Passkeys Are Not Enough: The Authorization Proof AI Agent Payments Need, and How Merchants Should Prepare
Google, Mastercard, and PayPal debated the gap between authentication and authorization at FIDO Authenticate APAC. Passkey performance data, a comparison of four delegation designs including AP2 and Verifiable Intent, and what merchants should settle now.
Key Takeaways
- At the FIDO Alliance's Authenticate APAC conference in Singapore, Google, Mastercard, and PayPal agreed that authenticating the shopper is no longer sufficient for AI agent transactions.
- Passkeys prove that the person is who they claim to be. What an agent is allowed to buy, and within what limits, has to travel through a separate mechanism.
- For merchants, the near-term question is which delegation format their payment stack can accept, and whether their product data is accurate enough for an agent to present it correctly.
The shopper is verified, but nobody knows what was approved
Passkeys can authenticate users, but agentic commerce also requires proof of what an AI agent was authorised to purchase.
www.frontier-enterprise.comAt "Enabling Trusted, Simple Interactions in the Agent Era", a panel at the inaugural FIDO Authenticate APAC conference held in Singapore in June 2026, speakers from Google, Mastercard, and PayPal converged on the same problem. When an AI agent makes a purchase, merchants, banks, and payment networks cannot decide anything on identity alone.
Lee Campbell, Identity and Authentication Lead for the Android platform at Google, stressed that the starting point of the purchase has moved. Shoppers no longer open the merchant's site. They finish the entire journey inside Gemini, ChatGPT, or another agent. That leaves merchants with no way to confirm whether the agent represented their products and conditions accurately.
The same gap exists on the shopper's side. When someone says "buy me a green T-shirt", the final product, the merchant, and the price do not yet exist. The substance of the transaction they approved is absent at the moment of approval.
What a passkey actually proves is only who
It helps to be precise about what a passkey is. A passkey is an authentication method built on the FIDO2 and WebAuthn specifications. A key pair is generated on the device, the private key never leaves it, and the service holds only the public key. At sign-in, the device verifies the user through biometrics or a local gesture and returns a signature. Because there is no shared secret to steal and replay, the method is resistant to phishing.
In other words, a passkey answers the question "is this the registered person?", which is authentication. What agent-mediated commerce additionally needs is an answer to "does this actor have permission to make this transaction?", which is authorization.
In conventional e-commerce, the two rarely needed to be separated. The shopper looked at the cart and pressed the final button, and authentication and authorization were established in the same instant. Agent transactions break that simultaneity. The moment permission is granted and the moment the purchase happens are separated in time and in context. The design of Verifiable Intent, described by Jonathan Grossar, Senior Vice President of Product Management at Mastercard, is built around that separation.
A 17% improvement, and the people who enrol but never use it
Passkeys themselves are producing measurable results. Mastercard deployed its payment passkey last year and has since enabled more than 1,000 merchants to receive authenticated payments. Compared with traditional authentication methods, it recorded a 17% improvement in authentication rates. Grossar noted that results vary by market, but that once consumers create a passkey they tend to keep using it.
PayPal has run FIDO-based authentication far longer, for the past 12 to 13 years. Since launching PayPal passkeys, conversion among passkey users has run higher than among users of traditional methods, and Rakan Khalid, Senior Director of Identity Product at PayPal, said passkeys and biometrics appear as key revenue drivers in the company's February 2026 earnings report.
There is another side to that story. According to PayPal figures compiled by the passkey vendor Corbado, enrolled users passed 100 million as of May 2026 and enrolment penetration reached 48% of the eligible base, yet only around 20% of eligible logins actually use a passkey. Enrolment moves faster than usage, and that gap persists even in one of the industry's largest deployments. Judging a rollout on the authentication-rate improvement alone hides it.
Four designs for carrying authorization, running in parallel
So how does authorization get proved? This is a crowded area. In April 2026 the FIDO Alliance formed an Agentic Authentication Technical Working Group, taking Google's AP2 and Mastercard's Verifiable Intent as initial contributions. The group is co-chaired by CVS Health, Google, and OpenAI, and covers three areas: verifiable user instructions, authentication of the agent itself, and trusted delegation for commerce.
The Agent Payments Protocol (AP2) that Campbell described exists to give merchants, banks, and payment networks assurance that the agent is acting accurately on the user's behalf and has permission to buy. Mechanically, it signs the user's intent, the confirmed cart, and the payment as separate W3C verifiable credentials and chains them together.
Verifiable Intent, as Grossar put it, is a deterministic and non-repeatable proof of the user's intent. The first layer verifies identity and produces a device-bound key. The second defines what the agent may do and generates a set of constraints, including a digitally signed list of permitted merchants. The third records the completed transaction and links the proof to the cart.
| Approach | What it tries to prove | What the merchant receives | Status |
|---|---|---|---|
| AP2 (Google) | The user's intent and approval of a confirmed cart | Three signed credentials covering intent, cart, and payment | Published September 2025. Contributed to the FIDO working group |
| Verifiable Intent (Mastercard) | A non-repeatable record of the reason for the purchase | Three layers: identity, permission constraints, transaction proof | Pilots began February 2026. Contributed to FIDO |
| Agentic Token (Mastercard Agent Pay) | Which agent may pay, and within what scope | A token restricted by merchant, category, amount, and timeframe | Announced April 2025. Agent Pay for Machines added in June 2026 |
| Delegated Payment (ACP) | A single-use right to use a payment method | A one-time token bounded by amount, currency, expiry, and merchant ID, plus risk signals | Specification published |
Lined up side by side, the four are proving slightly different things. AP2 and Verifiable Intent try to prove what the user permitted. Agentic Tokens and delegated payment tokens try to bound how far a payment credential may be used. From a merchant's seat, the former affects where liability lands after a dispute, and the latter caps the size of the loss.
Attackers are already looking at delegated credentials
Taking the proponents at their word would be a mistake. Visa's Payment Ecosystem Risk and Control team reported in its analysis of agentic commerce threats that mentions of "AI Agent" in underground community posts rose more than 450% over six months compared with the prior six-month period. Over the same window, malicious bot-initiated transactions rose 25% globally and 40% in the United States.
One named technique is the counterfeit storefront that looks legitimate and passes automated checks. The agent completes a purchase with stored credentials, and the operator harvests the payment data and uses it immediately. What makes this awkward is that the transaction looks technically valid at every step. Authentication passed, the token was live, the signatures were in place. Only the intent was broken.
Grossar himself acknowledged that agentic systems are developing much faster than standards can be created, and called the task ahead difficult. His hope was that basic standards would exist a year from now. Campbell argued that spending three years behind closed doors on a specification would leave the industry far behind, and pushed for limited early implementations to learn from. Read the other way, today's implementations should be treated as provisional forms still being learned from.
What merchants should settle now
Merchants do not need to pick a standard yet. What they need is to be ready to move when one settles.
On the payments side, asking your PSP which delegation formats it intends to support makes the later decision faster. Accepting AP2-style signed evidence, leaning on card network token constraints, or handling single-use ACP tokens each imply a different amount of merchant-side work. Making agent-mediated transactions identifiable in your logs is worth doing alongside it, so that a fraud case can be separated out later.
Product data pays off regardless of where the standards land. The problem Campbell raised, whether the agent represents your products and conditions accurately, is not solved by any authorization protocol unless price, stock, return policy, and shipping terms are machine-readable and consistent. Proof of authorization secures the agent's permission. It says nothing about the accuracy of what was presented.
The panel did not set out merchant implementation costs, nor how liability is divided when a merchant does not verify the authorization evidence. Publication timing for the specifications the FIDO working group is handling is also undisclosed.
Conclusion
The shift in the passkey conversation from authentication to authorization is itself a sign that agent transactions are leaving the experimental stage. Four designs are still running in parallel, though, with no guarantee that they converge.
Two things are worth watching: how the FIDO working group reconciles AP2 with Verifiable Intent, and how the industry answers the counterfeit-storefront attack Visa described. For merchants, getting your product data into a state that agents can read correctly remains the reliable investment while the authorization layer settles.
