Cannot login using passkeys on Firefox using Bitwarden

Technical Q&A
1

Everyday Shopify asks me to verify my account but when I try to do so using my passkey it fails with the following error message: “We’ve encountered an error accessing your passkey. Try again or use a different method.”

Screenshot 2026-07-30 at 12-00-33
Screenshot 2026-07-30 at 12-00-33360×356 15.9 KB

When I hit the “Verify” button I can see a POST request being made to https://accounts.shopify.com/user-verification/passkey?native_app=false&os_name=other&token=XXXXXXXXXX and it gets a 200 response with the following JSON:

{
  "result": "error",
  "reason": "user_submission_canceled_passkey",
  "credential_options": {
    "challenge": "YYYYYYYYYYY",
    "timeout": 120000,
    "extensions": {},
    "allowCredentials": [
      {
        "type": "public-key",
        "id": "ZZZZZZZZZZZZZZ"
      }
    ],
    "rpId": "accounts.shopify.com",
    "userVerification": "preferred"
  },
  "selected_method": "passkey",
  "other_info": {},
  "severity": null
}

(I’ve redacted some information from the request URL and the response body)

The passkey popup from Bitwarden never opens.

I then use 2FA with my authenticator app and am able to login.

I’m using Firefox 153.0.1 and the Bitwarden extension 2026.7.0.

This used to work fine for me some time ago and I can still use passkeys using Chrome + Bitwarden on the same computer.

2

The response you pasted actually rules a lot out. user_submission_canceled_passkey is the browser telling Shopify the ceremony was cancelled, and Shopify hands back a fresh credential_options in the same payload, so nothing failed on the account side. It never got as far as checking a signature. That puts the whole thing in Firefox or Bitwarden.

The first thing I would check is Bitwarden’s blocked domains. If you ever hit “Use your device or hardware key” on one of its passkey prompts, the extension adds that site to blocked domains and from then on it will not offer to save or use a passkey there. Bitwarden’s own docs spell that out. Firefox then falls through to its own authenticator, that dialog goes nowhere, and you get exactly the cancel you are seeing. Open the extension, check Settings then Notifications for “Ask to save and use passkeys”, then look through the blocked or excluded domains list for accounts.shopify.com and pull it out.

Worth checking the credential id too. allowCredentials has one entry, so Firefox will only accept that one specific credential and nothing else on the machine. Bitwarden keeps one passkey per login item, so if you overwrote it at some point or created the passkey somewhere else, your vault holds a passkey Shopify has never seen and every attempt dies the same way. A JSON export from Bitwarden includes passkeys, so you can compare the id in the export against the id in that response. If they do not match, removing the passkey from your Shopify account and enrolling a fresh one is the fast way out.

To split the two, try webauthn.io in the same Firefox and register and authenticate there. If Bitwarden prompts fine on that site, it is domain specific rather than a Firefox problem.

When you hit Verify, does the Bitwarden popup come up at all, or do you get Firefox’s own dialog?

5

I am also having the same issues from today. This is the first time I’ve ever seen this new way of verifying my Passkey. It has always worked in the past.

My console is reporting this:

image
image660×185 29.2 KB

6

Same was working for a few days after the webauthn configchanges but whatever got deploy 2-3 days ago clearly wasn’t tested with Bitwarden/Firefox.