apidays LIVE London 2021 - Reaching Maximum Potential in Banking & Insurance with API Mindset October 27 & 28, 2021 APIs in Finance: The Next Evolution Leveraging Webauthn for Payments: Secure Payment Confirmation Chris Wood, Freelance Architect & Developer

1. Leveraging Webauthn for
Payments: Secure Payment
Confirmation
Chris Wood
chris@graphiso.io

2. What is Webauthn?
● API for web authentication that
supports biometrics.
● All major browsers/operating
systems.
● Provides loose-coupling to underlying
biometric capabilities.
● Replaces operating system
delegation with “Authentication
Assertion”.
● Signed-proofs of authentication that
can be verified by a Relying Party.
● Each credential tied to a web origin
i.e. a specific domain.

3. Webauthn in action...

4. New York
JULY
Australia
SEPTEMBER
Singapore
APRIL
Helsinki & North
MARCH
Paris
DECEMBER
London
OCTOBER
Jakarta
FEBRUARY
Hong Kong
AUGUST
JUNE
India
MAY
Check out our API Conferences here
50+ events since 2012, 14 countries, 2,000+ speakers, 50,000+ attendees,
300k+ online community
Want to talk at one of our conferences?
Apply to speak here

5. Secure Payment Confirmation
● Created in W3C Web Payments
Working Group
● Currently at first public draft
● Adds a payment extension to
Webauthn
● Adds a new actor - the Merchant
● Merchant can invoke the Webauthn
API using bank credential - they
own the UX
● Can meet dynamic linking
requirements of PSD2

6. SPC in action...

7. SPC Use Cases
Obviously ecommerce...
● SCA initiated by a merchant with a credential owned by the bank.
● Supported in latest versions of 3D Secure.
● Easily pluggable into OpenID Connect to support open banking payments.
But considering the ubiquity of the underlying Authenticator?
● Biometric-based authorization on any compatible platform:
○ Corporate kit only.
○ BYOD only.
○ Cross security realm.
○ Nothing to install.
● And ripe for extension to other industries, sectors, etc. - Secure Identity
Confirmation?

8. The End
Cheers!
Questions?