The operation either timed out or was not allowed.

[Whip]

For some reason, I'm getting this error on login from navigator.credentials.create. This happen sometimes and for some accounts but not for others. Can you tell what is the reason/source of this error? Here's the code

try {
	$WebAuthn = new lbuchs\WebAuthn\WebAuthn('Project Name', 'ProjectDomain', ['none']);
	$createArgs = $WebAuthn->getCreateArgs($customer['id'], $email, $customer['name'], 120, 'required', 'required', null);
	$challenge = $WebAuthn->getChallenge();
  $_SESSION['login-challenge'] = [
  	'challenge' => $challenge->getBinaryString(),
  	'userId' => $customer['id'],
  	'email' => $email
	];

  echo json_encode([
  	'actionRequired' => 'newDevice',
  	'createArgs' => $createArgs
  ]);
} catch (Exception $e) {
	echo '{"error":"'.$e->getMessage().'"}';
}

This response from php is provided to js

if(pubKeyCredOpts.actionRequired == 'newDevice'){
	recursiveBase64StrToArrayBuffer(pubKeyCredOpts.createArgs);

	navigator.credentials.create(pubKeyCredOpts.createArgs).then(cred => {
		const publicKeyCredential = {
			transports: cred.response.getTransports ? cred.response.getTransports() : null,
			clientDataJSON: cred.response.clientDataJSON ? arrayBufferToBase64(cred.response.clientDataJSON) : null,
			attestationObject: cred.response.attestationObject ? arrayBufferToBase64(cred.response.attestationObject) : null
		};

		// step 4 request
		verifyCreds('NewDevice', publicKeyCredential);

	}).catch(err => {
		handleError(err); <- This is executed showing the error
	});
}

[lbuchs]

a not allowed error could mean that the user has no device to register passkeys.

[Whip]

Does this mean that the biometric hardware on the device is unavailable for some reason?

[lbuchs]

I think on Windows it can happen when Windows Hello has not been set up and you don't have any other device (USB key, NFC, Bluetooth etc.)

[Whip]

I've mostly seen it on android though. When I started field testing it, on some phones folks had the fingerprint setup to unlock the phone but when registering on my website, they get this error.