Issue with the Passkey-Enrollment Screen when api.access.deny() is Called

Knowledge Articles
, ,
1

Overview

This article clarifies whether there are ways to display an error message on the passkey-enrollment screen when the user’s access is blocked with api.access.deny().

Users might get stuck on the passkey-enrollment screen if the user is blocked and no error is shown.

Use Case: Block signups for users with a specific email domain.

Sample Action (Pre-Registration Action):

exports.onExecutePreUserRegistration = async (event, api) => {
    api.access.deny(
      "disallow email domain",
      "You cannot use this email domain"
    );
    return;
};

Signup flow:

  1. Click Sign up.
  2. Sign-up screen: Enter the email address.
  3. Passkey-enrollment screen: Click Create a passkey.
  4. Choose how the user wants to create a passkey.
  5. Click Continue.
  6. api.access.deny() is called.
  7. Passkey-enrollment screen: No error is shown. The user gets stuck on this screen.

Applies To

  • Passkey
  • Multifactor Authentication
  • Factor Enrollment
  • API Calls

Solution

This can be achieved by using a validation error in the actions flow, respectively api.validation.error() call, instead of api.access.deny() for this use case.

For example:

exports.onExecutePreUserRegistration = async (event, api) => {
  api.validation.error("disallow_email_domain", "You cannot use this email domain");
  return;
};