How to Inspect Credential Manager Providers and Passkey Sessions on Android Using ADB dumpsys credential

Starting with Android 14, Google unified authentication workflows under the CredentialManager framework architecture. This modern subsystem replaces legacy, fragmented autofill and Smart Lock mechanisms with a consolidated API capable of orchestrating FIDO2 passkeys, federated identity logins (such as Sign in with Google), and traditional password managers (including 1Password, Bitwarden, and Google Password Manager). For application developers and security auditors implementing biometric authentication or troubleshooting passkey registration flows, standard UI prompts mask internal handshake details. Using the Android Debug Bridge (ADB), the internal dumpsys credential command reveals active credential providers, pending session tokens, client package permissions, and authentication event logs directly from the Android runtime.

Understanding the CredentialManager Architecture

The Android CredentialManagerService coordinates authentication between three distinct stakeholders:

• Calling Application: The app requesting authentication via createCredential() or getCredential().
• System UI Selector: The native bottom-sheet dialogue that aggregates available passkeys and credentials across providers and presents them to the user.
• Credential Provider Services: Third-party or system authentication apps implementing android.service.credentials.CredentialProviderService that securely store private keys, biometric signatures, and vault records.

The service enforces strict cryptographic origin validation to prevent phishing, verifying that WebAuthn Relying Party IDs match digital asset links associated with the calling application package.

Connecting via ADB and Dumping Credential Manager State

To inspect the status of the Credential Manager service, connect your Android device with USB debugging enabled and execute the diagnostic command:

adb shell dumpsys credential

The dump prints comprehensive runtime state information, including active user services, registered provider components, current session lifecycles, and recent request histories.

To capture the dump to a local file for offline inspection:

adb shell dumpsys credential > credential_service_dump.txt

Auditing Active and Available Credential Providers

Android allows users to configure multiple simultaneous credential providers. To verify which services are registered and recognized by the system:

adb shell dumpsys credential | grep -A 25 "User Services"

Look for the mServices list under the active user (User 0). Each entry details:

• Package Name: The identity of the provider (e.g. com.google.android.gms or com.x8bit.bitwarden).
• Service Class: The exported service component declaring the CredentialProviderService intent filter.
• Enabled State: Whether the provider is active or suppressed by the user.
• Capabilities: Supported credential types, including androidx.credentials.TYPE_PUBLIC_KEY_CREDENTIAL (Passkeys) and android.credentials.TYPE_PASSWORD_CREDENTIAL.

Inspecting Active Passkey Authentication Sessions

When an app invokes CredentialManager.getCredential(), a transient session is generated. If an application hangs during login or fails to render the biometric prompt, you can inspect the active session state in real time:

adb shell dumpsys credential | grep -A 20 "mSessionMap"

The output provides key diagnostic identifiers:

• mCallingPackage: The application package initiating the authentication request.
• mRequestSessionType: Indicates whether the request is a Get (retrieval) or Create (registration) operation.
• mRelyingPartyId: The WebAuthn domain/identifier requested for cryptographic assertion.
• mOrigin: The verified package signature hash or web origin. If this origin does not match the Digital Asset Links configuration, the request fails with security exceptions.

Checking Persistent User Settings and Default Providers

Credential Manager settings are backed by secure settings in the Android settings provider. You can audit and verify these preferences directly via ADB:

# Query the primary credential service provider
adb shell settings get secure credential_service

# Query primary and secondary enabled credential providers
adb shell settings get secure credential_service_primary
adb shell settings get secure enabled_credential_providers

To programmatically set the default credential provider during test automation:

# Set Google Play services as the primary provider
adb shell settings put secure credential_service_primary "com.google.android.gms/com.google.android.gms.auth.api.credentials.service.CredentialProviderService"

Debugging Common Passkey Handshake Failures

If passkey registration or authentication fails silently in your application, combine dumpsys credential with Android logcat filtering to diagnose the root cause:

adb logcat -v time -s CredentialManager:V CredentialProvider:V

Common failure modes exposed in logs include:

• TYPE_USER_CANCELED: The user dismissed the selector sheet or aborted biometric fingerprint verification.
• ORIGIN_MISMATCH: The calling app’s signing certificate does not match the SHA-256 fingerprint declared in the server’s assetlinks.json file.
• NO_CREDENTIAL: The designated Relying Party ID has no passkeys enrolled in any enabled provider.

Utilising dumpsys credential empowers Android engineers to validate Passkey implementations, audit authentication providers, and troubleshoot complex WebAuthn flows with granular runtime visibility.