The same person must come back.

Record a baseline you can compare.

In your own staging environment, select a disposable pre-migration test account. Record its internal user ID and the provider connection it uses in a private test record. A familiar display name is not sufficient: two users can share the same name. Keep a separate test case for new registration, which exercises an insert that an old session can skip.

Start without the previous browser session.

Sign out and open the staging flow in a fresh browser profile or context. Complete the same provider login used by the existing test account. Verify the returned internal user ID against the baseline through your application's trusted test instrumentation. A successful redirect or dashboard screenshot does not establish identity continuity.

WebTraceCheck is an optional way to work with a fresh browser session and inspect your public staging URL. It does not read your account database or certify a migration. You can use your own browser profile and application tests instead.

Exercise a new account insert.

Create a separate disposable account in your own non-sensitive staging app. Check the actual user and account rows through your normal test access. If your app includes verification email, request one message and follow the complete verification path. Distinguish a successful send request, receipt, accepted verification and authenticated application state in the test record.

CleanTempMail can supply a disposable inbox for that non-sensitive signup test. Use a dedicated test inbox if your app blocks disposable domains. Never use a temporary address for a production administrator, an identity-provider account, recovery or a sensitive user identity. This optional step does not require KeyFold to send mail.

Test the account flow you actually use.

If linking a second provider is part of your application, test it separately with disposable accounts and the expected owner relationship. This can exercise different code from initial signup. Include the SSO or custom-provider path only when you have a safe staging configuration for it; the local map cannot validate provider claims or ownership.

Keep the evidence layers separate.

The identity review reports exact-string groupings. A schema inspection reports constraints. The staging run reports observed behavior in that environment. None substitutes for the others. Both linked products share an operator with KeyFold; they are optional conveniences, with no guarantee of traffic, deliverability or migration correctness.