Hi. We have Android and iOS native apps that display a Next.js application via web views. We'd like to offer the possibility to simply ask the user to check their biometrics when opening the app to avoid the back and forth auth trip. We tried to make an auth flow that directly starts with a "Sign In / Passkeys (WebAuthn)" action (without displaying a screen / having to click on a "sign in with biometrics" button), but this leads to a "[E067011]: Missing domain in WebAuthn settings: Failed to sign in - No value for domain or origin" error. So we were thinking about making the native apps directly ask to check biometrics and then sign out the user from everywhere (not only the native app) if they fail to do so twice. Here is a more detailed specification of what we had in mind: Enable persistent sessions on iOS and Android so users don't have to login every time they want to access their app (this is only applicable for IOS and android deployments of the app). The app needs to store a refresh token securely using iOS Keychain / Android Keystore. These are hardware-backed secure storage. This will enable smoother app open that can skip descope, so descope timeout can go up to 1 year. Quick re-authentication When opening the app again, users unlock via: • FaceID • TouchID • device passcode This is done using: • iOS LocalAuthentication framework • Android BiometricPrompt (ping @Alda Pontes)

WebAuthn Domain Configuration Issue The E067011 error occurs because WebAuthn requires proper domain configuration. You need to configure the top-level domain in your Descope project settings . For webview apps, add your domain to the approved domains list in Project Settings > Security > Approved Domains . Native Biometric Authentication Approach Your proposed approach using native biometrics with secure token storage is the recommended pattern for mobile apps. Here's how to implement it: 1. Secure Token Storage - iOS: Use Keychain Services for refresh token storage - Android: Use EncryptedSharedPreferences for secure storage

// Android - Check session and prompt biometrics
val session = Descope.sessionManager.session
if (session != null && !session.refreshToken.isExpired) {
    // Prompt for biometric authentication
    showBiometricPrompt()
} else {
    showLoginScreen()
}

2. Session Management - Enable persistent sessions with long refresh token expiry (up to 1 year) - Implement automatic token refresh - Use native biometric prompts (LocalAuthentication/BiometricPrompt) before accessing stored tokens 3. Security Implementation - Store refresh tokens in hardware-backed secure storage - Implement biometric failure handling (sign out after 2 failures) - Use Descope's session management for token validation and refresh This approach avoids WebAuthn domain issues while providing secure, seamless authentication using native device capabilities. Passkeys Settings Guide | Descope Documentation Project Settings | Descope Documentation Mobile SDK Session Management | Descope Documentation Refresh Token Rotation | Descope Documentation

To be more precise: the whole auth flow occurs in the web context (Next.js web app - cf. our previous discussion: https://authtown.slack.com/archives/C04490U8M7A/p1770680397392929?thread_ts=1770653437.840399&cid=C04490U8M7A)

Hi, I'm Descope's AI assistant. WebView Authentication Context Got it — you're running the Next.js auth flow inside webviews, not using native mobile SDKs. This explains the WebAuthn domain error since webviews have different origin handling than browsers. WebAuthn in WebViews WebAuthn has known limitations in webviews. The domain validation expects

window.location.origin

to match your configured domain , but webviews may not provide the expected origin value. This is similar to OAuth restrictions in webviews . Recommended Hybrid Approach 1. Native Biometric Gate - Use native LocalAuthentication/BiometricPrompt before loading the webview - Store refresh tokens in Keychain/Keystore as planned - Only load the Next.js app after biometric success 2. Webview Session Management - Pass the stored refresh token to your Next.js app via URL parameter or postMessage - Use Descope's client SDK to establish the session in the webview context - Configure long session timeouts (up to 1 year) to minimize re-authentication

// In Next.js webview - receive token from native app
const refreshToken = getTokenFromNativeApp();
await descope.refresh(refreshToken);

This avoids WebAuthn domain issues while maintaining your desired UX of biometric authentication on app launch, with the auth flow remaining in your familiar Next.js context. Biometrics (Passkeys) | Backend SDK | Descope Documentation Unsupported WebView for OAuth | Descope Documentation

and this E067011 error only occurs in this auth flow (the one which displays the screen and sign in with biometrics button then run the action does work perfectly).

Hi, I'm Descope's AI assistant. WebAuthn Flow Timing Issue The E067011 error occurs when starting WebAuthn directly without displaying the screen first because the domain/origin validation happens before the webview context is fully established. Why the Button Flow Works When you display the screen with a "Sign in with biometrics" button, the webview has time to: • Fully load and establish the proper origin context • Initialize the WebAuthn environment • Set up domain validation properly Direct Flow Issue Starting WebAuthn immediately without the screen display means: • The webview context isn't fully initialized •

window.location.origin

may not be available or correct • Domain validation fails before WebAuthn can start Solution Options 1. Add minimal delay before WebAuthn

// Allow webview to initialize before starting WebAuthn
setTimeout(() => {
  startWebAuthnFlow();
}, 100);

2. Check origin availability

if (window.location.origin) {
  startWebAuthnFlow();
} else {
  // Fallback or retry
}

The button approach works because user interaction gives the webview sufficient time to establish the proper context for WebAuthn domain validation.