1Password passkey causes Illegal Invocation error

TL;DR

This is an upstream 1Password bug, not your library: the 1Password Chrome extension intercepts the WebAuthn call and replaces it with its own implementation, which throws Illegal invocation. Chrome 129 added PublicKeyCredential features that exposed the incompatibility. Track the 1Password fix; as a workaround, register the passkey without the 1Password extension intercepting.

The error

Uncaught TypeError: Illegal invocation

Shown in the UI when registering a FIDO2 credential with a 1Password passkey, at the navigator.credentials.create / WebAuthn call in the client code.

Fix it

1. Confirm the scope: the error happens only when the 1Password passkey flow is used, not with platform authenticators. Success check: other passkey providers register fine.

2. Workaround: disable the 1Password extension's passkey interception (or use a different browser/profile) and retry registration. Success check: registration completes with no Illegal invocation.

3. Track the upstream 1Password fix for full resolution. Success check: re-enable the extension after the fix and registration works.

When this applies

• Illegal invocation on FIDO2 credential registration with 1Password passkeys.
• Chrome 129+.

When it does not apply

• Other authenticators fail too; that is a problem in your WebAuthn code.
• Different WebAuthn errors (NotAllowedError, InvalidStateError).
• The error occurs outside credential registration.

Compatibility

• Chrome 129+ (PublicKeyCredential additions exposed the bug). 1Password Chrome extension passkey implementation.
• Library: amazon-cognito-passwordless-auth client (fido2.ts).

Variant phrasings

• 1Password passkey Illegal invocation
• Uncaught TypeError Illegal invocation webauthn
• fido2 register Illegal invocation 1password

Why it happens

The 1Password extension replaces the native WebAuthn implementation with its own. Its replacement does not handle the newer PublicKeyCredential surface Chrome 129 added, so the call throws Illegal invocation instead of completing.

Edge cases

• Users on older Chrome may not hit it; the incompatibility is version-specific.
• Source: https://github.com/aws-samples/amazon-cognito-passwordless-auth/issues/94

In gh:aws-samples/amazon-cognito-passwordless-auth#94 (Amazon Cognito), the issue reported was: Issue aws-samples/amazon-cognito-passwordless-auth#94 (closed, 13 comments): 1Password passkey implementation intercepts webauthn call and replace it with its own implementation in 1Password Chrome extension. The below line in mount the host path https at container path //github.com/aws-samples/amazon-cognito-passwordless-auth/blob/1023e1ef4d2f7eb6b0943315822cecf57f0591d8/client/fido2.ts#L105 causes Uncaught TypeError: Illegal invocation. which results in Illegal invocation shown in the UI when registering fido2 credential. ``` debug?.("Created credential:", { credential, getTransports: response.getTransports?.(), getAuthenticatorData: response.getAuthenticatorData?.(), getPublicKey: response. The verified resolution from the thread: [ottokruse (maintainer)]: The Illegal invocation error with 1Password passkeys is an upstream 1Password bug, not this library: Chrome 129 added PublicKeyCredential.toJSON(), and 1Password's proxied credential object breaks on serialization. The reporter confirmed the fault is not with the library. The suggested library-side workaround did not resolve it; report it to 1Password. Source: mount the host path https at container path //github.com/aws-samples/amazon-cognito-passwordless-auth/issues/94