{"record":{"id":"24e8e69c60d0497a","repo":"QuantumNous/new-api","slug":"passkey-verification-is-not-available-in-the-curre","errorCode":null,"errorMessage":"Passkey verification is not available in the current state","messagePattern":"Passkey verification is not available in the current state","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"warning","filePath":"web/src/features/auth/secure-verification/api.ts","lineNumber":184,"sourceCode":"    if (!finishResponse.success) {\n      throw new Error(\n        finishResponse.message || i18next.t('Passkey verification failed')\n      )\n    }\n\n    if (!finishResponse.data?.proof_token) {\n      throw new Error(i18next.t('Verification proof was not returned'))\n    }\n    return finishResponse.data\n  } catch (error: unknown) {\n    if (error instanceof DOMException && error.name === 'NotAllowedError') {\n      throw new Error(\n        i18next.t('Passkey verification was cancelled or timed out'),\n        { cause: error }\n      )\n    }\n    if (error instanceof DOMException && error.name === 'InvalidStateError') {\n      throw new Error(\n        i18next.t('Passkey verification is not available in the current state'),\n        { cause: error }\n      )\n    }\n    throw error\n  }\n}\n","sourceCodeStart":166,"sourceCodeEnd":192,"githubUrl":"https://github.com/QuantumNous/new-api/blob/e2c7aa7b102c2075eae2377df3508658d45e88dc/web/src/features/auth/secure-verification/api.ts#L166-L192","documentation":"Thrown from the catch in verifyPasskey() when the WebAuthn call rejects with a DOMException named InvalidStateError. The spec defines this for operations on credentials that are in an invalid state — most commonly re-using a credential that is already registered, or the authenticator being in a state that forbids the requested operation. The original exception is kept as cause.","triggerScenarios":"navigator.credentials.get() with an allowList credential whose state is invalid on the authenticator; racing a second credentials.get() while one is pending on some browsers; platform authenticator locked by a prior in-flight ceremony.","commonSituations":"Double-triggered verification (button double-click firing two ceremonies); security key left in a half-finished state from a previous aborted flow (replug fixes it); browser bug after tab sleep/resume.","solutions":["Make the passkey button idempotent: disable it while a ceremony is in flight so only one credentials.get() runs.","Retry once — transient authenticator state usually clears.","Unplug/replug the security key or re-trigger platform-authenticator availability.","If persistent, re-register the passkey (the stored credential may be in a bad state server-side)."],"exampleFix":"// before\n<button onClick={handlePasskey}>Use Passkey</button>\n\n// after\nconst [busy, setBusy] = useState(false)\n<button\n  disabled={busy}\n  onClick={async () => {\n    setBusy(true)\n    try { await verify('passkey', scope) } finally { setBusy(false) }\n  }}\n>\n  Use Passkey\n</button>","handlingStrategy":"try-catch","validationCode":"// guard against concurrent ceremonies\nif (busyRef.current) return\nbusyRef.current = true\ntry {\n  await verify('passkey', scope)\n} finally {\n  busyRef.current = false\n}","typeGuard":"const isInvalidStateError = (e: unknown): boolean =>\n  e instanceof DOMException && e.name === 'InvalidStateError'","tryCatchPattern":"try {\n  await verify('passkey', scope)\n} catch (e) {\n  if (isInvalidStateError(e)) {\n    await sleep(250)\n    return verify('passkey', scope) // single retry after authenticator settles\n  }\n  throw e\n}","preventionTips":["Disable the passkey button while a ceremony is in flight (no double-trigger)","Retry once after a short delay; transient authenticator state clears itself","Replug security keys or re-register the passkey if errors persist"],"tags":["passkey","webauthn","dom-exception","concurrency"],"backgroundTag":null,"analyzedSha":"e2c7aa7b102c2075eae2377df3508658d45e88dc","analyzedAt":"2026-08-15T10:35:18.111Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}