:::endpoint POST /v1/me/passkeys/options

Ask for this, hand it to the platform, then send what comes back to
[the register step](/docs/api/apps/passkeys-create).

The challenge inside is kept against the token that asked for it, so only the
device that started the ceremony can finish it. It is spent by the next attempt,
whether that attempt worked or not.

## Request

```bash
curl -X POST https://api.proppertrading.com/v1/me/passkeys/options \
  -H "Authorization: Bearer ptat_9f2c1a44_3b8e7d2f5c9a1b4e6d8f0a2c4e6b8d1f"
```

No body.

## Response

The `publicKey` half of a WebAuthn creation request. Field names are WebAuthn's.

```json
{
    "data": {
        "object": "passkey_options",
        "challenge": "3q2-7_8",
        "timeout": 60000,
        "rp": { "name": "Propper", "id": "proppertrading.com" },
        "user": {
            "id": "AQIDBA",
            "name": "jamie@acmefunded.com",
            "displayName": "Jamie Rivera"
        },
        "pubKeyCredParams": [{ "type": "public-key", "alg": -7 }],
        "authenticatorSelection": { "userVerification": "required" },
        "excludeCredentials": []
    },
    "meta": { "request_id": "req_01kz4bkr1aj1gv63d8fv3133ey" }
}
```

`userVerification` is `required` on purpose. The phone is asking for Face ID or a
fingerprint either way, so it may as well say so to the authenticator instead of
hoping.

`rp.id` is ours and stays ours whichever firm the account belongs to.

## Errors

| Status | Code                 | Meaning                              |
| ------ | -------------------- | ------------------------------------ |
| 403    | `insufficient_scope` | This device does not hold `me:write` |