Exceptions

Every failure extends RoundlyConsulting\Passkeys\Exceptions\PasskeyException (a RuntimeException). Catch the base for a uniform response, or a child for finer control:

use RoundlyConsulting\Passkeys\Exceptions\PasskeyException;

try {
    $passkey = Passkeys::authenticate($response);
} catch (PasskeyException $e) {
    // Return a uniform failure to the client; log $e server-side.
    return response()->json(['message' => 'Sign-in failed.'], 422);
}

Ceremony failures

Configuration, decoding and attestation

Localised messages

Messages resolve through the passkeys::errors.* translation namespace, which ships in English and Slovak and follows the app locale — publish passkeys-translations to adjust them or add another language. A message is worded entirely in the app locale: the package’s own detail fragments — the shape a setting must have, why an attestation statement is malformed, which certificate requirement failed — are translation keys too, while literal tokens such as x5c, CA:FALSE, OIDs and setting keys stay as they are. Integer and enum settings are validated by package-toolkit-for-laravel, whose messages are English only.

Text from a lower layer — the CBOR/COSE decoder or the certificate parser — is not translatable, so it never enters the message. It stays available to developers:

• $e->getPrevious() — the lower-level exception (for example a CryptoException) behind MalformedCbor, InvalidCoseKey, InvalidAuthenticatorData::because(), UnsupportedAlgorithm::because() and a parser-backed InvalidAttestation::malformedStatement().
• $e->context() — ['reason' => '…'] for the four reason-carrying factories, [] otherwise. Laravel’s exception handler merges it into the log entry automatically.