Double authentication in Click To Pay checkout

[tblachowicz]

Let's consider a Click To Pay user journey that uses passkey to access list of cards and SPC to confirm and authenticate payment:

1. User selects to pay with card using Click To Pay
2. Click To Pay verifies the user with passkey
3. User is presented with card available in Click To Pay
4. User selects the preferred card
5. User is presented payment payment sheet and Pay button
6. User activates Pay button
7. Click To Pay triggers SPC
8. User is presented with SPC dialog
9. User confirms the payment and authenticates with passkey
10. User is presented with payment confirmation screen

There is an issue with the user journey, because user is authenticated with passkey twice, in steps 2 and 9.

We'd like to optimize the journey in a way that user is not authenticated with passkey in step 9 if the browser recognizes user has already been authenticated with the passkey in step 2. The initial passkey authentication would be carried over into SPC to avoid double authentication in a single Click To Pay checkout.

[Goosth]

Thanks @tblachowicz. Interesting concept.
I guess the first question would be why we cannot do this by only performing Authentication at step 9 (the payment and card verification done once everything is presented), and remove step2?

In principle I am supportive of allowing Step 9 to merely be a SPC confirmation where the implementing party can choose to not use a Passkey during the flow. So it's a decision of the implementer to ask for Passkeys (e.g. Merchant), and the Relying Party can still decide if they will allow the SPC signature without a Passkey being present.
This will therefore also enable the opportunity to use a single factor authentication with the BBK, for non-SCA regulated regions, allowing us to use SPC as something that can replace SMS OTP's.