This page is the relying party. Build the options, press the button, and a real authenticator — a YubiKey, a platform authenticator, whatever this browser can reach — performs a real WebAuthn ceremony. Every artifact below is genuine.
The RP ID is not a free field. WebAuthn binds a ceremony to the calling origin: the RP ID must be this page's host, or a registrable parent of it. This page cannot run a ceremony for a domain it does not own — and that refusal is the phishing resistance, not a limitation to route around. To examine a ceremony belonging to someone else's relying party, use the Analyzer (paste the artifacts) or the browser extension (watch the call as it happens).
