Glossary
FIDO2
The FIDO Alliance and W3C standard for phishing-resistant, public-key authentication, made of the WebAuthn browser API and the CTAP device protocol.
FIDO2 is the umbrella name for two specifications: WebAuthn, the W3C browser API that websites call, and CTAP2, the FIDO Alliance protocol that browsers and operating systems use to talk to an authenticator over USB, NFC or Bluetooth.
At registration the authenticator creates a new key pair for the website and keeps the private key. At login it signs a challenge that includes the site's origin, which is why a FIDO2 credential cannot be replayed on a look-alike phishing domain. Most FIDO2 security keys also support the older U2F (CTAP1) protocol.
See the guide FIDO2 security keys and passkeys.