Passkeys at work: test access, recovery, and offboarding in the pilot
Let's discuss your project →A passkey pilot should also cover the lost-device case and account recovery. The FIDO Alliance describes passkeys as cryptographic key-pair credentials that resist phishing and can be either device-bound or synchronised.
That distinction matters: sign-in security does not automatically make every recovery path secure. The workshop below is a Dedaloop editorial proposal, useful for checking the full flow before rolling it out to the team.
Scope the pilot
Choose one application that supports passkeys and a small group of volunteer users. Prepare test accounts, a support contact, and an already approved recovery procedure. Do not disable the company’s sign-in methods for the first trial.
Before you start, clarify which devices are allowed, who manages them, and whether provider-based synchronisation is permitted. The right choice depends on the context: there is no universal preference that fits every role or device.
Four flows to test
- Registration: can the person create the credential and understand where it is stored? Is it clear which service they are linking it to?
- Everyday sign-in: does the flow work across the browser and device combinations the group actually uses?
- Device unavailable: without destroying data, simulate the main device becoming unavailable and check the agreed recovery path.
- Offboarding: test how to revoke credentials and access for a test account leaving the group, using the service’s functions.
Do not ask participants to share PINs, recovery codes, or credentials. If an alternative path allows re-entry with weaker checks than expected, record it as a problem to fix, not as a helpful shortcut.
What to record before expanding
Keep the results of the four flows, support requests, and cases where the user gets blocked. Include people who use assistive technologies or cannot comfortably use a smartphone: usability should be observed, not assumed.
Before rollout, decide who can authorise recovery and what evidence is required. Phishing resistance is a useful property of authentication; operational security also depends on registration, devices, sessions, and procedures. A successful pilot should leave a supportable process for helpdesk staff, as well as an access flow that works.