GeezerVison

This article has been nominated for merging. You are welcome to participate in the merge discussion, which will decide whether it should be merged into Passkey. Feel free to improve the article, but do not merge it before the discussion is closed. The discussion may also result in this article being deleted, redirected, or draftified. To learn more, read the guide to merge discussions. Find sources: "Client to Authenticator Protocol" – news · newspapers · books · scholar · JSTOR%5B%5BWikipedia%3AArticles+for+deletion%2FWebAuthn%5D%5DAFD

The Client to Authenticator Protocol (CTAP) enables a roaming, user-controlled cryptographic authenticator (such as a smartphone or a hardware security key) to interoperate with a client platform such as a laptop. The standard is also adopted as ITU-T Recommendation X.1278.^[1][2]

CTAP is complementary to the Web Authentication (WebAuthn) standard published by the World Wide Web Consortium (W3C).^[3] WebAuthn and CTAP are the primary outputs of the FIDO2 Project, a joint effort between the FIDO Alliance and the W3C.^[4]

CTAP is based upon previous work done by the FIDO Alliance, in particular the Universal 2nd Factor (U2F) authentication standard. Specifically, the FIDO U2F 1.2 Proposed Standard (July 11, 2017) became the starting point for the CTAP Proposed Standard, the latest version 2.2 of which was published on February 28, 2025.^[5]

The CTAP specification refers to two protocol versions, the CTAP1/U2F protocol and the CTAP2 protocol.^[6] An authenticator that implements CTAP2 is called a FIDO2 authenticator (also called a WebAuthn authenticator). If that authenticator implements CTAP1/U2F as well, it is backward compatible with U2F.

The protocol uses the CBOR binary data serialization format.

• FIDO Specifications Overview
• FIDO Specifications