pub const MAX_CREDENTIAL_ID_CHARS: usize = 1364;
Longest credential id accepted. The spec allows up to 1023 raw bytes; this is that ceiling in base64url, so nothing legitimate is refused and an unbounded string is.