[PM-28157] Passkey error with Revolut app: 'Passkeys not supported for this app'

[samuele-ruffino96]

Origin

Native Application (non-browser app)

Web URL or App name

Revolut (com.revolut.revolut)

Passkey Action

• Creating new passkey (Registration)
• Signing in (Authentication)

Build Information

App Version: 2025.10.1 (20867)
Build: release/standard
Operating System: Android 16 (API 36)
Device: Samsung SM-A566E (Galaxy A56)

Additional Information

Related Issue:
This appears similar to #6111, which was closed due to insufficient reproduction information.
I'm providing detailed logs, screenshots, and device information to help investigate this issue.

Steps to reproduce:

1. Open Revolut app (com.revolut.revolut)
2. Attempt to create a passkey
3. Bitwarden autofill appears
4. Error dialog displays: "An error has occurred - Passkeys not supported for this app"

Observations:

• Digital Asset Links verification succeeds (200 response)
• Revolut's certificate fingerprint is correctly verified
• Bitwarden autofill service processes the request (request ID 2254)
• Despite successful verification, passkey operation fails

Attached:

• Screenshot of error dialog
• Application logs showing the autofill request flow flight_recorder_2025-11-13_09-40-43.txt

Issue Tracking Info

• I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

[bitwarden-bot]

Thank you for your report! We've added this to our internal board for review.
ID: PM-28157

[SaintPatrck]

Hi @samuele-ruffino96

The logs do indicate a 200 response, but that only means Google's DAL API successfully processed the request and provided a response. The 200 does not indicate the actual result of validation. When I perform the same API call in Postman, I can see that the response body contains an error. Google's DAL API is receiving a redirect response when attempting to retrieve Revolut's assetlinks.json file. For security reasons the API does not follow redirects.

That being said, I do notice the response indicates Google is calling https://revolut.com. (note the additional . at the end), despite us properly sending https://revolut.com (without the additional .). I have reached out to Google for clarity regarding this behavior. You can track the issue here.

Response from Google's DAL API:

{
    "maxAge": "599.999999986s",
    "debugString": "********************* ERRORS *********************\n* Error: unavailable: Redirect encountered while fetching statements from https://revolut.com./.well-known/assetlinks.json (which is equivalent to 'https://revolut.com/.well-known/assetlinks.json'): redirects are disallowed for security reasons (NOT_FOLLOWED_MAX_FORWARDS) [651] while fetching Web statements from https://revolut.com./.well-known/assetlinks.json (which is equivalent to 'https://revolut.com/.well-known/assetlinks.json') using download from the web (ID 1).\n",
    "errorCode": [
        "ERROR_CODE_REDIRECT"
    ]
}

[samuele-ruffino96]

Hi @SaintPatrck
Thanks for the detailed explanation and for reaching out to Google about this!

You're absolutely right about the redirect. I've confirmed that https://revolut.com/.well-known/assetlinks.json returns a 301 redirect to https://www.revolut.com/.well-known/assetlinks.json. This is why Google's Digital Asset Links API is failing the verification - as you mentioned, it doesn't follow redirects for security reasons.

Regarding the additional . at the end (https://revolut.com.), I tested this as well and it performs the same redirect (see attached screenshot). From what I found, the trailing dot represents the DNS root and it's technically valid - most HTTP clients handle revolut.com. identically to revolut.com.

It's a bit unusual that Google is using the FQDN format but it shouldn't affect the outcome. I believe the core issue is that Revolut needs to serve the file directly without any redirects on either domain.

Curious to hear what Google says!

[SaintPatrck]

Hi @samuele-ruffino96

We heard back from Google. The absence of www. in the target website is causing a redirect. I have opened a PR that injects www. to hopefully prevent redirects from occurring for Revolut and any other applications that do not host assetlinks.json at their apex domain.

Thanks again for reporting the issue and providing details.

[Raul6469]

Hi everyone!

May be off topic, but I'm commenting on this issue since I'm encountering the same error message in a somewhat similar situation 👀

While testing our mobile implementation of passkeys, I found out that our app.domain.com. was not working, which is probably why I was getting the error message in Bitwarden. I guess we have to work this out and handle the fully qualified domain to fix Bitwarden compatibility?

Also, on our app, we host the asset links file exclusively on app.domain.com, and is not accessible through www.app.domain.com. The RP ID we use is app.domain.com. I may be mistaken since I'm not familiar with Kotlin, but will #6183 break comptability with our app, by prefixing with www. ? Maybe this injection should only happen on apex domains like domain.com?

[SaintPatrck]

Hi, @Raul6469.

Not off topic at all. Thank you for chiming in and pointing this out.

You're absolutely right. After taking another look at WebAuthn and Digital Asset Link specs, our strict matching was correct. I've opened a PR to revert the change.

@samuele-ruffino96 unfortunately this means Revolut, and any other applications that are misconfigured, will continue failing. I suggest reaching out to Revolut if you have not already. They will need to host their assetlinks.json file at revolut.com instead of redirecting to www.revolut.com. Alternatively, they can update the RP ID, but that is a destructive change I do not suggest unless no other options are available.

[samuele-ruffino96]

Contacted Revolut via api-requests@revolut.com (the closest technical contact I've found) about this configuration issue. Will keep the thread updated on their response.

@SaintPatrck Thanks! 👍

[Raul6469]

Hi @SaintPatrck !

I have a last question regarding the trailing . on digital asset link requests: is this an Android behaviour, or specific to Bitwarden?

On our existing app, we already host the assetlinks.json file for other purposes than passkeys support, and according to our logs, all requests we currently receive are made without this trailing dot.

When developing our passkey support, it seems like requests on app.domain.com. are only made when trying to use a Bitwarden passkey. Also, google password manager passkeys seem to work fine, which makes me believe there is some sort of Bitwarden specific configuration 👀