Test your website configuration
Check if isitme is set up on your domain, view authentication status, and reset access.
Localhost & Testing
isitme works on localhost out of the box. Here's what to know when developing locally.
WebAuthn on localhost
WebAuthn requires a secure context — which means HTTPS in production. But browsers make an exception for localhost and 127.0.0.1, so passkey registration and login work over plain HTTP during development.
0.0.0.0, my-app.local, or a LAN IP won't work without HTTPS. Stick to localhost for local development.Auto-detection
isitme automatically detects the right configuration from the incoming request. No environment variables or manual config needed.
Set from the request hostname. On localhost, this is localhost.
Built from the request protocol and host, e.g. http://localhost:3000.
The Secure flag is off in development so cookies work over HTTP.
Storage for testing
The default cloud storage is scoped to your domain — credentials registered on localhost are separate from production. For faster iteration, use a local adapter:
import { isitme } from "isitme/express";
import { file } from "isitme/storage";
app.use(isitme({
storage: file("./.credentials.json"),
}));
// Delete .credentials.json to start freshUse memory() for ephemeral testing — credentials are lost on every server restart, so you can re-register each time.
Common issues
Browser says passkeys aren't available
Make sure you're accessing your app via localhost, not 0.0.0.0 or a raw IP. WebAuthn only works in secure contexts.
Session lost after login
Check that your frontend and backend are on the same origin. If your API runs on a different port, cookies won't be sent. Use a proxy or serve both from the same origin.
Want to start over?
With file() storage, delete the JSON file. With memory(), restart the server. With cloud storage, use the domain checker above to reset via DNS.
Different port = different site
Credentials registered on localhost:3000 won't work on localhost:5173. The WebAuthn origin includes the port, so each port is treated as a separate site.