v145 · Web APIs · Browser Bound Demo

Browser Bound Demo

Checks browser-bound key support and explains what the browserBoundKey field looks like in the SPC assertion response.

Browser-bound keys require a full SPC payment flow (relying party server, registered credential, payment amount) to use the browser's internal key store. This page checks API availability and includes a backend verifier for the dual-signature assertion shape.

API support

WebAuthn / PublicKeyCredential—
PaymentRequest API—
Browser-bound key support—
Showcase verifier backend—

backend-backed assertion check

Enroll two public keys with the relying-party backend, request a payment challenge, sign it with both private keys, and verify both signatures server-side.

No verification run yet.

assertion structure with browser-bound key

// SPC assertion response (Chrome 145+, with browser-bound key)
{
  "id": "credential-id-base64",
  "rawId": ArrayBuffer,
  "response": {
    "authenticatorData": ArrayBuffer,
    "clientDataJSON": ArrayBuffer,
    "signature": ArrayBuffer,          // User auth signature

    // New in Chrome 145:
    "browserBoundKey": {
      "publicKey": ArrayBuffer,         // Browser-bound public key (COSE)
      "signature": ArrayBuffer,         // Signature over payment data
      "attestation": ArrayBuffer,       // Optional browser attestation
    }
  },
  "type": "public-key"
}

// Server verification:
// 1. Verify response.signature with the registered credential public key
//    → proves user authenticated (biometric/PIN)
// 2. Verify response.browserBoundKey.signature with browserBoundKey.publicKey
//    → proves same browser/device as at registration time

see also