Passkey origin check

REC-561. This page is not the portal — it is the harness that proves this origin can assert the passkey your iPhone already registered, which is the thing REC-557 is built on top of.

Origin

—

Relying party

—

Platform authenticator

checking…

Nothing is sent anywhere. The challenge is random and generated in this tab, so the signature proves nothing to a server — what it proves is that the browser accepts app-dev.reconcily.uk as a valid origin for relying party reconcily.uk, and that the credential registered on iOS is discoverable here. A server-verified assertion is REC-557's job.

Full sign-in check

REC-557, and this one is real: Cognito issues the challenge and verifies the signature, so a PASS here is exactly what the check above could not prove. tools/webauthn-probe already proves the same leg with a virtual authenticator — what is left, and what only you can do, is proving it with the passkey actually on your device.

Pool

—

App client

—

⚠️ This performs a real sign-in. Tokens are read to confirm they arrived and are then discarded — nothing is written to storage by this page, deliberately, because a probe has no business leaving a session behind. A session row is created server-side and will appear under “Where you’re signed in”; sign it out from the app afterwards.

Add ?pool=prod to run against production. Without it this targets dev, where your passkey does not exist — a failure there means the wrong pool, not a broken origin.