demo · v135

The "non-syncing" key in SCA / PSD2 regulation

Why merchants asked for this: EU PSD2 and similar regulations require that one of the authentication factors be tied to a specific device, not a cross-device-synced credential. Passkeys sync by design, which technically violated SCA. Browser-bound keys add a second signature, locally generated, that doesn't sync — satisfying the "something you have, on this device" requirement without losing the UX of synced passkeys.

Behind a flag Browser-bound keys ship behind chrome://flags/#secure-payment-confirmation-browser-bound-keys. This page sends the two-signature shape through a backend verifier so the server proves the passkey signature and browser-bound signature separately.
WebCrypto: ?

passkey only (pre-135)

// synced key signs the assertion
sig = sign(challenge, passkey)

// Bank: "Was authentication
// device-bound?" — no proof.

passkey + browser-bound key (135+)

// synced passkey signs as usual
sig1 = sign(challenge, passkey)

// device-local key signs too
sig2 = sign(challenge, browserBound)

// Bank verifies both. sig2's
// public key never left this
// device → SCA requirement met.

  


  

    
see also