Skip to main content

Passkeys Across Multiple Domains (Related Origin Requests)

A passkey is normally scoped to the single domain it was registered against, so a user who has a passkey for example.com cannot use it to sign in on example.ch even if both are your sites. Related Origin Requests (ROR) lift this restriction by letting a Relying Party ID declare which other origins are allowed to use it, so the same passkey works across branded or country-specific domains.

Unlike the other use cases in this section, ROR is not configured through a field on the nevisFIDO FIDO2 Instance pattern or any other nevisAdmin 4 pattern. It is a static file the browser fetches directly from your domain, independent of nevisFIDO, so there is currently nothing to assign on the Instance pattern for it.

To support ROR, host a JSON file named webauthn (no extension) at the well-known path /.well-known/webauthn on the Relying Party ID's domain, served with content type application/json:

example
{
  "origins": [
    "https://example.com",
    "https://example.ch",
    "https://example.co"
  ]
}

A Hosting Service pattern can serve static resources on a virtual host and may work for this file, but confirm during testing that it serves the extensionless webauthn file at the exact /.well-known/webauthn path with the required application/json content type; this combination is not a documented, verified use of that pattern.

For the full specification of the origins field and browser support, see passkeys.dev and Using passkeys across multiple domains in the Concept and Integration Guide.

If you rely on this use case, consider raising it with the nevisFIDO plugin team as a candidate for a dedicated pattern field.