User Passkey Assertion Failed

The user.passkey.assertion_failed event is triggered when a WebAuthn assertion ceremony fails to verify. Useful for brute-force detection, cloned-authenticator monitoring, and operational dashboards that surface unsuccessful passkey attempts.

Failure reasons

The reason field identifies the precise rule that failed. It is one of the following values:

Reason	Description
`invalid_assertion`	Catch-all for WebAuthn-library verification failures — bad signature, bad client data, unknown / mismatched credential id, or an origin / RPID mismatch.
`sign_count_replay`	The authenticator-supplied sign count was not strictly greater than the stored value. Indicates a cloned authenticator or a replayed assertion — the credential should be considered compromised and pulled out of band.
`token_invalid`	The login-ceremony token was unknown, expired, or already redeemed. Only emitted on the primary-factor login path.
`no_credentials`	The resolved user holds no registered passkey credential. The step-up or login flow cannot proceed.

Source

The source field distinguishes which ceremony failed:

Source	Description
`step_up`	A `verify_passkey` step-up step failed to advance.
`login`	The primary-factor (passwordless) login at `/login/passkey/finish` failed.

Best-effort fields

user_id, session_id, and credential_id are all populated when known and omitted otherwise. The primary-factor login path can fail before the user is even resolved (e.g. reason: token_invalid), in which case user_id is absent. credential_id is populated only once the WebAuthn library has matched a credential — earlier failures leave it empty.

Event payload

Emitted on any failed passkey assertion, during either step-up or primary-factor login. user_id, session_id and credential_id are best-effort: the login path can fail before the user is resolved, so they may be absent.

reason

enum<string>

required

Typed failure reason. See the event page for the full table.

Available options:

invalid_assertion,

sign_count_replay,

token_invalid,

no_credentials

source

enum<string>

required

Distinguishes the step-up assertion path from the primary-factor login path.

Available options:

step_up,

login

occurred_at

string<date-time>

required

Example:

"2025-03-15T10:30:00Z"

user_id

string

Best-effort. Empty on early failures that happen before the user is resolved (e.g. reason: token_invalid on the primary-factor login path).

Example:

"usr_01jqebhswje1ka1z7ahr9rfsgt"

session_id

string

Best-effort. Empty on the primary-factor login path (no session exists yet) and on step-up failures that happen before the session context is loaded.

Example:

"ses_01jr0z5w2seq998trz7ftbb9rj"

credential_id

string

Best-effort. Populated when the WebAuthn library has matched a credential against the user; empty when the failure happened earlier (e.g. reason: token_invalid, reason: invalid_assertion on parse).

Example:

"XKv4eJk7mGmJYI4r-hZxxBg"

correlation_id

string

Example:

"123e4567-e89b-12d3-a456-426614174000"

​Failure reasons

​Source

​Best-effort fields

​Event payload

Failure reasons

Source

Best-effort fields

Event payload