zeroclaw-labs/zeroclaw · error

No registered credentials for user '{user_id}'

Error message

No registered credentials for user '{user_id}'

What it means

start_authentication loads all credentials stored for the user and requires at least one before building allowCredentials and issuing a challenge. If none exist for that user_id, authentication cannot proceed and the error names the user.

Source

Thrown at crates/zeroclaw-runtime/src/security/webauthn.rs:348

            algorithm: COSE_ALG_ES256,
            user_id: reg_state.user_id.clone(),
        };

        // 4. Store the credential
        self.store_credential(&credential)?;

        Ok(credential)
    }

    /// Begin a WebAuthn authentication ceremony.
    /// Returns the options to send to the browser and the server-side state
    /// to keep until `finish_authentication` is called.
    pub fn start_authentication(
        &self,
        user_id: &str,
    ) -> Result<(RequestChallengeResponse, AuthenticationState)> {
        let credentials = self.load_credentials_for_user(user_id)?;
        anyhow::ensure!(
            !credentials.is_empty(),
            "No registered credentials for user '{user_id}'"
        );

        let challenge = self.generate_challenge()?;

        let allow: Vec<CredentialDescriptor> = credentials
            .iter()
            .map(|c| CredentialDescriptor {
                type_: "public-key".into(),
                id: c.credential_id.clone(),
            })
            .collect();

        let allowed_ids: Vec<String> = credentials
            .iter()
            .map(|c| c.credential_id.clone())
            .collect();

View on GitHub (pinned to 88bb9c8533)

Solutions

1. Route the user through registration (create a credential) before starting authentication
2. Verify the user_id passed in is byte-identical to the one used at registration time
3. Check the credentials store configuration (path/file) points where registrations are actually written

// route users without credentials to registration before starting auth
const hasCredentials = await fetch(`/webauthn/credentials?user=${encodeURIComponent(userId)}`)
  .then(r => r.json()).then(j => j.credentials.length > 0);
if (!hasCredentials) { window.location = '/register'; }

catch the no-credentials error at the auth-start handler and return 404 or a 'registration-required' code so the frontend can redirect instead of showing a generic failure

When it happens

Trigger: User never completed registration; their credentials were removed via remove_credential; user_id differs from the one used at registration (different ID namespace, casing, or email vs internal ID); the credential store path pointing at an empty or wrong location.

Common situations: Frontend routing users to login before signup completed; identity mapping bugs between the app's user table and the WebAuthn store; users who deleted all their passkeys and must re-register; fresh environments with an empty credentials store.

Related errors

• Expected type 'webauthn.create', got '{cd_type}'
• Credential ID not in allowed list
• Expected type 'webauthn.get', got '{cd_type}'
• Challenge mismatch in authentication response
• createSession failed ({status}): {body}

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/edcd600969cbda73. Report an issue: GitHub.