FIDO Alliance Launches Working Groups for AI Agent Authentication and Payments With Google and Mastercard

The FIDO Alliance announced two new working groups on Tuesday to develop industry standards for how AI agents authenticate, transact, and act on behalf of users. Google and Mastercard contributed open-source protocols as starting points: Google’s Agent Payments Protocol (AP2) and Mastercard’s Verifiable Intent framework, according to WIRED.

The initiative addresses a growing gap: AI agents are already initiating purchases, logging into services, and completing tasks with minimal human oversight, but no shared standard exists for verifying that an agent is acting on legitimate, authorized instructions.

Two Working Groups, Two Problems

The first group, the Agentic Authentication Technical Working Group, will focus on how users delegate actions to AI agents using phishing-resistant authentication without exposing credentials. It is chaired by members from CVS Health, Google, and OpenAI, with vice-chairs from Amazon, Google, and Okta, according to Help Net Security.

The second, the Payments Technical Working Group, will develop specifications for agent-initiated commerce. It is chaired by members from Mastercard and Visa and will build on Google’s AP2 and Mastercard’s Verifiable Intent contributions, according to PYMNTS.

How AP2 and Verifiable Intent Work

AP2 provides cryptographic proof that a user explicitly authorized a specific agent transaction within defined guardrails. WIRED described the use case: a buyer instructs an agent to purchase sneakers if they come back in stock below $100. AP2 verifies that the eventual purchase matches the user’s original, authenticated intent.

Google also released AP2 v0.2 on GitHub, introducing “Human Not Present” payments that allow agents to execute transactions autonomously based on pre-authorized instructions, according to the Google Blog.

Mastercard’s Verifiable Intent, co-developed with Google, creates a tamper-proof log of user-authorized agent actions. “By contributing Verifiable Intent to the FIDO Alliance’s standards work, we’re supporting an approach that creates a shared record of user intent that the entire payments ecosystem can rely on,” Pablo Fourez, Mastercard’s chief digital officer, said according to Help Net Security.

“We want to provide cryptographic proof that a transaction was authorized by the user themself, but keep it private so there is built-in selective disclosure,” Stavan Parikh, Google’s VP and GM of Payments, told WIRED.

The Timeline Problem

FIDO Alliance CEO Andrew Shikiar drew a direct parallel to the password crisis. “If we look back on our work in recent years on the massive problem space of passwords, that originated decades ago. The security foundation for what became our connected economy wasn’t fit for purpose,” he told WIRED. “Now we’re at a similar precipice with agentic agents and agentic interactions.”

Standard-setting processes in industry associations typically take years. Mastercard’s Fourez told WIRED that the pace of agentic AI development “compresses standards timelines that in the past might have taken two or three years.” The open-source contributions from Google and Mastercard are designed to give the working groups a head start, but the groups still need to build out practical use cases, test real-world implementations, and drive adoption across platforms, merchants, and payment providers.