Ah ok, it's using Sendgrid (free tier) for the emails so perhaps that's impacting deliverability - I have found in the past the shared IPs can be hit and miss. I'll look at switching to a paid service and make sure there's a way to have the email resent if it doesn't deliver.

Sure, I'll look into cleaning up the error messages and providing a demo app next.

Will it work?

What we need to look for here is support for Webauthn, we can see here that all of the popular browsers support Webauthn - https://caniuse.com/?search=webauthn across desktop, iOS and Android, covering ~96% of all users.

Will the UX be good?

This is where we start to look at support for things like biometrics and generally, we'd prefer that user's passkeys are secured on their devices using biometrics rather than a PIN. In this area, the support is good across modern mobile devices (fingerprint and/or face id) and many newer desktop devices (e.g touchid). Probably the most obvious limitation here is a desktop device with no support for biometrics, however, Webauthn has a neat solution here where a user can link up this device with their smartphone using either bluetooth or by scanning a QR code - this then allows the user to login using a desktop device with a passkey secured on their mobile device.

Most of the popular password managers now also support passkeys, so that's another workaround that works well in many cases.

Passkeys use public key cryptography, so in this case we have a private key that remains securely on the user's device, and a public key that's stored on the server. Most modern devices are able to secure the passkey using biometrics, but users can also choose to use a password managed that supports passkeys.