Google Credential Provider for Windows Adds FIDO2 Security Key

Google Credential Provider for Windows Adds FIDO2 Security Key Authentication

Google Credential Provider for Windows (GCPW) now supports FIDO2-compliant physical security keys as a second factor for authentication

Google Credential Provider for Windows (GCPW) has been updated to support FIDO2-compliant physical security keys as a second factor for authentication. This update helps organizations improve their security posture by enabling administrators to enforce 2-Step Verification (2SV) using hardware security keys at the Windows login screen. Additionally, users can now use passkeys from nearby Bluetooth-connected mobile devices for their second-factor authentication.

Getting started

Admins: Visit the Help Center to learn more about enforcing 2SV.
End users: There is no end user setting for this feature.

Rollout pace

Rapid Release and Scheduled Release domains: Gradual rollout (up to 15 days for feature visibility) starting on July 13, 2026

Availability

Available to all Google Workspace customers

Resources

Google Workspace Admin Help: Prepare to install GCPW

Yes, that is correct. Google has formally updated Google Credential Provider for Windows (GCPW) to natively support FIDO2-compliant physical security keys alongside mobile device passkeys. [1, 2, 3]

This long-awaited update introduces phishing-resistant security straight to the Windows sign-in screen. [1, 3]

Key Details of the Update

Hardware Key Support: Administrators can now enforce 2-Step Verification (2SV) using physical hardware tokens (such as Google Titan keys or YubiKeys) directly at Windows login. [1, 3]
Mobile Passkeys via Bluetooth: Users can also leverage passkeys stored on nearby, Bluetooth-connected smartphones as their second factor. [1, 3]
Availability: The gradual rollout started on July 13, 2026, making it available to all Google Workspace customers over the subsequent days. [2, 3]
No Re-imaging Required: Admins only need to ensure their endpoints run the latest GCPW client and configure the 2SV policies directly inside the Google Admin console. [3]