v148 · Security · Web Authentication
Error Recovery Guide
When mediation: "immediate" rejects, the right response depends on why it rejected — NotAllowedError means no credentials exist; a timeout means the user didn't respond. This guide shows the complete recovery cascade for every failure mode.
Pick a scenario
Error reference table
| Error | Cause in immediate mode | Recommended recovery |
|---|---|---|
| NotAllowedError | No matching credential found for this origin | Show sign-in form / registration flow |
| NotAllowedError (timeout) | User didn't interact within timeout window | Fall back to conditional or required mediation |
| SecurityError | Called on insecure origin (http://) | Ensure HTTPS; show error message |
| AbortError | AbortController.abort() was called by caller | Retry or cancel; don't show an error to user |
| TypeError | Invalid options object passed to get() | Fix the call site; log to error tracking |
| Resolves (success) | Matching passkey/password found and user confirmed | Proceed — user is authenticated |
implementation reference
Need the exact API surface, compatibility boundaries, errors, lifecycle, and source links? Read the matching gendn reference ↗