The domain must be the one where you'll implement passkey login. It can be scoped to a subdomain (e.g. admin.example.com), but then the passkeys will only work there. You can also use "localhost" for development and update to your actual domain later.