Agentic Commerce Pushes Passkeys Beyond User Login

AI shopping agents are pushing payment identity beyond proving that a human is present, Frontier Enterprise reported from FIDO Authenticate APAC in Singapore, because merchants and banks also need evidence of what the agent was allowed to buy.

The checkout problem is different from a conventional passkey login.

A user may authorize an agent to search for a hotel room, monitor prices and complete a purchase later, before the final merchant, product or price is known.

In that flow, authentication has to cover both the person behind the request and the instructions delegated to the agent.

PayPal and Mastercard used the panel to show why passkeys are already part of the payment stack.

PayPal has deployed FIDO-based authentication for 12 to 13 years, and Rakan Khalid, the company's senior director for identity product, said passkeys and biometrics appeared several times as key revenue drivers in PayPal's February 2026 earnings report.

Mastercard's deployment gives the technology a merchant-side scale marker.

The network's payment passkey, launched last year, is now available to more than 1,000 merchants for authenticated transaction acceptance.

Jonathan Grossar, senior vice president of product management at Mastercard, put the authentication-rate lift from passkey use at 17%, with results varying by market.

The operating benefit is a shorter checkout path.

Passkeys can confirm a payment with a biometric gesture instead of adding a more intrusive authentication step, while verifiable credentials can let multiple data points be checked in the same interaction.

For merchants, fewer interruptions matter because extra checks can lead users to abandon carts or transactions.

Wallets are becoming the management surface for those credentials.

Lee Campbell, identity and authentication lead for Android at Google, said credentials managed inside wallets can sit beside payment credentials, giving users a place to select them and review transactions.

The FIDO Alliance is also adapting payment standards to digital credentials while addressing European requirements for two-factor authentication and other payment controls.

Agent-mediated commerce adds a second proof layer.

In a normal e-commerce session, the merchant can present the item, price and return terms directly to the user.

When the user shops inside Gemini, ChatGPT or another agent interface, the merchant may not control the screen that describes the offer, and the buyer may only have granted a broad instruction such as booking a hotel.

Google's Agent Payments Protocol is designed to support transactions between agents and merchants while carrying evidence that the user gave permission.

Mastercard's Verifiable Intent, which Grossar called deterministic and non-repeatable proof of the user's intent, addresses the same need from the network side: the payment ecosystem needs a record that an autonomous agent acted within the user's mandate.

The standards work is still early.

Grossar put a one-year horizon on basic standards, and Campbell called for limited early implementations rather than a three-year closed specification process.

Agent checkout will depend on whether those pilots can turn passkeys, wallet credentials and intent proofs into a payment flow that merchants, banks and networks can verify without adding friction back into the purchase.