Token has introduced a fingerprint smart card for passwordless enterprise logins and human approval of critical actions initiated by AI agents. TokenCore Card combines on-device fingerprint verification with FIDO2 authentication and Bluetooth and near-field communication connections.
The card will not authenticate without the enrolled user’s fingerprint, and the biometric data stays on the card; only a cryptographic signature is sent during authentication. Token says the card works with an organization’s existing single sign-on from day one and completes a passwordless login in under two seconds. It adds the card to a product line that already includes TokenCore Node, a biometric authenticator for air-gapped environments.
The card also extends the AI agent approval capability Token introduced in June. When an automated workflow reaches a sensitive step, such as releasing a wire transfer or changing access rights, the action waits until the authorized person approves it with a fingerprint on the card. The same fingerprint that signs a person in is used to approve their agents’ actions.
Token says the card integrates with AI agent gateways and with existing identity and access management (IAM), single sign-on (SSO) and privileged access management (PAM) systems, which govern employee accounts, access across applications and elevated administrative permissions. Supported operating systems include Windows, Mac, Linux, iOS and Android.
Token unveiled the card at the Authenticate U.S. 2026 conference in Carlsbad, California. “People have carried a card to work for decades. TokenCore Card makes that card prove who is holding it,” said Kevin Surace, chief executive of Token. “Whether an action begins with a person or an AI agent, the ones that matter should end with a verified human.”
Katy Nelson, Token’s chief revenue officer, said boards and auditors now ask whether an organization’s authentication “can be phished, and who approved their AI agents’ actions.” The company argues that factors proving possession of a device or code, rather than a person’s presence, can be used by whoever holds them, including AI agents acting on stored credentials.
Founded in 2014 and backed by Grand Oaks Capital, Token sells biometric authentication products that combine fingerprint verification, secure hardware and FIDO2 and WebAuthn standards to protect workforce access to enterprise applications, identity providers and cloud platforms.
Sources: Business Wire
–
By the ID Tech Editorial Team
