gravitational/teleport · info

device not registered for passwordless

Error message

device not registered for passwordless

What it means

errNoPasswordless is a user-friendly device filter error: during a passwordless login/registration, the device is not usable because it either lacks user verification (PIN/biometric) or resident key capability for this site — i.e. it is not registered/capable of passwordless. It filters the device out so the flow can try another device or prompt accordingly.

Source

Thrown at lib/auth/webauthncli/fido2.go:67

	fido2DeviceMaxWait = 100 * time.Millisecond

	// Timeout for blocking operations.
	// Functions fail with FIDO_ERR_RX on timeout.
	fido2DeviceTimeout = 30 * time.Second

	// Operation retry interval.
	// Keep it less frequent than 5Hz / 0.2s.
	fido2RetryInterval = 500 * time.Millisecond

	// Timeout for touch.Status operations.
	// Keep it less frequent than 5Hz / 0.2s.
	fido2TouchMaxWait = 200 * time.Millisecond
)

// User-friendly device filter errors.
var (
	errHasExcludedCredential = errors.New("device already holds a registered credential")
	errNoPasswordless        = errors.New("device not registered for passwordless")
	errNoPlatform            = errors.New("device cannot fulfill platform attachment requirement")
	errNoRK                  = errors.New("device lacks resident key capabilities")
	errNoUV                  = errors.New("device lacks PIN or user verification capabilities necessary to support passwordless")
	errPasswordlessU2F       = errors.New("U2F devices cannot do passwordless")
)

// TouchRequest abstracts *libfido2.TouchRequest for testing.
type TouchRequest interface {
	Status(timeout time.Duration) (touched bool, err error)
	Stop() error
}

// FIDODevice abstracts *libfido2.Device for testing.
type FIDODevice interface {
	// Info mirrors libfido2.Device.Info.
	Info() (*libfido2.DeviceInfo, error)

	// IsFIDO2 mirrors libfido2.Device.IsFIDO2.

View on GitHub (pinned to 1283425b60)

Solutions

1. Set a PIN on the security key (yubikey-manager: ykman fido access change-pin) to enable user verification.
2. Use a FIDO2 device with resident key support (YubiKey 5+ / other CTAP2.1 keys) for passwordless.
3. Register a passwordless-capable device: tsh mfa add --type=webauthn on hardware that supports passkeys.
4. Fall back to normal MFA (tap + password) instead of passwordless.

Example fix

// before
ykman fido info  // reveals rk=false on old keys
// after: set PIN and use a resident-key-capable key
ykman fido access change-pin
tsh mfa add --type=webauthn

// verify device capabilities before passwordless
// ykman fido info  -> resident key + UV supported?

err := tryPasswordlessLogin(ctx)
if err != nil && strings.Contains(err.Error(), "not registered for passwordless") {
	return normalMFALogin(ctx) // fall back to tap+password
}

When it happens

Trigger: fido2.go:200 — passwordless=true and (!info.uvCapable() || !info.rk): the tapped device cannot do UV or resident keys while the ceremony requires passwordless.

Common situations: Using an older YubiKey (non-5 series) for passwordless; security key without a PIN set; user chose passwordless but only a non-passwordless MFA key is plugged in.

Related errors

• device already holds a registered credential
• device lacks resident key capabilities
• U2F devices cannot do passwordless
• you are using a security key that is not registered with Tel
• device cannot fulfill platform attachment requirement

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/a14f56c489b2bd35. Report an issue: GitHub.