Token has introduced TokenCore Card, a biometric smart card designed to combine FIDO2 passwordless authentication with on-device fingerprint verification and wireless connectivity. The product targets enterprise identity security, including employee logins, privileged access and workflows in which AI agents must obtain human approval before executing sensitive actions.
Token Brings Biometric Verification to Enterprise Authentication
Token, a biometric identity assurance company, unveiled TokenCore Card at Authenticate U.S. 2026. The card combines fingerprint verification, Bluetooth and near-field communication (NFC) in a familiar employee-card format, with the aim of making phishing-resistant authentication easier to deploy across enterprise environments.
The product is designed to work alongside existing identity and access management (IAM), single sign-on (SSO) and privileged access management (PAM) systems. Token says the card supports FIDO2 passwordless authentication and verifies the enrolled user’s fingerprint directly on the device. According to the company, biometric data remains on the card, while a cryptographic signature is used for authentication.
The approach addresses a persistent weakness in enterprise security: authentication methods that prove someone possesses a credential or device may not establish that the authorized person is present. Passwords can be stolen, one-time codes intercepted and push notifications approved under pressure. Phishing-resistant authentication can reduce exposure to credential theft, although deployment configuration and account recovery processes remain important security considerations.
Token did not disclose pricing, general availability or independent security-test results in the announcement.
How TokenCore Card Works
TokenCore Card combines a physical security device with biometric verification. Instead of relying solely on a password or an approval prompt sent to a phone, the system requires the enrolled user’s fingerprint before the card can authenticate.
The company lists several capabilities:
- FIDO2 passwordless authentication: Supports authentication flows designed to resist common phishing attacks.
- On-device fingerprint verification: Keeps biometric verification on the card rather than transmitting the fingerprint as part of the authentication process.
- Bluetooth and NFC connectivity: Offers wireless interaction with supported devices and authentication workflows.
- Enterprise integration: Designed to work with existing IAM, SSO and PAM infrastructure.
- Cross-platform support: Token says the product works with Windows, macOS, Linux, iOS and Android.
Token also claims setup takes less than five minutes and passwordless login takes under two seconds. These are vendor-provided figures; the announcement does not describe the testing conditions or provide independent performance measurements.
The card’s practical value will depend on compatibility with an organization’s authentication stack, device policies, enrollment procedures and recovery options. Enterprises will also need to assess what happens if a card is lost, damaged or unavailable and how administrators revoke access without weakening security.
Human Approval for Sensitive AI Agent Actions
Token is positioning the card as a control for AI agents as well as human users. The company says TokenCore extends an agent-approval capability it introduced in June, allowing an AI workflow to pause when it reaches a sensitive operation that requires authorization.
Examples cited by Token include releasing a wire transfer or changing access rights. In these cases, the workflow waits for an authorized person to approve the action using a fingerprint on the card. Token says its technology integrates with AI agent gateways alongside existing IAM, SSO and PAM systems.
The model reflects an emerging challenge in enterprise AI: organizations need to distinguish between an agent being technically authorized to execute a task and a human having explicitly approved a consequential action.
A biometric approval step could provide an additional control for high-risk transactions, particularly when connected to clear policies about which actions require approval. However, biometric verification alone does not establish that a requested action is appropriate. Enterprises still need controls over agent permissions, transaction context, audit logs and the scope of delegated authority.
The announcement did not identify specific gateway integrations, provide technical architecture details or explain how approval requests are bound to the exact transaction being authorized. Those details will be important for security teams assessing the system against transaction manipulation and unauthorized workflow changes.
Identity Security Expands Beyond Passwordless Login
Token’s launch comes as enterprises reconsider authentication for employees, administrators and increasingly autonomous software agents. FIDO2-based authentication can help reduce reliance on passwords and other phishable factors, while hardware-backed credentials may provide stronger protection against credential theft.
AI agents complicate the picture because they can initiate actions at machine speed and operate across multiple systems. Organizations therefore need to determine when an agent can act independently, when it requires additional verification and which human is accountable for approving an operation.
Kevin Surace, Token’s CEO, said the card is intended to make the physical card employees already carry verify the identity of the person using it. Chief Revenue Officer Katy Nelson framed the product around enterprise concerns about phishing-resistant authentication and approval of AI-agent actions.
For buyers, the key evaluation points will extend beyond convenience: cryptographic design, integration coverage, lifecycle management, recovery procedures and evidence that approvals are securely linked to specific actions. TokenCore Card brings biometric authentication and human approval into one product concept, but independent validation and deployment details will help determine how effectively it addresses enterprise identity risks.
Market Landscape
Enterprise identity security is evolving from password replacement toward stronger verification, access governance and controls for automated actions. FIDO2 and passkeys help reduce phishing risks, while privileged access systems and approval workflows govern sensitive operations. As AI agents gain access to enterprise tools, vendors are also developing mechanisms to keep humans involved in consequential decisions without requiring manual intervention at every step.
Top Insights
- Biometric authentication: TokenCore Card combines FIDO2 passwordless login with on-device fingerprint verification.
- Existing infrastructure: The product is designed to work alongside IAM, SSO and PAM systems.
- AI agent controls: Sensitive actions can be paused for fingerprint-based human approval.
- Vendor-reported performance: Token claims setup under five minutes and login under two seconds, without independent benchmarks in the announcement.
- Deployment details matter: Integration coverage, recovery, transaction binding and auditability will be important for enterprise evaluation.
Power Tomorrow’s Intelligence — Build It with TechEdgeAI
