A website can have valid passkey metadata and a broken authentication flow. It can also support passkeys while publishing none of the optional discovery files a scanner looks for.

The useful question is not "How many green checks do I have?" It is "Which conditions did this report evaluate, and which of them does my architecture require?"

This is the final part of Passkeys in Production , adapted from the full report guide . We build the Helpers.work Passkey Deployment Checker ; this walkthrough describes its actual scope.

Use the origin where WebAuthn runs

Enter your public sign-in URL or domain. The tool normalizes it to an origin, so supplying /account/security does not turn the scan into a test of that page.

If the marketing site redirects to a login host, use the host where the browser actually creates or requests credentials.

The checker uses public HTTPS domains on port 443.…