Android Application - Create Passkey Issue

Question

As part of a POC I am trying to implement a functionality to create passkey from Android native mobile application. But I am getting following error code when I execute the passkey code:

androidx.credentials.exceptions.publickeycredential.CreatePublicKeyCredentialDomException: [50152] RP ID cannot be validated.  same error 

This how the Digital Asset Links configuration looks like:

    {"relation" : [     
 "delegate_permission/common.handle_all_urls",
"delegate_permission/common.get_login_creds"],"target" : {
    "namespace" : "android_app",
          "package_name" : "package name",
          "sha256_cert_fingerprints" : [
            "SHA1 fingerprint"
          ]
        }
      },
      {
        "relation": [
          "delegate_permission/common.handle_all_urls",
          "delegate_permission/common.get_login_creds"
        ],
        "target": {
          "namespace": "web",
          "site": "domain name"
        }
      }
    ]

Google Developer Link For Passkey Medium Link for Passkey Implementation

Answer 1

In my case I figured out that passkeys only worked with an app build signed by the Google signing key (eg by uploading a new release for internal testing). This was because I only used the fingerprint (located in Play Console > Test and Release > Setup > App Signing) of this Google signing key in my assetslinks.json file.

However this signing key in stored securely on a Google server and I can not access it for signing my debug builds.

Add fingerprint of debug.keystore

To also test the passkey creation with your debug build, you need to either add the release signing config to your debug build (which might be infeasible in my situation), or add the fingerprint of the debug.keystore to your assetlinks.json.

1. See this documentation on how to locate your debug.keystore file. This keystore is used to automatically sign your debug builds.
2. Run keytool -list -keystore <path-to-debug.keystore> to get the fingerprint of the keystore. The default password is "android".
3. Add this fingerprint to the list of sha256_cert_fingerprints in your assetlinks.json file

With this I was able to get rid of the RP ID cannot be validated error.