Two ways to sign in
An invited member can create an account with a password and later add a passkey. An organization may require an extra passkey or SMS step when accessing its codes, depending on its policy and configured integrations.
Avoid a single point of failure
Keep a second passkey when possible. Store one time recovery codes outside Team2FA, in a place the user can access if the primary device is lost. A recovery session can register a new passkey but cannot retrieve authenticator codes.
Domain changes
Passkeys are tied to the website domain. If the app moves to a new domain, existing passkeys may need to be registered again after signing in through another supported method. Plan this before retiring an old domain.