FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Comparing main...feat/setup-passkey-task · clerk/javascript · GitHub

/ javascript Public
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: clerk/javascript
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: main
Choose a base ref
Could not load branches
Nothing to show
{{ refName }}
...
head repository: clerk/javascript
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: feat/setup-passkey-task
Choose a head ref
Could not load branches
Nothing to show
{{ refName }}
Checking mergeability… Don’t worry, you can still create the pull request.
  • 1 commit
  • 19 files changed
  • 2 contributors

Commits on Aug 29, 2026

  1. feat(ui,clerk-js,shared): render the setup-passkey session task 

    Clerk's backend can now offer passkey enrolment right after sign-up, by
returning a `pending` session carrying a new `setup-passkey` task. No SDK
knows that key, and an unknown task key is not handled gracefully:
`getTaskEndpoint` builds `/tasks/undefined`, the SessionTasks router
matches no route, and the user is left on a pending session they cannot
clear — unable to use the app at all.

This adds the client half. A new TaskSetupPasskey card registers a passkey
through the existing `/v1/me/passkeys` endpoints, and `Session.skipTask`
declines the offer. `SUPPORTED_FAPI_VERSION` moves to 2026-08-20, which is
the version the backend gates the task behind.

1. `skipTask` is public API, not internal. For `setup-mfa` a headless flow
   clears the task implicitly by calling the ordinary TOTP endpoints, but
   an optional task has no side-effect equivalent — skipping is the only
   way to clear it, so custom sign-up flows need it or their users get
   stuck in `pending` permanently.
2. The instance chooses `off`, `optional` or `required` via
   `passkey_settings.prompt_at_sign_up`, read from the environment. Only
   an explicit `required` removes the decline button, so stale settings
   can never trap a user in a task they cannot clear.
3. On a device with no platform authenticator, `optional` silently skips
   the task and never renders the card. `required` cannot skip, so it
   shows an explanatory dead end rather than a spinner.
4. Required mode uses its own subtitle. The offer framing ("Next time,
   sign in with your fingerprint") reads as an invitation, which is
   misleading on a step the user cannot decline.

Part of CORE-3729

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdvBsr6erhXVy4edPejNGx
    dmoerner and claude committed Aug 29, 2026
    Configuration menu
    Copy the full SHA
    cea431f View commit details
    Browse the repository at this point in the history
Loading
Back | FazBrowse Home | New Git URL