If your passkey works on one hostname but fails on another, start by comparing the RP ID with the actual calling origin .

They are not interchangeable values. An RP ID is a domain identifier. An origin includes the scheme, hostname, and port.

This is part three of Passkeys in Production , adapted from the Helpers.work RP ID guide . We build the Passkey Deployment Checker , which evaluates this public configuration boundary without claiming to test the entire login flow.

One URL, three different values

For this illustrative page:

https://login.example.com/account/security

Enter fullscreen mode

Exit fullscreen mode

You have:

Origin: https://login.example.com Hostname: login.example.com RP ID: potentially example.com or login.example.com

Enter fullscreen mode

Exit fullscreen mode

The path is not part of the origin. A non-default port is part of the origin, but never part of the RP ID.

Registration options use publicKey.rp.id ; authentication options use publicKey.rpId .…