attestationChallenge

MUST be delivered with HTTP header Cache-Control: no-store (see io.ktor.http.HttpHeaders.CacheControl). Serialize the body as JSON. See OAuth 2.0 Attestation-Based Client Authentication