The WebAuthn user id must never hold an email address. Here is what the spec forbids, what breaks when you ignore it, and what to store instead.
Never Use an Email as Your WebAuthn user.id
calendar_today
July 16, 2026
domain
mojoauth