AtAuth
fix: require discoverable credential for passkey registration
residentKey: 'preferred' → 'required' so Firefox stores passkeys
as discoverable credentials. The OIDC login page authenticates
without allowCredentials (user not identified yet), which requires
discoverable credentials to work.
Bryan Brooks
(Feb 24, 2026, 12:54 PM -0600)
f2a4e660
4de01501
+1
-1
+1
-1
gateway/src/services/passkey.ts
+1
-1
gateway/src/services/passkey.ts
···
67
67
transports: cred.transports as AuthenticatorTransportFuture[] | undefined,
68
68
})),
69
69
authenticatorSelection: {
70
-
residentKey: 'preferred',
70
+
residentKey: 'required',
71
71
userVerification: 'preferred',
72
72
authenticatorAttachment: undefined, // Allow both platform and cross-platform
73
73
},