Why your analytics can't see passkey failures (and what to measure instead)

#passkeys #webauthn #security #analytics

Login failures that never reach your server

You ship passkeys. Server logs look clean, your IdP dashboard is green and login success rate is stable. Meanwhile users tap "Sign in", hit the OS passkey dialog and fail. No request is ever sent, so nothing shows up on your side.

More than 80% of passkey failures happen on the device, before any server request. Corbado just updated its 58-page Authentication Analytics Whitepaper on how to measure this. Here is the developer-relevant part.

The NotAllowedError black box

This is what most WebAuthn error handling looks like:

try {
  const credential = await navigator.credentials.get({ publicKey: options });
  await verifyOnServer(credential);
} catch (err) {
  // In many failure cases, this is all you get
  console.log(err.name); // "NotAllowedError"
}

User cancelled? Timeout? No matching credential on the device? NotAllowedError alone has 8 different causes. On top of that, the OS passkey dialog emits no events, so tag-based analytics can't see what happened inside it either.

If every failure lands in the same bucket, you can't prioritize fixes. You also can't tell a confused user from a broken integration.

What to measure instead

The whitepaper defines 10 core KPIs in three groups:

Group	Question it answers
Outcome	Does login work for the user, end to end?
Diagnostic	Where and why does it break?
Adoption	Are users moving to better methods like passkeys?

Each KPI has a formula, industry benchmarks and notes on how to measure it right. 60+ supporting KPIs cover friction, method mix, uplift, security checks and errors.

Rules that keep the numbers honest

A login success rate is only useful if everyone counts it the same way. The paper sets six rules, for example:

Outcome: the outcome decides
Flows: every flow counts
Tries: tries are counted apart from start-overs

Numbers from production

ROI model: +11 pp login success, 20 to 50% fewer reset tickets, 4 to 8x faster logins
VicRoads: passkeys in more than half of all logins, >80% activation on mobile, 3.8M+ passkeys created
Adoption: teams that measure the full journey instead of single events go from around 5% to 50%+ passkey adoption

Read the full paper

The complete breakdown, including all KPI formulas and how to tell the 8 NotAllowedError causes apart, is in the free whitepaper: Authentication Analytics Whitepaper

DEV Community