> ## Documentation Index
> Fetch the complete documentation index at: https://docs.prelude.so/llms.txt
> Use this file to discover all available pages before exploring further.

# User Passkey Assertion Failed

The `user.passkey.assertion_failed` event is triggered when a WebAuthn assertion ceremony fails to verify. Useful for brute-force detection, cloned-authenticator monitoring, and operational dashboards that surface unsuccessful passkey attempts.

## Failure reasons

The `reason` field identifies the precise rule that failed. It is one of the following values:

| Reason              | Description                                                                                                                                                                                                              |
| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `invalid_assertion` | Catch-all for WebAuthn-library verification failures — bad signature, bad client data, unknown / mismatched credential id, or an origin / RPID mismatch.                                                                 |
| `sign_count_replay` | The authenticator-supplied sign count was not strictly greater than the stored value. Indicates a cloned authenticator or a replayed assertion — the credential should be considered compromised and pulled out of band. |
| `token_invalid`     | The login-ceremony token was unknown, expired, or already redeemed. Only emitted on the primary-factor login path.                                                                                                       |
| `no_credentials`    | The resolved user holds no registered passkey credential. The step-up or login flow cannot proceed.                                                                                                                      |

## Source

The `source` field distinguishes which ceremony failed:

| Source    | Description                                                                |
| --------- | -------------------------------------------------------------------------- |
| `step_up` | A `verify_passkey` step-up step failed to advance.                         |
| `login`   | The primary-factor (passwordless) login at `/login/passkey/finish` failed. |

## Best-effort fields

`user_id`, `session_id`, and `credential_id` are all populated when known and omitted otherwise. The primary-factor login path can fail before the user is even resolved (e.g. `reason: token_invalid`), in which case `user_id` is absent. `credential_id` is populated only once the WebAuthn library has matched a credential — earlier failures leave it empty.

## Event payload