Setup

• FusionAuth Server: 1.69.2
• WebAuthn workflow: reauthentication
• Relying Party ID: a web domain (e.g., dashboard.example.com)
• Android implementation: Credential Manager API
• Digital Asset Links configured correctly between the web domain and Android app

The Problem

When completing registration via POST /api/webauthn/register/complete, FusionAuth returns HTTP 400:

{
  "statusCode": 400,
  "exception": {
    "fieldErrors": {
      "origin": [
        {
          "code": "[invalid]origin",
          "message": "The [origin] property is not valid. The provided value must match the value returned by the authenticator. Expected [android:apk-key-hash:<certificate-hash>] but found [dashboard.example.com]."
        }
      ]
    }
  }
}

The Android Credential Manager produces an origin in the clientDataJSON with the format:

android:apk-key-hash:<base64url-sha256-of-signing-certificate>

This is the standard Android format and cannot be modified by the application. FusionAuth 1.69.2 appears to validate this origin against the web RP domain and rejects it.

What Changed

Before 1.69.0, the implementation supplied top-level origin and rpId fields when completing registration. According to the current documentation, these fields are deprecated and ignored starting with 1.69.0. The new implementation now passes only:

await fusionAuthClient.completeWebAuthnRegistration({
  userId,
  credential,
});

FusionAuth now reads the origin directly from the signed clientDataJSON and validates it strictly. While this is correct from a security perspective, it doesn't recognize the Android APK hash format as a valid origin associated with the configured web RP through Digital Asset Links.

Questions

1. Does FusionAuth 1.69.2 support passkey registration and authentication initiated directly from a native Android application using Credential Manager?
2. Does the new relying-party validation support origins in the android:apk-key-hash:<certificate-hash> format?
3. Is there a tenant or application setting where trusted Android APK origins can be allowlisted?
4. Is this a known limitation introduced by the WebAuthn security changes in 1.69.0?
5. Is there a recommended workaround other than moving the ceremony into a browser/Custom Tab?