Cross-Device Passkey Login Failing Frequently

[TranThiKimThoa]

I am experiencing frequent failures when trying to log in using passkeys across devices (e.g., from my Android phone to my PC). Local passkey login on the same device works reliably (~75% success rate), but cross-device login success is very low (~14%), making passkeys effectively unusable in daily cross-device workflows.

Steps to reproduce:

1. Create a passkey on Android using my Google account.
2. Attempt to log in on a PC (Chrome) using the cross-device QR/confirmation flow.
3. Confirm the login on the Android device when prompted.
4. PC either times out, becomes unresponsive, or occasionally succeeds.

Environment details:

• Android device: Pixel 7, Android 14, latest Google Account passkey support
• PC: Linux, Chrome 134
• Google account: [your account, optional]
• Network: [home Wi-Fi, office network, etc.]

Observations:

• Even after setting the WebAuthn timeout to 120s, cross-device login still fails intermittently.
• Local passkey login on the same device works as expected.
• Failures appear to occur more often when confirmation from the mobile device is delayed.

Impact:
This issue significantly limits the usability of passkeys for users who regularly switch devices.

Could you please advise:

• Is this a known limitation or bug with cross-device passkey login?
• Are there recommended configuration steps for production environments to ensure cross-device reliability (session settings, cookies, load balancers, etc.)?
• Any guidance for debugging or improving success rates for cross-device logins?

Any guidance on configuration or best practices to improve cross-device reliability would be greatly appreciated.
Thank you for your support!

[Michael-MCP]

The example in this code doesn't store passkeys beyond the session, you have made changes to store in a database? otherwise this won't work across devices.

[My1]

key question is obviously also how does it fail. because webauthn has several components, and this library is only the things that happen on the side of the "server" and the website itself, what your Browser, OS and authenticator do are obviously very much outside that scope.