Token Unveils TokenCore Card, a Fingerprint Smart Card for Logins and AI Agent Actions

Token unveiled the TokenCore Card on October 19 at Authenticate U.S. 2026, booth K4 at the Omni La Costa Resort & Spa. The company describes it as a biometric smart card for enterprise employees, combining FIDO2 passwordless authentication, on-device fingerprint verification, Bluetooth and NFC in the card workers already carry.

The card is positioned as proof of identity for “every login and every AI agent action that matters.” Token says it covers everyone from office staff to privileged administrators and works alongside existing IAM, SSO and PAM infrastructure rather than replacing it. The release lists day-one SSO compatibility, user setup in under five minutes, passwordless login in under two seconds, and support for Windows, Mac, Linux, iOS and Android.

The security model is straightforward. The card will not authenticate without the enrolled user's fingerprint, and the biometric never leaves the device; what leaves is a signature. CEO Kevin Surace framed the pitch around familiarity: people have carried a card to work for decades, and TokenCore Card is meant to make that card prove who is holding it.

The AI agent angle is the part that matters most for this audience. TokenCore Card extends the agent-approval capability Token introduced in June. When an agentic workflow reaches a high-consequence action such as releasing a wire transfer or changing access rights, the action waits until the authorized person approves it with a fingerprint on the card. The same fingerprint signs the person in and approves their agents' actions, and the card integrates with AI agent gateways alongside existing identity systems.

That design addresses a widening gap: AI agents often act on credentials alone, and any factor that proves possession rather than presence can be reused by whoever or whatever holds it. Chief Revenue Officer Katy Nelson said boards and auditors no longer ask only whether an organization has MFA, but whether it can be phished and who approved its AI agents' actions.

As AI agents increasingly act on credentials alone, Token is betting that the last gate before a high-stakes action should be a fingerprint belonging to a verified person. That fits a broader “human in the loop” push in finance, healthcare and manufacturing: the goal is not to stop agents from acting, but to insert an auditable human confirmation before irreversible steps.

The caveats are familiar for a vendor launch. The performance figures, including “100% user acceptance” for wireless use and sub-two-second login, are Token's own; pricing, general availability and independent security testing were not disclosed in the release. Whether the card scales inside large enterprises will depend on whether those claims hold up in real office environments and on the integration cost with existing identity stacks.