CTAP2 commands include authenticatorMakeCredential, authenticatorGetAssertion, authenticatorGetInfo, authenticatorClientPIN (with PIN/UV auth protocols), credential management and large-blob storage. CTAP1 is the older U2F message format kept for compatibility. CTAP 2.2 (July 2025) added the hybrid transport details and new extensions, and CTAP 2.3 (Proposed Standard, February 2026) is the current certification baseline.
The hybrid transport (formerly caBLE) lets a phone act as the authenticator for a nearby computer: the computer shows a QR code, the devices check proximity over Bluetooth Low Energy and the CTAP messages travel through a cloud relay, encrypted end to end. Web developers rarely see CTAP; it matters to authenticator vendors, browser and operating system developers and anyone debugging security keys with tools such as libfido2.