[BUG] Embedded browser doesn't support Passkeys for SSO

[podux]

App Version

2.4.3

Platform

• Android
• iOS

How you installed it

App Store

What happened?

I run my OpenWebUI instance with Pocket Id as an OIDC provider. In Conduit, when I try to login to my OWUI instance, it brings up Pocket ID. As soon as I click Sign In, Pocket ID errors out and says An unknown error occurred. This failure occurs exactly when Pocket ID should be negotiating a passkey login with my device.

What should have happened?

iOS system prompt to login via Passkey should have occurred.

How to reproduce

1. Go to OWUI instance in Conduit
2. Click sign in via SSO (or sign in via Pocket ID)
3. Click Sign In in Pocket ID

Does this happen every time?

Yes, every time

When did this start?

No response

Screenshots

No response

Logs

No response

[appieschot]

Can replicate this issue, my logs:

Note: The tool simplified the command to ` grep -i "authorize\|callback\|oauth/oidc" /mnt/obfuscate/logs/access.log | tail -30`, and this is the output of running that command instead:
myip - - [23/Feb/2026:10:47:25 +0000] "GET /authorize?client_id=ba66e382
-3faf-4fa2-974c-06e899398cc3&scope=openid%20profile%20email&response_type=code&redirect_uri=https%3A%2F%2Faudiobookshelf.mydomain.com%2Fauth%2Fopenid%2Fcallback&state=8ZqBJTkv7OgnmWzy11sEtmAmR4RphqZ0PD4vtLcmKQs&code_challenge=i2tHK0Gllzma2GsrrT7v-y7ya41nNvYDy9tIJeq1xN0&code_challenge_method=S256 HTTP/2.0" 200 862 "-" "-" 29284 "pocketid@file" "http://pocketip:1411" 2ms                         myip - - [23/Feb/2026:10:47:26 +0000] "POST /api/oidc/authorize HTTP/2.0
" 403 53 "-" "-" 29298 "pocketid@file" "http://pocketip:1411" 2ms         myip - - [23/Feb/2026:10:47:46 +0000] "POST /api/oidc/authorize HTTP/2.0
" 200 153 "-" "-" 29318 "pocketid@file" "http://pocketip:1411" 14ms       myip - - [23/Feb/2026:10:47:47 +0000] "GET /auth/openid/callback?code=vk
f5J8XGdtHHAbFged6QuJCdokKX74gf&state=8ZqBJTkv7OgnmWzy11sEtmAmR4RphqZ0PD4vtLcmKQs&iss=https%3A%2F%2Fpocketid.mydomain.com HTTP/2.0" 302 128 "-" "-" 29319 "audiobookshelf@file" "http://pocketip:30067" 91ms                                 myip - - [23/Feb/2026:10:47:47 +0000] "GET /login?error=Unauthorized&aut
oLaunch=0 HTTP/2.0" 301 249 "-" "-" 29323 "audiobookshelf@file" "http://pocketip:30067" 1ms                                                               myip - - [23/Feb/2026:10:47:47 +0000] "GET /login/?error=Unauthorized&au
toLaunch=0 HTTP/2.0" 200 1272 "-" "-" 29324 "audiobookshelf@file" "http://pocketip:30067" 1ms                                                             myip - - [23/Feb/2026:10:47:53 +0000] "GET /audiobookshelf/auth/openid?c
allback=https://audiobookshelf.mydomain.com/audiobookshelf/login/ HTTP/2.0" 302 792 "-" "-" 29341 "audiobookshelf@file" "http://pocketip:30067" 5ms         myip - - [23/Feb/2026:10:47:53 +0000] "GET /authorize?client_id=ba66e382
-3faf-4fa2-974c-06e899398cc3&scope=openid%20profile%20email&response_type=code&redirect_uri=https%3A%2F%2Faudiobookshelf.mydomain.com%2Fauth%2Fopenid%2Fcallback&state=y4-Kegv5QcPKCAGedywCcqaCX5oXbX142NNSJst7ZHw&code_challenge=b46HRskCZJKqQteS4pWtpkI8deToAAB15AZSx-jYK7I&code_challenge_method=S256 HTTP/2.0" 200 863 "-" "-" 29342 "pocketid@file" "http://pocketip:1411" 1ms                         myip - - [23/Feb/2026:10:47:53 +0000] "POST /api/oidc/authorize HTTP/2.0
" 200 153 "-" "-" 29347 "pocketid@file" "http://pocketip:1411" 5ms        myip - - [23/Feb/2026:10:47:54 +0000] "GET /auth/openid/callback?code=Qu
Dad21jv00Kn0zZQVUdEt0VYxXMyjlm&state=y4-Kegv5QcPKCAGedywCcqaCX5oXbX142NNSJst7ZHw&iss=https%3A%2F%2Fpocketid.mydomain.com HTTP/2.0" 302 128 "-" "-" 29348 "audiobookshelf@file" "http://pocketip:30067" 60ms                                 myip - - [23/Feb/2026:10:47:54 +0000] "GET /login/?error=Unauthorized&au
toLaunch=0 HTTP/2.0" 304 0 "-" "-" 29351 "audiobookshelf@file" "http://pocketip:30067" 1ms                                                                myip - - [23/Feb/2026:10:50:50 +0000] "GET /audiobookshelf/auth/openid?c
allback=https://audiobookshelf.mydomain.com/audiobookshelf/login/ HTTP/2.0" 302 792 "-" "-" 29444 "audiobookshelf@file" "http://pocketip:30067" 11ms        myip - - [23/Feb/2026:10:50:50 +0000] "GET /authorize?client_id=ba66e382
-3faf-4fa2-974c-06e899398cc3&scope=openid%20profile%20email&response_type=code&redirect_uri=https%3A%2F%2Faudiobookshelf.mydomain.com%2Fauth%2Fopenid%2Fcallback&state=EN6lvyA_Bamv31_vJ17oxFsijZMoFIactd5vhBe8B0w&code_challenge=5owlRcTLMESyRVSsMVYytGsHlH1ZNybeBqVGyQcEkZY&code_challenge_method=S256 HTTP/2.0" 200 866 "-" "-" 29445 "pocketid@file" "http://pocketip:1411" 1ms                         myip - - [23/Feb/2026:10:50:50 +0000] "POST /api/oidc/authorize HTTP/2.0
" 200 153 "-" "-" 29450 "pocketid@file" "http://pocketip:1411" 13ms       myip - - [23/Feb/2026:10:50:51 +0000] "GET /auth/openid/callback?code=nZ
J0tZq8ZSwDc3wTm14yissbjKTWcYLV&state=EN6lvyA_Bamv31_vJ17oxFsijZMoFIactd5vhBe8B0w&iss=https%3A%2F%2Fpocketid.mydomain.com HTTP/2.0" 302 384 "-" "-" 29451 "audiobookshelf@file" "http://pocketip:30067" 114ms                                myip - - [23/Feb/2026:10:50:51 +0000] "POST /audiobookshelf/api/authoriz
e HTTP/2.0" 200 7396 "-" "-" 29465 "audiobookshelf@file" "http://pocketip:30067" 12ms                                                                     iphoneip - - [23/Feb/2026:11:00:10 +0000] "GET /authorize?client_id=ba66e382
-3faf-4fa2-974c-06e899398cc3&scope=openid%20profile%20email&response_type=code&redirect_uri=https%3A%2F%2Faudiobookshelf.mydomain.com%2Fauth%2Fopenid%2Fmobile-redirect&state=i0n850cZsvnSPMavGt8I0NG22c8lkG5Env_Gj0GX9i8&code_challenge=1bkj6-RxKEhq-CDiZ4AnNHRCLti5XXjpXL08Mfd4f3E&code_challenge_method=S256 HTTP/2.0" 200 863 "-" "-" 29604 "pocketid@file" "http://pocketip:1411" 1ms                  iphoneip - - [23/Feb/2026:11:00:25 +0000] "POST /api/oidc/authorize HTTP/2.0
" 400 80 "-" "-" 29688 "pocketid@file" "http://pocketip:1411" 1ms         iphoneip - - [23/Feb/2026:11:00:50 +0000] "POST /api/oidc/authorize HTTP/2.0
" 200 160 "-" "-" 29693 "pocketid@file" "http://pocketip:1411" 27ms       iphoneip - - [23/Feb/2026:11:00:51 +0000] "GET /auth/openid/callback?state=i
0n850cZsvnSPMavGt8I0NG22c8lkG5Env_Gj0GX9i8&code=R894OW7wVwXiHkFXDZw5Ph3ECOshYgER&code_verifier=4UTFkPTwcVlIKtWkfikxZi-PYTg36sGC-BU3vhrpxfk HTTP/2.0" 200 7618 "-" "-" 29695 "audiobookshelf@file" "http://pocketip:30067" 75ms            iphoneip - - [23/Feb/2026:11:00:55 +0000] "POST /api/authorize HTTP/2.0" 200
 7396 "-" "-" 29729 "audiobookshelf@file" "http://pocketip:30067" 5ms     iphoneip - - [23/Feb/2026:11:16:02 +0000] "POST /api/authorize HTTP/2.0" 200
 7396 "-" "-" 30098 "audiobookshelf@file" "http://pocketip:30067" 6ms     iphoneip - - [23/Feb/2026:11:26:30 +0000] "GET /oauth/oidc/login HTTP/2.0" 3
02 0 "-" "-" 30183 "openwebui@file" "http://pocketip:31028" 21ms          iphoneip - - [23/Feb/2026:11:26:30 +0000] "GET /authorize?response_type=code
&client_id=3d0efedc-6980-4e65-b2b8-0999f3dffd4d&redirect_uri=https%3A%2F%2Fopenwebui.mydomain.com%2Foauth%2Foidc%2Fcallback&scope=openid+email+profile&state=6XISpvJihM7tCjX2c3PJrPeHn1uIeN&nonce=1OjDw5sAmQI1QP5qOkDc&code_challenge=nQZ4zm4n6-MIOq-Um_nUvT8Dof5XZaArOWh7EgL5leM&code_challenge_method=S256 HTTP/2.0" 200 865 "-" "-" 30184 "pocketid@file" "http://pocketip:1411" 3ms                     iphoneip - - [23/Feb/2026:11:38:06 +0000] "GET /oauth/oidc/login HTTP/2.0" 3
02 0 "-" "-" 30288 "openwebui@file" "http://pocketip:31028" 20ms          iphoneip - - [23/Feb/2026:11:38:06 +0000] "GET /authorize?response_type=code
&client_id=3d0efedc-6980-4e65-b2b8-0999f3dffd4d&redirect_uri=https%3A%2F%2Fopenwebui.mydomain.com%2Foauth%2Foidc%2Fcallback&scope=openid+email+profile&state=ahaHuSsG3Pb6zPNCaASCs5F9CLHBrA&nonce=QFoUksbk5GVux9thYI5t&code_challenge=GkPp0pFBTF208woC2u2nyct6-oJ31cnXsayOu3wOvfY&code_challenge_method=S256 HTTP/2.0" 200 864 "-" "-" 30289 "pocketid@file" "http://pocketip:1411" 2ms                     myip - - [23/Feb/2026:11:40:41 +0000] "GET /oauth/oidc/login HTTP/2.0" 3
02 0 "-" "-" 30525 "openwebui@file" "http://pocketip:31028" 15ms          myip - - [23/Feb/2026:11:40:41 +0000] "GET /authorize?response_type=code
&client_id=3d0efedc-6980-4e65-b2b8-0999f3dffd4d&redirect_uri=https%3A%2F%2Fopenwebui.mydomain.com%2Foauth%2Foidc%2Fcallback&scope=openid+email+profile&state=Le2oaLvvBqpKiAcFyv4qbjPYlbkh0s&nonce=lrLK1XgLZz5C55db4p8s&code_challenge=hxPaf2x-rNXPEF4cj3I8G2qokMokcc6atl6fKB8rUQs&code_challenge_method=S256 HTTP/2.0" 200 865 "-" "-" 30526 "pocketid@file" "http://pocketip:1411" 2ms                     myip - - [23/Feb/2026:11:40:45 +0000] "POST /api/oidc/authorize HTTP/2.0
" 200 147 "-" "-" 30612 "pocketid@file" "http://pocketip:1411" 3ms        myip - - [23/Feb/2026:11:40:46 +0000] "GET /oauth/oidc/callback?code=NA0
FresCUlZ8YqnDfYxIEJBXQWsWEfdN&state=Le2oaLvvBqpKiAcFyv4qbjPYlbkh0s&iss=https%3A%2F%2Fpocketid.mydomain.com HTTP/2.0" 307 0 "-" "-" 30613 "openwebui@file" "http://pocketip:31028" 103ms                                                     

For my browser the flow is is full cycle (myip) records

For my Iphone the flow is:
GET /oauth/oidc/login → 302 (redirect to PocketID authorize)
GET /authorize?...&redirect_uri=https://openwebui.schot.tech/oauth/oidc/callback&... → 200 (PocketID shows login page)
No callback is ever received, The flow stops there.

Not sure if I need to add additional redirect URI's to my pocketid config for the app?

[robertbeckey]

Same issue with Keycloak passkeys. I have to use TOTP to be able to sign in.

[bobbyhyam]

same issue with authentik