Double passkey popup

[chertik77]

Describe the issue

When doing registration, it first displays apple-like style passkey dialog, i click cancel, it display chrome-like passkey dialog.

Expected behavior

Passkey popup shouldn’t be duplicating or coming from multiple providers

Code Samples + WebAuthn Options and Responses

Front-end part

 const options = await fetch(
        env.VITE_API_BASE_URL + '/auth/passkey/signup-init',
        {
          method: 'POST',
          credentials: 'include'
        }
      ).then(r => r.json())

      const attestation = await startRegistration(options)

      await fetch(env.VITE_API_BASE_URL + '/auth/passkey/signup-verify', {
        method: 'POST',
        credentials: 'include',
        body: JSON.stringify(attestation),
        headers: { 'Content-Type': 'application/json' }
      })

Backend options

    const options = await generateRegistrationOptions({
      rpName: 'TaskPro',
      rpID: RP_ID,
      userID: Buffer.from(user.id),
      userName: user.name,
      attestationType: 'none',
      authenticatorSelection: {
        userVerification: 'required',
        residentKey: 'required',
        authenticatorAttachment: 'platform'
      },
      excludeCredentials: user.passkeys.map(passkey => ({
        id: passkey.id
      }))
    })

Dependencies

• OS: (e.g. macOS 26.3)
• Browser: (e.g. Helium 0.10)
• Authenticator: (None)

SimpleWebAuthn Libraries

"@simplewebauthn/browser": "^13.3.0",
"@simplewebauthn/server": "^13.3.0",

Additional context

Screen.Recording.2026-03-28.at.00.36.42.mov

And I have also tested passkeys functionality on different test websites like https://www.passkeys.io/ and haven't experienced duplicated dialogs. So it's probably not a Helium browser issue.

[MasterKale]

Hello @chertik77 unfortunately you're running into one of the rough truths about passkeys. As an RP using passkeys there's nothing that the WebAuthn API itself gives you to streamline this experience. The browser and platform are active players in a passkey ceremony, and they make choices independently about how they should fulfill their role to ultimately allow users to register and authenticate with passkeys.

In this case what you're seeing is Chrome choosing to offer other options when its initial call to the OS platform is cancelled out of. Nothing in the WebAuthn API allows you to force browsers or platforms to behave a specific way so unfortunately you, as an RP, have to prepare to answer users' questions about this flow if it confuses them...

[chertik77]

Oh, thanks for you reply. Alright, I'll do something about it, thanks

[chertik77]

https://www.passkeys.io/, but this website doesn't duplicate passkeys, it shows google-like style immediately. So how did they do that?

[MasterKale]

Hmm, can you share a recording of your experience on passkeys.io? On my end, on macOS 26.4 using Chrome 146, I see two prompts when registering a passkey:

Screen.Recording.2026-03-31.at.9.14.15.AM.mov

Nothing really stands out to me about how they're calling WebAuthn either:

[chertik77]

Screen.Recording.2026-04-02.at.16.04.32.mov

[chertik77]

Oh, I see. It also had duplicates on registration, i just went through signin process. Never mind. Thanks for your help!