This browser holds a non-extractable P-256 key, like a phone. Registering creates a device-bound account; add its id to the API's OWNER_ACCOUNT_IDS variable and reload. No password or shared secret exists.