What is the Federated Credential Management API (FedCM)?

Key Concepts

• FedCM (Federated Credential Management API): A browser-mediated API designed to standardize and secure federated identity flows.
• Relying Party (RP): The website or application the user is trying to access.
• Identity Provider (IdP): The service (e.g., Google, Facebook) that authenticates the user and provides credentials to the RP.
• Protocol Agnostic: FedCM operates independently of specific authentication protocols like OAuth or SAML.
• UX Modes: The two primary interaction models for FedCM: Active (user-initiated) and Passive (automatic/streamlined).

---

1. Overview and Core Innovation

FedCM is a browser-level API that acts as a trusted mediator between the user, the Relying Party (RP), and the Identity Provider (IdP). Unlike traditional methods that rely on iframes or third-party cookies—which are increasingly restricted by privacy-focused browser policies—FedCM places the browser in the middle of the transaction. This ensures that user data is only shared after explicit browser-mediated consent, providing greater transparency and privacy.

2. User Experience (UX) Modes

FedCM facilitates authentication without requiring top-level redirects or pop-up windows, keeping the user within the context of the current page.

• Active Mode: Requires a user gesture (e.g., clicking a "Sign In" button). If the user is not logged into the IdP, a pop-up window appears to handle authentication and closes automatically upon completion, returning the user to the RP site.
• Passive Mode: Does not require a user gesture. If the user is already signed into the IdP, the browser automatically displays a prompt to sign in or sign up, creating a "one-tap" experience.

3. Benefits for Stakeholders

• For Users: Provides a consistent, recognizable sign-in experience across the web. It offers better control over data sharing and eliminates the need for multiple, cluttered login buttons.
• For Relying Parties: Increases sign-in conversion rates by simplifying the flow. It is resilient to "bounce tracking" mitigations and functions effectively even when third-party cookies are disabled.
• For Identity Providers: Allows for centralized management of authentication flows via an SDK, ensuring that updates can be pushed to RPs without breaking existing integrations.

4. Privacy Enhancements

• Data Minimization: Information is only exchanged between the RP and IdP after the user explicitly grants permission.
• Delegation Model: The FedCM team is developing a model where the IdP does not necessarily know which specific RP the user is visiting, further decoupling the user's browsing history from their identity provider.
• No Link Decoration: Because the API does not rely on URL parameters or link decorations, it is immune to privacy-preserving technologies that target bounce tracking.

5. Implementation Framework

To implement FedCM, the Identity Provider must configure specific infrastructure:

1. Well-Known File: A configuration file that acts as a map, directing the browser to the IdP’s endpoints.
2. Accounts Endpoint: Lists the user’s available accounts.
3. ID Assertion Endpoint: Verifies the user and issues a secure token for the RP.
4. Login Endpoint: Manages the authentication page if the user is not currently logged into the IdP.
5. Client Metadata Endpoint: Provides branding assets (e.g., logos, privacy policy links) to be displayed in the browser’s native UI.

Recommendation: IdPs should distribute an SDK to RPs to ensure that implementation updates are managed centrally.

6. Synthesis

FedCM represents a shift toward browser-native identity management. By moving the mediation layer from the web page (iframes/cookies) to the browser itself, it solves the conflict between user privacy and the convenience of federated identity. It provides a robust, future-proof framework that works without third-party cookies, ensuring that personalized user experiences remain possible in a privacy-first web ecosystem.