On Android, backing out of a step inside the passkey provider's own flow, like Google Password Manager asking to confirm the Google account, fails the sign-in with AuthenticationFailed and a raw Credential Manager message. Dismissing the system picker already counts as a cancellation; declining inside the provider doesn't. Apps end up showing an error for a deliberate back-out.
What we'd like: a NotAllowedError from a sign-in counts as a cancellation (UserCancelled, or UserTimedOut by elapsed time), the way the create side already handles its own DOM error.
On Android, backing out of a step inside the passkey provider's own flow, like Google Password Manager asking to confirm the Google account, fails the sign-in with
AuthenticationFailedand a raw Credential Manager message. Dismissing the system picker already counts as a cancellation; declining inside the provider doesn't. Apps end up showing an error for a deliberate back-out.What we'd like: a
NotAllowedErrorfrom a sign-in counts as a cancellation (UserCancelled, orUserTimedOutby elapsed time), the way the create side already handles its own DOM error.