Editorial review: Document recent FedCM additions, Chrome 122-136 #40411

chrisdavidmills · 2025-07-17T13:54:02Z

Description

Chrome has added several FedCM features that we are missing from MDN. This PR adds docs for them.

The features are:

Support for multiple IdPs in a single get() call, as specified inside the providers array, added in Chrome 136: https://chromestatus.com/feature/5067784766095360
The above ChromeStatus entry also includes the IdentityCredential.configURL (if you look at the associated spec changes)
IdentityCredential.disconnect(), added in Chrome 122: https://chromestatus.com/feature/5202286040580096.
identity.mode in get() calls, added in Chrome 132: https://chromestatus.com/feature/4689551782313984.
identity.fields and identity.params in get() calls, added in Chrome 132. I'm not sure what ChromeStatus entry covers these, but developer.chrome.com says they were added in Chrome 132.
account_label / label_hints in the IdP config file / accounts list endpoint. This was added in Chrome 132. Note that this won't have browser compat data - we don't really have a way of recording data for features in endpoints related to an API.
supports_use_other_account in the IdP config file.
domain_hints in the accounts list endpoint and domainHint in get() calls.

One point I'd especially like the tech review to comment on — the specified options object for disconnect() does not match up with the description in the Chrome docs. I think the latter makes more sense, but I'd like to know what is going on here.

Motivation

Additional details

Related issues and pull requests

github-actions · 2025-07-17T13:56:21Z

Preview URLs (16 pages)

Flaws (3)

Note! 15 documents with no flaws that don't need to be listed. 🎉

URL: /en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy
Title: Permissions-Policy header
Flaw count: 3

unknown:
- No generic content config found
- no blog root
- no blog root

External URLs (7)

URL: /en-US/docs/Web/API/FedCM_API/IDP_integration
Title: Identity provider integration with FedCM

https://github.com/w3c-fedid/FedCM/issues/230 (1 time) (Note! This may be a new URL 👀)
https://privacysandbox.google.com/blog/fedcm-chrome-120-updates (2 times) (Note! This may be a new URL 👀)

URL: /en-US/docs/Web/API/FedCM_API/RP_sign-in
Title: Relying party federated sign-in

https://developers.google.com/identity/gsi/web/guides/verify-google-id-token (1 time) (Note! This may be a new URL 👀)
https://privacysandbox.google.com/cookies/fedcm (2 times) (Note! This may be a new URL 👀)
https://privacysandbox.google.com/cookies/fedcm/why (1 time) (Note! This may be a new URL 👀)

URL: /en-US/docs/Web/API/IdentityCredential/configURL
Title: IdentityCredential: configURL property

https://privacysandbox.google.com/cookies/fedcm (1 time) (Note! This may be a new URL 👀)

URL: /en-US/docs/Web/API/IdentityCredential/disconnect_static
Title: IdentityCredential: disconnect() static method

https://privacysandbox.google.com/cookies/fedcm (1 time) (Note! This may be a new URL 👀)

(comment last updated: 2025-07-25 01:04:56)

hamishwillee · 2025-07-18T01:00:19Z

@chrisdavidmills Can you ping me or/and Will when you're ready for the editorial review.

files/en-us/web/api/fedcm_api/idp_integration/index.md

ewewraw · 2025-07-18T13:47:25Z

files/en-us/web/api/identitycredentialrequestoptions/index.md

    - `loginHint` {{optional_inline}}
      - : A string providing a hint about the account option(s) the browser should provide for the user to sign in with. This is useful in cases where the user has already signed in and the site asks them to reauthenticate. Otherwise, the reauthentication process can be confusing when a user has multiple accounts and can't remember which one they used to sign in previously. The value for the `loginHint` property can be taken from the user's previous sign-in, and is matched against the `login_hints` values provided by the IdP in the array of user information returned from the IdP's [accounts list endpoint](/en-US/docs/Web/API/FedCM_API/IDP_integration#the_accounts_list_endpoint).
    - `nonce` {{optional_inline}}
      - : A random string that can be included to ensure the response is issued specifically for this request and prevent {{glossary("replay attack", "replay attacks")}}.
-
-    > [!NOTE]
-    > Currently FedCM only allows the API to be invoked with a single IdP, i.e., the `providers` array has to have a length of 1. Multiple IdPs must be supported via different `get()` calls.


FedCM still only supports a single get() (subsequent get requests will fail), but it can support multiple IdPs in the providers array. Maybe it's worthy to call it out?

Possibly, but this isn't really the right place to do so. A better place would be the get() page "Exceptions" section. But then, that raises more questions:

What exactly is the nature of the failure? Is it simply that a get() call cannot be make when a previous get() call promise remains unresolved? Or is it that you can only be signed in using one federated identity provider per domain, and all other galls will fail until the existing sign-in is signed out again? Is it both?

I'm assuming the exception type would be an InvalidStateError, but I could be wrong.

Is this the case for all get() call types, or just for FedCM/identity types?

I think I'm going to ask for an editorial review of this PR now, but feel free to chime in more on this issue. Thanks for the review, @ewewraw!

FWIW I agree with you here Chris (unless I misunderstand the point). The existing note is incorrect because you can have multiple providers. More information needed on how get() fails, but likely and exception on get, and not something to mention in this particular interface.

chrisdavidmills · 2025-07-19T14:43:19Z

This one is ready for an editorial review, @hamishwillee and @wbamberg. Whoever fancies it.

hamishwillee · 2025-07-20T22:26:55Z

account_label / label_hints in the IdP config file / accounts list endpoint. This was added in Chrome 132. Note that this won't have browser compat data - we don't really have a way of recording data for features in endpoints related to an API.

Suggest asking BCD for how to do this. You might need to invent a way.

files/en-us/web/api/identitycredential/disconnect_static/index.md

files/en-us/web/api/fedcm_api/idp_integration/index.md

files/en-us/web/api/identityprovider/close_static/index.md

files/en-us/web/api/fedcm_api/index.md

files/en-us/web/api/identitycredential/index.md

files/en-us/web/api/identitycredentialrequestoptions/index.md

files/en-us/web/api/identitycredential/configurl/index.md

hamishwillee · 2025-07-21T22:58:10Z

I don't see it as that useful. Most of the features you can add to the IdP endpoint have some kind of corresponding feature in the actual RP developer-visible API surface, for example:

supports_use_other_account in the IdP config file has mode: "passive" in the get() call identity object.

domain_hints in the accounts list endpoint has domainHint in the get() call identity object.

This is somewhat of an exception.

As long as people can work out the support story then fine.

files/en-us/web/api/fedcm_api/index.md

files/en-us/web/api/fedcm_api/rp_sign-in/index.md

hamishwillee

Thanks for the comprehensive changes in response. Looks great. A few nits. I'd quite like to resolve #40411 (comment) before merging.

Co-authored-by: Natalia Markoborodova <50494110+ewewraw@users.noreply.github.com>

Co-authored-by: Hamish Willee <hamishwillee@gmail.com>

hamishwillee

Thanks very much @chrisdavidmills - looks excellent. Approving.

chrisdavidmills · 2025-07-25T07:36:12Z

Thanks very much @chrisdavidmills - looks excellent. Approving.

Super, thanks for the awesome review, @hamishwillee!

chrisdavidmills requested review from a team as code owners July 17, 2025 13:54

chrisdavidmills requested review from hamishwillee and wbamberg and removed request for a team July 17, 2025 13:54

github-actions bot added Content:WebAPI Web API docs Content:HTTP HTTP docs size/m [PR only] 51-500 LoC changed labels Jul 17, 2025

chrisdavidmills changed the title ~~Document recent FedCM additions, Chrome 122-136~~ Technical review: Document recent FedCM additions, Chrome 122-136 Jul 17, 2025

ewewraw reviewed Jul 18, 2025

View reviewed changes

chrisdavidmills changed the title ~~Technical review: Document recent FedCM additions, Chrome 122-136~~ Editorial review: Document recent FedCM additions, Chrome 122-136 Jul 19, 2025