Error text / 报错原文
RP ID mismatchSecurityErrorrpId is not a registrable domain suffix
What it means
The requested RP ID does not match the current origin or a valid parent domain.
Most common causes
- Using preview domain in production
- localhost vs custom domain
- Subdomain mismatch
- Native app webview origin mismatch
Fastest fix
- Reproduce the smallest failing case.
- Check environment, platform, and production settings.
- Use the related local tool to classify the issue.
- Fix the highest-risk security or data issue first.
Safe fix
- Keep secrets out of client code and logs.
- Prefer least privilege and explicit allowlists.
- Add a regression test or checklist before retrying.
- Document the working production configuration.
What not to do
- Do not disable security controls as a permanent fix.
- Do not paste secrets into public issue trackers or AI chats.
- Do not trust preview success as production readiness.
Diagnostic commands
window.PublicKeyCredential
location.origin
document.querySelector("input[autocomplete*=webauthn]")