Systems and methods for token-based device binding during merchant checkout

A user device comprising:

• a non-transitory memory;
• and
• one or more processors communicatively coupled to the non-transitory memory and configured to read instructions from the non-transitory memory to cause the user device to perform checkout operations comprising:
• requesting a user credential from a user initiating a first transaction on the user device via a first merchant website using a web browser;
• transmitting a received user credential to a third party entity to perform a hashing operation of the user credential, wherein a hashed user credential is transmitted to an authentication server, the authentication server being configured to perform a matching operation between the received hashed user credential and a stored hashed user credential stored at the authentication server;
• receiving an authentication challenge from the authentication server, the authentication challenge being received in response to the authentication server detecting a match between the received hashed user credential and the stored hashed user credential;
• performing a user eligibility operation associated with the first transaction and determining that the user is eligible for the first transaction;
• transmitting a user response to the authentication challenge to the authentication server;
• and
• receiving a first authorization at the first merchant website from the authentication server, the first authorization including binding credentials bound to the web browser, the binding credentials comprising a private key associated with the hashed user credential corresponding to a public key stored at the authentication server;
• storing the private key in a cookie of the web browser;
• transmitting a digital signature signed by the stored private key responsive to a user initiating a second transaction on the user device via a second merchant website on the web browser;
• and
• receiving a second authorization for the second transaction that is based on checking the digital signature signed by the private key using the public key from the authentication server, the second authorization not requiring the user to re-enter the user credential or sensitive payment information.

A non-transitory computer readable medium including instructions that, when executed by one or more processors of an authentication server, cause the one or more processors to perform authentication operations in response to a user initiating a first transaction through the authentication server on a user device via a first merchant website using a web browser, the authentication operations comprising:

• receiving a hashed user credential from a third party entity;
• performing a matching operation between the received hashed user credential and a stored hashed user credential;
• in response to the matching operation detecting a match between the received hashed user credential and the stored hashed user credential, performing a user eligibility operation associated with the first transaction;
• in response to the user eligibility operation determining that the user is eligible for the first transaction, generating an authentication challenge to the user;
• in response to receiving an indication that the user successfully completed the authentication challenge, retrieving a payment credential of the user and authenticating the user;
• authorizing a first checkout operation associated with the first transaction at the first merchant website;
• binding the hashed user credential to the web browser based on authorizing the first checkout operation at the first merchant website, wherein the binding comprises:
• generating a public key and a private key associated with the user credential,
• storing the public key in a non-transitory memory of the authorization server,
• transmitting the private key to the web browser, wherein the private key is stored in a cookie of the web browser responsive to the transmitting;
• receiving a digital signature signed by the private key, the digital signature corresponding to a second checkout operation at a second merchant website on the web browser;
• and
• authorizing the second checkout operation without requiring the user to re-enter the user credential or sensitive payment information by checking the digital signature signed by the private key using the public key.