Common Implementation Mistakes

Identity mistakes

Putting a port inside the RP ID
Registering on one subdomain and expecting another RP ID to work
Forgetting that local dev and production use different identities

Verification mistakes

Skipping origin validation
Reusing challenges
Treating passkeys as a frontend-only concern

Product mistakes

No fallback when a user loses a device
Assuming passkey-first discovery will stay clean on crowded localhost
Over-investing in attestation before shipping the basics
Hiding setup behind too much account ceremony

Practical Takeaways

Start with the mental model: registration creates a credential, authentication proves possession.
Treat RP ID as site identity: domain only, shared across ports, scoped across subdomains.
Verify on the server: challenge, origin, RP ID, signature, and counter behavior.
Use a mature library and spend your time on UX, recovery, and rollout.
For JavaScript teams, passkeys are mostly an integration problem, not a cryptography project.