CTAP, the Client to Authenticator Protocol, is the messaging channel that lets browsers, apps, and operating systems communicate with hardware authenticators such as security keys and built-in platform credentials. It is part of the FIDO ecosystem and is commonly used alongside WebAuthn, which defines how websites ask for authentication while CTAP defines how the client talks to the authenticator.
In security, CTAP matters because it helps enforce phishing-resistant login and user-consent flows. A browser can request a cryptographic challenge, and the key can require a touch, PIN, or other local confirmation before signing. Attackers may try to abuse weak client integrations, session theft, or poor approval design, but CTAP-based workflows make credential replay much harder than passwords or one-time codes. Defenders use it for strong sign-in, step-up authentication, and hardware-backed approvals when an action needs explicit user consent.