Passkeys at Scale on Android: An Error Taxonomy, an Eligibility Gate, and a Fallback You Can Trust

Adding a passkey button is an afternoon of work. Keeping that button from stranding users on a six-year-old handset with no screen lock, a half-updated Play services, and a custom OEM credential sheet is a quarter of work. This post is about the second job.

1. The ceremony, minimally

A passkey sign-in is a challenge-response exchange. Your backend hands out a one-time challenge, the device signs it with a private key that never leaves secure hardware, and your backend verifies the signature against the stored public key.

Two details in that flow cause most production pain:

Step 2 has a TTL. If the user sits on the biometric sheet, takes a call, and returns, your challenge may be gone. That is a server-side failure that surfaces client-side as a generic error.

Step 4 belongs to someone else. The prompt is rendered by the system and a credential provider you do not control.…