[bendavis381]

This matches our experience too. Out of curiosity, do you use email as the identifier? And if so, do you verify during the initial signup flow?

[p0seidon]

We use email or phone number as the identifier. We recommend verifying on sign-up, but it is actually a configuration option. We have other customers who want to request OTP on the next sign-in. Not validating the identifier on sign-up comes with a long list of potential security/ux race conditions further down the chain (especially if you also support social logins). What is your approach?

[foxylad]

Yes, we use email as the identifier, and yes we verify on signup.

We certainly aren't exceptional, and I expect that implementation will become easier as passkeys become more popular, and browser/device APIs develop. So hopefully later adopters will find it even easier than we did.