demo · v135
Two signatures, one click
Secure Payment Confirmation in Chrome 135 adds a second signature — a per-device, non-syncing key the browser holds. This backend-backed lab enrolls a passkey-style public key and a browser-bound public key, issues a payment challenge, then verifies both signatures on the server.
Backend verifier
The browser-bound key store itself is internal to SPC. This page uses WebCrypto key pairs to drive the same dual-signature verification shape through a real Deno endpoint, so the server accepts or rejects the assertion instead of the page inventing the result.
subtle.generateKey: ?
see also
- Browser-bound keys — feature index
- ChromeStatus entry
- SPC spec