Challenges are generated in the browser for simplicity. Production apps should issue challenges from your server and verify attestation / assertions there.
@demo.local
Saved in database.json via /api/users— pick who to authenticate as.
database.json
/api/users
Console log
—