Client to Authenticator Protocol
CTAP is the FIDO Alliance protocol that lets a browser or operating system talk to an external authenticator such as a security key or a phone over USB, NFC, or Bluetooth. Together with WebAuthn it forms the FIDO2 standard behind passkeys and hardware key login. It matters because it enables phishing-resistant, passwordless authentication using keys that never leave the device.