v135 · miscellaneous

Secure Payment Confirmation: Browser Bound Keys

Adds an additional cryptographic signature over Secure Payment Confirmation assertions and credential creation. The corresponding private key is not synced across devices. This helps web developers meet requirements for device binding for payment transactions.

concepts

  1. Browser-bound keys

    Generate a non-syncing key alongside the platform passkey, enroll both public keys with the backend, and verify the resulting double-signature on the server.

  2. The "non-syncing" key in SCA / PSD2

    The PSD2 regulatory use case the feature was designed for: passkeys sync (violating "something you have"), browser-bound keys add a device-pinned signature without losing the synced-passkey UX.

  3. Key lifecycle explorer

    Walk through the full lifecycle of an SPC browser-bound key — enrol, sign, rotate, destroy — and compare it with a passkey to see scope, sync, and recovery differences.

  4. Cross-device replay demo

    Enroll Device A with the backend, create a payment assertion, then send a Device B browser-bound signature for the same challenge. The server verification fails, demonstrating exactly why browser-bound keys prevent cross-device replay.

why it shipped

This feature amends to Secure Payment Confirmation to keep up with syncing passkeys and device requirements for online payments. The Browser Bound Keys feature adds device binding in the browser to enabling payment use cases where device binding is required.

references