> Also, I've made one invite-only web app where single-use invite codes and passkeys are the only ways to log in. It was not too hard, it was fun, actually. And I get the peace of mind that account sharing is pretty much impossible were a bad actor able to get their hands on an invite, as is hacking other people's accounts.

It also makes access to the app maximally unrecoverable if someone loses access to the passkey...

The userbase is so tiny they can just ask me or another admin for another invite code. No data is tied to the account that would be lost in the process.