Passkey registration with Cognito always fails with: InvalidParameterException: Credential data is not valid

Question

We are having a really hard time, trying to get Passkeys working with AWS Cognito. We have our custom security page in our webshop that allows customers to see, delete and add passkeys. 
We are using the typescript SDK:

```
    const command = new CompleteWebAuthnRegistrationCommand({
      AccessToken: accessToken,
      Credential: credential,
    });

const response = await cognitoServerClient.send(command);
```

We tried out many different things for the credentials object. It does look like that (cut the clientDataJSON):

```
{
  "id": "7MzzmtNM6uLl0-MjszgGt3Xb",
  "rawId": "7MzzmtNM6uLl0-MjszgGt3Xb",
  "type": "public-key",
  "response": {
    "clientDataJSON": "eyJ0eXBlIjoid2ViWWWWWWWWWWWWWWWWW",
    "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YViWAHHT_7Z8qSiDm9b-ldLXyCS_h0mKf5iWkoJsnjXajAZdAAAAALraVWanqkAfvZZFYZpVEg0AEuzM85rTTOri5dPjI7M4Brd126UBAgMmIAEhWCBSl5fnfKDznbIvo71E7XcY17D4_9zNAUZ_VY3PGH2rGCJYIF6G4fA3i7Q5tB6DS4ym3PadS8Ff2PMFvVCE9prHvX23"
  },
  "transports": ["internal", "hybrid"],
  "clientExtensionResults": { "credProps": null },
  "authenticatorAttachment": "platform"
}

```

What are we doing wrong? There is not a single coding example for that purpose and we are a bit lost here. Setting up passkeys with the hosted page is working.

re:Post Agent · Answer

Based on your description, it seems you're encountering issues with the CompleteWebAuthnRegistrationCommand when trying to implement passkeys with AWS Cognito using your custom security page.

The error "InvalidParameterException: Credential data is not valid" typically indicates that the credential object you're passing doesn't match what Cognito expects. When working with passkeys in Cognito, the credential format is very specific.

Here are a few things to check:

1. Make sure the credential object structure matches exactly what Cognito expects. The credential parameter should be a base64-encoded string representation of the credential object, not the raw JavaScript object.

2. The credential object needs to be properly serialized. Try converting your credential object to a JSON string and then encoding it to base64 before passing it to the CompleteWebAuthnRegistrationCommand.

3. Check that your accessToken is valid and not expired.

4. Ensure that your user pool is properly configured for passkeys. If you've migrated from an older "lite" plan to "Essentials", there might be underlying configuration issues even if passkey registration appears to be enabled.

5. Verify that the attestation object and client data JSON are properly formatted and encoded.

Since you mentioned that setting up passkeys with the hosted page works, you might want to use browser developer tools to capture the exact request format that the hosted UI sends when successfully registering a passkey. This can serve as a reference for your custom implementation.

If you continue to face issues, you might need to contact AWS Support for more specific guidance, as there could be subtle configuration issues with your user pool that are difficult to diagnose without more information.  
**Sources**  
[Cognito pool migration legacy/lite to essentials - passkeys not working | AWS re:Post](https://repost.aws/questions/QU7QkmSVynQ4uSWpyQmJFhwA/cognito-pool-migration-legacy-lite-to-essentials-passkeys-not-working)

Passkey registration with Cognito always fails with: InvalidParameterException: Credential data is not valid

Add your answer

Relevant content