FIDO passkeys and the FIDO agentic working groups: how it relates to agent payment protocols

Steward: FIDO Alliance (CTAP and the agentic working groups); W3C Web Authentication Working Group (WebAuthn)
Status: Live passkey standards; agentic working groups active with no public deliverable
Latest version: WebAuthn Level 3 W3C Recommendation; CTAP 2.3 Proposed Standard (2026-02-26) (2026-08-25)
Primary source: Passkeys: passwordless authentication (external link)

What it is

A is a sign-in based on standards, kept on a phone, a computer or a hardware security key. Passkeys use FIDO2: WebAuthn is the browser API and CTAP is the protocol between the device and an authenticator. Synced passkeys move across a user’s devices through a passkey provider, while device-bound passkeys stay on one device. ^{Source [1]} WebAuthn Level 3 became a W3C Recommendation on 2026-08-25, and the newest CTAP is version 2.3, a FIDO Proposed Standard of 2026-02-26 (CTAP 2.2 dates from 2025-07-14). ^{Source [2, 3]}

The agentic working groups

On 2026-04-28 the announced a newly formed Agentic Authentication technical working group, chaired by members from CVS Health, Google and OpenAI, with vice-chairs from Amazon, Google and Okta. Its scope is how users delegate to agents with phishing-resistant authentication and how a service tells user-initiated actions from agent-initiated ones. The same release names a Payments technical working group chaired by Mastercard and Visa, and three focus areas: verifiable user instructions, authentication and trusted delegation for commerce. No deliverables or dates were given. ^{Source [4]}

Only the Agentic Authentication group was new that day. FIDO had launched a Payments working group on 2025-04-29, co-chaired by Visa and Mastercard. ^{Source [5]} No source says whether the 2026 “Payments technical working group” is the same body under a new name. FIDO drafts are member-only, and no public FIDO deliverable on agents was found on 2026-10-11. ^{Source [4]}

How it relates to the eight

On 2026-04-28 Google contributed AP2 and Mastercard contributed , which Mastercard co-developed with Google to work with AP2. is now the home of both. ^{Source [4, 6]} also appear in the card networks’ programs. authenticates payment instructions with passkeys, and Visa says every Agentic Ready transaction in Europe used Visa Payment Passkeys. These passkeys sit beside Visa TAP, not inside its signature . ^{Source [7, 8]} Mastercard says its build on the same tokenization behind Payment Passkeys, and its live regional purchases for Mastercard Agent Pay use Mastercard Payment Passkeys to authenticate consumers. ^{Source [9, 10]} OpenAI co-chairs the agentic group, but ACP has no specification link to FIDO. No relation was found for UCP, x402, ERC-8004 or MPP. ^{Source [4]}

Status history

2019-03-04: WebAuthn Level 1 becomes a W3C Recommendation. ^{Source [2]}
2025-04-29: launches the Payments working group (Visa and Mastercard co-chairs). ^{Source [5]}
2025-07-14: CTAP 2.2 Proposed Standard. ^{Source [3]}
2026-02-26: CTAP 2.3 Proposed Standard. ^{Source [3]}
2026-04-28: Agentic Authentication technical working group formed; AP2 and contributed. ^{Source [4]}
2026-08-25: WebAuthn Level 3 becomes a W3C Recommendation. ^{Source [2]}

Relations at a glance

How FIDO passkeys and the FIDO agentic working groups relates to each protocol
Protocol	Relation	Note
AP2	Same steward	Google contributed AP2 to the FIDO Alliance on 2026-04-28, so AP2 specification work now continues inside FIDO.
Mastercard Agent Pay	Same steward	Mastercard contributed Verifiable Intent, the intent layer of Agent Pay, to FIDO on 2026-04-28; Mastercard Payment Passkeys authenticate consumers in live regional transactions.
Visa Trusted Agent Protocol	Complements	Visa co-chairs the FIDO Payments working group; Visa Payment Passkeys authenticate Visa Intelligent Commerce payment instructions around TAP, not the TAP signature itself.

Back to the orbit

Sources

Passkeys: passwordless authentication (external link)FIDO Alliance. Documentation, primary source. Accessed 2026-10-11.
Web Authentication: An API for accessing Public Key Credentials Level 3 (external link)W3C. Standard, primary source. Published 2026-08-25. Accessed 2026-10-11.
Download the FIDO specifications (external link)FIDO Alliance. Standard, primary source. Accessed 2026-10-11.
FIDO Alliance to Develop Standards for Trusted AI Agent Interactions (external link)FIDO Alliance. Announcement, primary source. Published 2026-04-28. Accessed 2026-10-11.
FIDO Alliance Launches Payments Working Group (external link)FIDO Alliance. Announcement, primary source. Published 2025-04-29. Accessed 2026-10-11.
We're donating Agent Payments Protocol to the FIDO Alliance to support the future of secure, agentic payments (external link)Google (The Keyword blog). Announcement, primary source. Published 2026-04-28. Accessed 2026-10-11.
Visa Intelligent Commerce overview (Visa Developer Center) (external link)Visa. Documentation, primary source. Accessed 2026-10-11.
Visa and Banks Across Europe Reach the Next Phase of Agentic Commerce, Unlocking Secure Access to Merchants (external link)Visa. Announcement, primary source. Published 2026-07-02. Accessed 2026-10-11.
Mastercard Unveils Agent Pay, Pioneering Agentic Payments Technology to Power Commerce in the Age of AI (external link)Mastercard (Investor Relations, Business Wire release). Announcement, primary source. Published 2025-04-29. Accessed 2026-10-11.
Mastercard advances agentic payments in Latin America and the Caribbean with live transactions completed across the region (external link)Mastercard Newsroom. Announcement, primary source. Published 2026-03-24. Accessed 2026-10-11.