Challenges are generated in the browser for simplicity. Production apps should issue challenges from your server and verify attestation / assertions there.
@demo.local
Saved via /api/users (MongoDB) — pick who to authenticate as.
/api/users
Console log
—