v145 · Web APIs · Payments

Secure Payment Confirmation: Browser Bound Keys

Chrome 145 adds browser-bound key support to Secure Payment Confirmation — a device-local cryptographic key managed by the browser, binding SPC credentials to a specific browser installation for additional fraud prevention.

background

Standard SPC credentials can be backed by platform authenticators (fingerprint, Face ID) but may be synced across devices. Browser-bound keys are generated and stored by the browser itself, tied to a specific device and browser installation, and never exported or synced. They provide an additional proof-of-device layer on top of the user authentication.

This is particularly useful for high-value transactions where the issuing bank wants to ensure the payment was initiated from a known, registered device.

concepts

  1. Browser Bound Demo

    Checks browser-bound key support, runs a backend-backed dual-signature verification, and shows how the browser-bound fields fit into an SPC assertion response.

  2. Key Management

    The lifecycle of browser-bound keys — generation, attestation, verification on the server, and what happens when the browser or device changes.

  3. Key Rotation Walkthrough

    Step through enrolment, payment, second-device sign-in, rotation, and revocation against the backend verifier. Surfaces which moments leave the browser-bound private key on a single device.

  4. Risk Scenario Comparison

    Walk through four attacks — phishing, malware, credential stuffing, device theft — and see what changes when browser-bound keys are in play. Includes an attack matrix showing which vectors are blocked, partially mitigated, or unaffected.

the change

// Chrome 145: SPC supports browser-bound keys
// Opt in during credential creation:
const credential = await navigator.credentials.create({
  publicKey: {
    // ... standard WebAuthn options ...
    extensions: {
      payment: {
        isPayment: true,
        // Request a browser-bound key alongside the credential
      }
    }
  }
});

// On payment: browser includes a browserBoundSignature in the assertion
// The assertion contains:
// - The credential's signature (user auth)
// - A browserBoundSignature (device/browser binding)

// Relying party verifies both signatures:
// 1. credential signature → user authenticated
// 2. browserBoundSignature → same browser/device registered

references