Before promoting passkey registration, I would like to check whether the user device has platform authenticator (or passkey platform authenticator). While trying to search such feature in the docs, I cannot find it anywhere.
Is this intended?
If there is no such api, how can we know whether the user can register passkey?
All users running iOS 16 or macOS Ventura can register passkeys. If they don't have iCloud Keychain set up at the time, the registration sheet will let them know they need that and provide a link to go turn it on.
Thanks for the information.
Following up on the accepted answer in this thread — which states that all users running iOS 16 or later can register passkeys and that the system sheet handles the iCloud Keychain case — I'm running into a scenario that falls outside that assumption.
A subset of our users are hitting:
com.apple.AuthenticationServices.AuthorizationError Code: 1010. This is the deviceNotConfiguredForPasskeyCreation error introduced in iOS 26.
Crucially, this error is thrown silently — the system sheet never appears, the user gets no recovery prompt, and the error lands directly in our authorizationController(_:didCompleteWithError:) delegate method.
From testing, the conditions that trigger 1010 without showing the system recovery sheet appear to include:
My question is about the MDM case:
Is there any API — in AuthenticationServices, DeviceManagement, or otherwise — that allows an app to detect whether a restricting MDM profile is in place before attempting passkey creation? Something like a preflight check that would let us skip the passkey flow entirely for managed devices where it will silently fail.
Given that the system sheet no longer handles this case on iOS 26 (unlike the manual iCloud Keychain off scenario), a preflight API would be meaningful for apps serving enterprise or government users.
If no such API exists, is this a known gap? And is there a recommended pattern for handling error 1010 gracefully on iOS 26?
