From 3d8e0931ddc4ee08954543ec7678994efde04260 Mon Sep 17 00:00:00 2001
From: Adam Soltys <adam@coinos.io>
Date: Sun, 8 Mar 2026 22:53:35 -0700
Subject: accept android app origin for passkey verification

---
 lib/passkey.ts | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

(limited to 'lib')

diff --git a/lib/passkey.ts b/lib/passkey.ts
index 8a965c94..2875e388 100644
--- a/lib/passkey.ts
+++ b/lib/passkey.ts
@@ -11,6 +11,8 @@ import { fail } from "$lib/utils";
 import { v4 } from "uuid";
 
 const rpName = "coinos";
+const androidOrigin =
+  "android:apk-key-hash:DaYNHto1fsy7jrhOfRaDDy4HCRNqFo8H0gf3DmW7bOw";
 
 function getRpID(origin: string) {
   try {
@@ -20,6 +22,10 @@ function getRpID(origin: string) {
   }
 }
 
+function getExpectedOrigins(origin: string) {
+  return [origin, androidOrigin];
+}
+
 export async function generatePasskeyRegistration(user: any, origin: string) {
   const rpID = getRpID(origin);
   const passkeys = user.passkeys || [];
@@ -53,7 +59,7 @@ export async function verifyPasskeyRegistration(user: any, response: any, origin
   const verification = await verifyRegistrationResponse({
     response,
     expectedChallenge: expectedChallenge as string,
-    expectedOrigin: origin,
+    expectedOrigin: getExpectedOrigins(origin),
     expectedRPID: rpID,
   });
 
@@ -110,7 +116,7 @@ export async function verifyPasskeyLogin(response: any, challengeId: string, ori
   const verification = await verifyAuthenticationResponse({
     response,
     expectedChallenge: expectedChallenge as string,
-    expectedOrigin: origin,
+    expectedOrigin: getExpectedOrigins(origin),
     expectedRPID: rpID,
     requireUserVerification: false,
     credential: {
-- 
cgit v1.2.3