# Google test accounts

Set up a dedicated Google Workspace test account with passkeys, approved passwordless sign-in, or password and authenticator access.

Use a Google credential when your app offers **Continue with Google**. Use a dedicated Google Workspace test account. We recommend a dedicated passkey with passwordless sign-in when your organization's security policy permits it; password and authenticator sign-in remains available.

## Which account to use

- **A company Google Workspace account made for testing**, such as `qa-agent@yourcompany.com`. Your Workspace admin controls it, and it belongs to no real person.
- **Not a personal Gmail account.** Google suspends personal accounts that sign in automatically from new browsers.
- **Not signed in on any phone or tablet.** When an account is on a device, Google sends "Is it you trying to sign in?" prompts to that device, and the agent cannot answer them.

## Set up the account

1. Ask your Google Workspace admin to create the user in an organizational unit used only for test accounts, and to allow 2-Step Verification for it.
2. Sign in as that user once in your own browser and set a strong password.
3. Open **Google Account → Security → 2-Step Verification** and turn it on.
4. Under **Authenticator**, choose **Set up authenticator**, then **Can't scan it?**. Copy the setup key that Google shows. You add it to Composal in the next section.
5. Finish setup by entering a code from any authenticator app that has the same key.
6. Keep the dedicated passkey and administrator-approved recovery methods. Avoid second steps that need someone to approve a phone prompt, and sign the test account out of phones and tablets under **Your devices**.

## Recommended: a dedicated passkey

For approved Workspace test accounts, we recommend starting with their dedicated organizational unit. Your administrator can instead apply the policy organization-wide when that scope is explicitly approved:

1. In the Admin console, open **Security → Authentication → Passwordless → Skip passwords**. Select the organizational unit for test accounts, or the whole organization if that is your approved policy.
2. Enable **Allow users to skip their password and authenticate with a passkey**, then choose **Override** or **Save** for the selected scope.
3. Sign in as the test account. Open **Google Account → Security & sign-in → How you sign in to Google**, and turn on **Skip password when possible**.

Both the admin policy and the user's preference are needed. This does not remove the account's password. See [Google's Workspace administrator instructions](https://knowledge.workspace.google.com/admin/users/allow-users-to-skip-passwords-at-sign-in) and [Google's passkey account instructions](https://support.google.com/accounts/answer/13548313).

Example of the administrator policy enabled organization-wide. Select the scope approved by your
    administrator; a dedicated organizational unit can limit the rollout to test accounts.

The test account's own Skip password when possible preference must also be on.

Then [enroll a new dedicated passkey with Composal](/docs/verify/credentials/managed#passkey) and verify a fresh sign-in. Enabling the switches does not create a key or establish that the runner can sign in. Complete every provider step before confirming `SAVE`; test a fresh Verify run before relying on passwordless access.

If your policy does not allow skipping passwords, keep password and passkey sign-in. Attach the key to the existing Google credential with `--account` so its password and authenticator remain available. The enrollment CLI requires a build that includes `accounts enroll-passkey`; check its `--help` before starting.

## Add it to Composal

1. Open your project's **Credentials** and choose **Add Credential**, or use **Test access** during setup.
2. Choose **Google** under other sign-in methods.
3. Enter the account's email address and password.
4. Paste the setup key into **Authenticator Secret**. It is required for the **Google** credential method: agents use it to generate a fresh code whenever Google asks. Paste the key itself, not a six-digit code.
5. Choose **Save test account**.

Composal encrypts the password and setup key.

## Troubleshooting

- **Google asks for a phone or shows "Verify it's you".** Check whether Google requires a device prompt. Ask your Workspace administrator to review the test account's permitted second steps and recovery policy before using it for runs.
- **Google says the browser may not be secure.** Sign in to your app yourself, then save your app's session with **Session** sign-in instead. Google's own cookies are not accepted.
- **The authenticator code is rejected.** The setup key was copied wrongly or replaced. Set up the authenticator again in Google and paste the new key.
- **A passkey is used but Google still asks for a password.** Check the account's effective passwordless policy and the user's **Skip password when possible** preference. Until a complete fresh sign-in proves passwordless access, keep the existing Google credential with its saved password and authenticator.