# django-allauth: Help needed testing Passkeys **URL:** \ **Category:** Show & Tell\ **Created:** [July 5, 2024, 5:15pm UTC](https://forum.djangoproject.com/t/django-allauth-help-needed-testing-passkeys/32724 "2024-07-05T17:15:24Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![pennersr](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/pennersr/32/15832_2.png) [@pennersr](https://forum.djangoproject.com/u/pennersr)\ **Post date:** [July 5, 2024, 5:15pm UTC](https://forum.djangoproject.com/t/django-allauth-help-needed-testing-passkeys/32724/1 "2024-07-05T17:15:25Z")
The upcoming support for WebAuthn (including Passkeys) within django-allauth has reached a point where early feedback would be incredibly valuable. If you would like to help out, this is what you could do: - Do some monkey testing of the live demo running over at [https://django.demo.allauth.org/](https://django.demo.allauth.org/) - Similarly, test the React headless/single-page application version over at [https://react.demo.allauth.org/](https://react.demo.allauth.org/) - Check out the updated headless API specification: [allauth.headless OpenAPI Specification | django-allauth](https://docs.allauth.org/en/dev/headless/openapi-specification/#tag/Authentication:-WebAuthn) - Try using the current main branch locally, or within your project. Note that you do need to add `MFA_SUPPORTED_TYPES = ["totp", "webauthn", "recovery_codes"]` and `MFA_PASSKEY_LOGIN_ENABLED = True` to your `settings.py`. If you find anything out of the ordinary, please file an issue over at [Issues · pennersr/django-allauth · GitHub](https://github.com/pennersr/django-allauth/issues) With your help, progress towards getting this in a release will be faster. Thanks! ---
**Author:** ![IAmKale](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/iamkale/32/22423_2.png) [@IAmKale](https://forum.djangoproject.com/u/IAmKale)\ **Post date:** [July 5, 2024, 5:42pm UTC](https://forum.djangoproject.com/t/django-allauth-help-needed-testing-passkeys/32724/2 "2024-07-05T17:42:41Z")
This is very exciting, I’m eager to smoke test the demos! However, is use of a valid email required for the demos? My first inclination was to use “[a@example.com](mailto:a@example.com)” as an email just to get through account registration, but then I’m asked to “verify my email address.” These are clearly throwaway account credentials and passkeys being demonstrated, can the email address verification be made optional for the demos? ---
**Author:** ![pennersr](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/pennersr/32/15832_2.png) [@pennersr](https://forum.djangoproject.com/u/pennersr)\ **Post date:** [July 5, 2024, 8:23pm UTC](https://forum.djangoproject.com/t/django-allauth-help-needed-testing-passkeys/32724/3 "2024-07-05T20:23:46Z")
Alas, that would would not work very well. For example, turning on 2FA for accounts with unverified email addresses is something allauth prohibits, as that would result in an attack vector that can be abused. For example, consider a service where a hacker signs up using your email. Obviously, (s)he cannot not verify the email, but if 2FA is turned on you are effectively locked out of your account… ---
**Author:** ![dennisvd](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/dennisvd/32/1441_2.png) [@dennisvd](https://forum.djangoproject.com/u/dennisvd)\ **Post date:** [July 7, 2024, 4:09pm UTC](https://forum.djangoproject.com/t/django-allauth-help-needed-testing-passkeys/32724/4 "2024-07-07T16:09:27Z")
You can use a temp email address for example from this service: [https://temp-mail.org/en/](https://temp-mail.org/en/)