BIO-key Receives FIDO Alliance Full Certification for Passkey:YOU™ Authentication, Unlocking New Markets Including Agentic AI Authenticated Controls
HOLMDEL, N.J., Sept. 23, 2026 (GLOBE NEWSWIRE) -- BIO-key® International, Inc. (NASDAQ: BKYI), a global provider of workforce and customer Identity and Access Management (IAM) software featuring passwordless, phoneless and tokenless Identity-Bound Biometrics™ (IBB) authentication, today announced that its Passkey:YOU™ authenticator has received Full Certification from the FIDO Alliance, the industry body behind the FIDO2/WebAuthn/Passkey standard now in widespread use to allow phish-resistant sign in without typing a password.
With Passkey:YOU, an employee authenticates to unlock a shared passkey service by touching a shared fingerprint scanner or tapping the door-access badge they already carry — no smartphone or separate hardware token needed. A single enrollment then works everywhere a passkey is accepted, including enterprise identity platforms such as Microsoft Entra ID, Okta, Ping, Duo, BIO-key's own PortalGuard®, and a growing list of websites, with no separate integration project required for each one. Employees who do carry a phone can authenticate the same way through BIO-key's MobileAuth app on iOS and Android. Passkey:YOU works at any workstation in the enterprise to provide easy, phish-resistant authentication without phones, or tokens.
Passkey:YOU’s design solves a specific problem: most authentication products assume every user carries a smartphone or can be issued and carry a physical token like a security key, which they use to authenticate. Passkey:YOU is built for the people and places where that assumption breaks down — secure facilities where phones aren't allowed, air-gapped networks, shared workstations, manufacturing floors, call centers, retail counters, and healthcare settings. Because the Passkey:YOU authentication hardware lives at the workstation rather than in every employee's pocket, one Passkey:YOU client can serve any number of roving or device-restricted workers.
Full Certification is the FIDO Alliance's formal confirmation that Passkey:YOU meets the technical and security bar — Security Assurance Level L1, conforming to the FIDO2 CTAP v2.0 specification — to work as a standards-based authenticator with any of those destinations, rather than a proprietary system. It's secured by BIO-key's NIST-tested, scanner-interoperable fingerprint platform and its MobileAuth palm and face authentication.
In biometric mode, Passkey:YOU runs on BIO-key's Identity-Bound Biometrics, meaning each employee's own fingerprint, palm, or face becomes their credential — something they can't share, forget, or lose the way they could a password or a token. Biometric data is encrypted to military-grade, quantum-resistant levels, and the platform supports NIST 800-63 and CMMC authentication requirements along with more than 30 interchangeable fingerprint scanners, so organizations aren't locked into a single hardware vendor. One enrollment carries across devices and locations, and enrollment workflows and user-controlled privacy dashboards are built to comply with GDPR and other privacy laws.
Passkey:YOU Means Better Governance and Control for Enterprises
A traditional hardware security key is, by design, invisible to the organization that issued it: once provisioned to a user, IT typically can't see which sites or systems it has been registered with, can't approve new ones, and can't revoke access to a single third-party account without physically collecting the key back. That's a reasonable tradeoff for an individual consumer. For a regulated or enterprise workforce, it's a blind spot.
Because Passkey:YOU is centrally managed, security and compliance teams get the opposite: visibility into which systems employees have authenticated to, the ability to approve new destinations, and the ability to cut off access to any one system instantly — without waiting for someone to physically return a device. It still presents a standard, certified interface to Entra ID, Okta, Ping, Duo, and every other passkey-enabled destination; what changes is what the organization can see and control behind it.
Agentic AI Must Be Controlled by Real People, Not Inanimate Tokens
As AI agents take on the ability to act across applications, data, and payments on a company's behalf, someone has to be accountable for approving what they do — and that accountability breaks down if approval rests on a credential that isn't tied to a specific person, such as a password left in a browser session or a hardware key left plugged into a shared machine.
Passkey:YOU ties that approval to a person’s unique physical features instead: a fingerprint on a shared scanner, or a face or palm scan through MobileAuth, is evidence that a specific, named individual — not an unattended device or delegated user — authorized the action. That decision is then carried to the relevant AI authorization controls using the standardized FIDO-certified, phishing-resistant cryptography behind Passkey:YOU.
Game-Changing Economics
Hardware tokens typically cost $25–$70 each, organizations often issue two or more per employee, and roughly a quarter are lost or replaced each year. Passkey:YOU instead puts the authentication hardware at shared access points rather than in every employee's pocket, lowering the total cost of a deployment while still meeting the strong-authentication standards cyber insurers increasingly require — now backed by FIDO's Full Certification.
"FIDO gave the world a trustworthy, interoperable way to kill the password. Full Certification means Passkey:YOU now speaks that language as a certified FIDO authenticator," said Jim Sullivan, Chief Legal Officer of BIO-key. "A roving user can tap the badge they already carry or touch a shared fingerprint scanner and authenticate to Entra ID, Okta, Ping, Duo, or any website that accepts FIDO passkeys. Mobile users can do the same from MobileAuth on iOS and Android. Security teams can see, approve, and revoke the relying parties behind those passkeys—something they can’t do with an unmoderated hardware security key in the hands of a user."
"Agentic AI will force a simple question: who approved that action?" Sullivan added. "A security key left in the machine is not an answer. BIO-key Passkey:YOU proves which person was actually present to approve the action."
Learn more about Passkey:YOU, MobileAuth, and Identity-Bound Biometrics at www.bio-key.com.
About the FIDO Alliance (www.fidoalliance.org)
The FIDO Alliance enables identity technologies that put trust and simplicity at the center of interactions among people, services, and devices. The Alliance publishes open technical specifications, certifies secure and interoperable products, and operates global market enablement programs that have made passkeys the leading standard for phishing-resistant, passwordless authentication. FIDO Certified and the FIDO Certified logo are trademarks of the FIDO Alliance.
About BIO-key International, Inc. (www.BIO-key.com)
BIO-key is revolutionizing authentication and cybersecurity with biometric-centric, multi-factor identity and access management (IAM) software securing access for over forty million users. BIO-key allows customers to choose the right authentication factors for diverse use cases, including phoneless, tokenless, and passwordless biometric options. Its cloud-hosted or on-premise PortalGuard IAM solution provides cost-effective, easy-to-deploy, convenient, and secure access to computers, information, applications, and high-value transactions.
Forward-Looking Statements
All statements contained in this press release other than statements of historical facts are forward-looking statements as defined in the Private Securities Litigation Reform Act of 1995. Words such as “estimate,” “project,” “intends,” “expects,” “anticipates,” “believes” and similar expressions identify forward-looking statements. Such statements are based on management’s beliefs and assumptions and information currently available to management. They are not guarantees of future performance and are subject to risks and uncertainties that may cause actual results to differ materially, including those described under “Risk Factors” in BIO-key’s filings with the Securities and Exchange Commission. Readers should not place undue reliance on these statements, which speak only as of the date made. Except as required by law, BIO-key undertakes no obligation to update forward-looking statements.
Engage with BIO-key
| Facebook – Corporate: | https://www.facebook.com/BIOkeyInternational/ |
| LinkedIn – Corporate: | https://www.linkedin.com/company/bio-key-international |
| X – Corporate: | @BIOkeyIntl |
| X – Investors: | @BIO_keyIR |
| StockTwits: | BIO_keyIR |
Media and Investor Contacts
William Jones, David Collins
Catalyst IR
BKYI@catalyst-ir.com or 212-924-9800 x3
