Passkeys are bound to the Relying Party ID (RP ID) they were registered under, which is normally your domain. If your users registered passkeys on a different domain, for example a previous domain you are migrating away from, pass that domain as relatedOriginRpId so they can keep signing in with their existing passkeys instead of registering new ones.
await DynamicSDK.Instance.Auth.Passkey.SignIn("old.example.com");// or via the passkeys moduleawait DynamicSDK.Instance.Passkeys.SignInWithPasskey("old.example.com");// the same parameter is available on AuthenticatePasskeyMFAawait DynamicSDK.Instance.Passkeys.AuthenticatePasskeyMFA( new MfaCreateToken { SingleUse = true }, relatedOriginRpId: "old.example.com");
Two conditions apply:
relatedOriginRpId must be the RP ID the passkey was registered under, as a bare hostname such as old.example.com.
That domain must link the two origins by hosting https://old.example.com/.well-known/webauthn with your current domain in its origins list:
{ "origins": ["https://app.example.com"] }
This uses the WebAuthn related origins feature. See Related Origin Requests for the underlying mechanism.