Passkeys on Android

Passkeys were already live on web. The relying party ID was the company’s top-level domain, credentials synced through Google Password Manager, and the WebAuthn flows were tested. Bringing the same credentials to Android should have been the easy half.

What made it hard

Two things cost more time than the Android code itself.

Serving assetlinks.json from the root domain. Android verifies the app against https://<rpid>/.well-known/assetlinks.json, and the file has to live on exactly that domain. Root domains are usually fronted by load balancers, CDNs, and infrastructure nobody wants to touch. Getting a static JSON file served there became a cross-team project that had to start before any app code was written.

An undocumented delegation. The official guidance says get_login_creds is sufficient for sharing passkeys between web and app. In practice, the credential provider also needed handle_all_urls before it would surface web-created passkeys to the app. That took a lot of trial and error to find.

Outcome

Sign-in on Android now uses the same passkeys users created on web, with no new enrolment step. The details, including the exact assetlinks.json shape that worked, are in the write-up linked above.