Testing passkey authentication in continuous‑integration pipelines has long been a stumbling block for developers. Saru, a multi‑tenant SaaS platform, tackles the problem by leveraging Playwright’s Chrome DevTools Protocol to spin up virtual authenticators that mimic real security keys. The approach works only on Chromium, so the team runs WebAuthn tests there and mocks the state for other browsers.

Matching the authenticator’s transport setting to the server’s AuthenticatorAttachment value prevents registration failures that previously plagued the test suite. For one‑time‑passwords, Saru abandons test‑mode endpoints in favor of the Mailpit API. The script polls the local mail server, filters by recipient and subject, and extracts the six‑digit code, ensuring the test mirrors the production email flow.

To avoid race conditions when tests run in parallel, each test uses a unique email address and records a timestamp before requesting the OTP, then searches only for messages sent after that moment. These techniques reduce manual QA, keep the CI pipeline fast, and give developers confidence that authentication behaves correctly across environments.