Create Challenge

Mints the challenge a browser needs to run a WebAuthn ceremony against the authenticated user's own passkeys. A registration challenge enrolls a new passkey; a deletion challenge is bound to the one passkey named by passkey_id and proves the user still holds it. Challenges are single-use and expire 5 minutes after they are issued, so send a fresh Idempotency-Key per ceremony — a replayed key returns the original challenge, which may already have expired. Requires a user session.