demo · v131

Source vs trigger header explorer

Build both Attribution Reporting response headers and watch the validation split: source registrations still reject aggregation key identifiers longer than 25 characters because those keys are persisted, while trigger registrations accept descriptive identifiers after Chrome 131.

Header verdict tool

attributionsrc IDL checking Permissions-Policy checking Request option checking

Aggregation key identifier Source aggregation key piece Trigger contribution value Destination

Source registration

checking

Waiting for validation.

Trigger registration

checking

Waiting for validation.

Attribution-Reporting-Register-Source

Attribution-Reporting-Register-Trigger

What the browser validates

Sources still cap key identifiers at 25 characters. A source registration with a longer aggregation_keys member is rejected before it can be persisted to the attribution database.
Triggers no longer apply that key-name cap. The same long identifier can appear in aggregatable_trigger_data.source_keys and aggregatable_values, so operators can keep descriptive names instead of short dictionaries.
Other trigger validation still exists. The contribution in aggregatable_values must stay within the per-trigger budget; this demo lets you force that failure so the key-length change does not look like a blanket bypass.