1
Verify identity and authorization
Confirm your backend issues action-specific Connect tokens only for an authenticated, authorized account. Test that another account cannot enroll or delete credentials for that user.Confirm signed-passkey verification succeeds before a session is created. Test invalid, expired and replayed results and check that none creates a session. Follow backend setup.
2
Test enrollment and management
Enroll after your existing login, then repeat from another supported device. Check eligibility, explicit skip, cancellation, retry and an already-existing credential.List and delete a passkey from account settings. Confirm a deleted credential cannot authenticate. Provider-side Signal API updates depend on platform support, so an old entry may still appear in a credential chooser.
3
Test login and fallback
Test identifier-first, One-Tap and autofill where your integration enables them. Include account switching, unknown identifiers, no available passkey, cancellation and network failure.Complete fallback through your existing authentication method. Check that successful fallback can reach enrollment eligibility again and that passkey errors do not leave the user on a blank or blocked screen.
4
Test native lifecycle and device changes
For native apps, test background/foreground transitions, a login screen left open past initialization expiry and management actions after a delay. Initialization and challenge data have a limited lifetime; confirm the SDK and your UI recover or offer fallback when an operation can no longer continue.Include app reinstall, another device and local biometric unlock where relevant. Verify the application session and device-registration behavior you designed. Use the iOS and Android testing guides.
5
Exercise rollout controls
Check enrollment, login and management gates separately. Test excluded users and a rollout pause while confirming the existing login remains usable.Reducing enrollment exposure is different from disabling login for users who already have passkeys. Verify the fallback consequences before changing login availability. See gradual rollout.
6
Review outcomes before expanding
Use Connect analytics and debugging to inspect test processes, errors, activation and login usage by environment. Confirm the frontend result agrees with your backend session outcome.Expand from internal testers to a limited audience. Review passkey login share, enrollment outcomes, fallback and support feedback before each increase. Use Observe when you need analysis across your broader authentication journey and methods.