Federated Credential Management API
ImportantThis API is still being maintained by Google in Chrome, even after the deprecation announcement of most other Privacy Sandbox APIs.
Overview
The Federated Credential Management (FedCM) API allows identity providers to build an SSO-login infrastructure facilitated by compatible web browsers that does not require the use of third-party cookies or redirects.
How does it work?
A relying party (RP) can allow users to sign-in using their credentials and account on a trusted third-party identity provider (IdP) by using the FedCM API. The browser mediates requests and information exchange between the RP and IdP through the FedCM API by:
-
Gathering user content to login to the RP with the IdP.
-
Recording if a relationship has been established between specific IdPs and RPs.
-
Providing features to the IdP and RP specific to the user consent provided.
-
API:
- JS:
navigator.credentials.get()navigator.recordFederatedLogin()IdentityCredential.disconnect()navigator.login.setStatus("logged-in"/”logged-out”)
- HTTP headers:
Sec-FedCM-CSRF - Permissions Policy on iframe:
allow="identity-credentials-get"
- JS: