || tokenable.Options == null)\n        {\n            throw new BadRequestException(\"The token associated with your request is invalid or has expired. A valid token is required to continue.\");\n        }\n\n        var (_, credential) = await _assertWebAuthnLoginCredentialCommand.AssertWebAuthnLoginCredential(tokenable.Options, model.DeviceResponse);\n        if (credential == null || credential.SupportsPrf != true)\n        {\n            throw new BadRequestException(\"Unable to update credential.\");\n        }","sourceCodeStart":111,"sourceCodeEnd":147,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/src/Api/Auth/Controllers/WebAuthnController.cs#L111-L147","documentation":"BadRequestException 'Passkeys cannot be created for your account. SSO login is required.' is thrown in ValidateIfUserCanUsePasskeyLogin when the RequireSsoPolicyRequirement.CanUsePasskeyLogin flag is false for the user. This organization policy (Require Sso) disallows passkey creation for affected users.","triggerScenarios":"POST /webauthn (passkey creation, line 129) by a user who is a member of an organization that enforces the Require Sso policy, which sets CanUsePasskeyLogin = false. The check runs before credential creation.","commonSituations":"Org admin enabled the 'Require Sso' policy, the user is now forced to log in via SSO and cannot create new passkeys, or the policy was applied org-wide and the user attempted a local passkey setup.","solutions":["Disable or exclude the user from the organization's Require Sso policy if passkey login is intended.","Have the user authenticate via SSO instead of creating a passkey.","Confirm with an org admin whether the policy is intended for this user.","If the policy is wrong, the admin updates it and the user retries after policy refresh."],"exampleFix":"// before: policy enforced, user tries passkey\napi.post('/webauthn', { ... }) // 400\n// after: org admin disables Require Sso\n// admin: orgPolicyApi.put(orgId, { type: 'requireSso', enabled: false })\n// user retries after policy sync\napi.post('/webauthn', { ... });","handlingStrategy":"validation","validationCode":"const req = await policyService.getRequireSsoRequirement(userId);\nif (!req.canUsePasskeyLogin) throw new Error('SSO required; passkey creation blocked by policy');","typeGuard":null,"tryCatchPattern":"try { await api.post('/webauthn', model); }\ncatch (e) {\n  if (e.response?.status === 400 && /SSO login is required/.test(e.response.data?.message)) {\n    throw new UserFacingError('Your organization requires SSO; passkeys are disabled. Contact an admin.');\n  }\n  throw e;\n}","preventionTips":["Check the Require Sso policy status before offering passkey setup.","Route affected users to SSO login instead.","Have admins review whether the policy should apply to the user."],"tags":["webauthn","passkey","sso","policy"],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}