Check the address bar: the dashboards live only at dashboards.protocolclear.com. A passkey refuses any other address by itself.
The sign-in asks for the username, the password and the authenticator code, then the passkey. Nobody at ProtocolClear will ever ask you for any of them.
Keep the recovery codes in 1Password only; each works once.
Five wrong tries lock an address for fifteen minutes; every refusal is logged.
Sign out on a shared device: the Sign out button ends the session on this browser.