pkSignIn

Register a YubiKey, sign in with or without a username, and see the options sent to the browser and the authenticator's raw response for every ceremony. The options that actually change behavior between devices are controls in the UI rather than constants in the code.

Two fallbacks for when the key is elsewhere or gone: an authenticator app, with TOTP implemented from RFC 6238 and checked against its published test vectors, and single-use recovery codes. The same sign-in model now protects this site's admin.