pre-132 result
blockedCross-origin embeds needed a publisher header when the default was self.
demo · v132
Why the default flipped: the fraud-detection embed rollout
Before 132 the default Permissions-Policy for PST issuance & redemption was self. A publisher embedding a third-party fraud-detection vendor had to ship a header override for every page, or the vendor's widget silently failed. v132 flips the default to *; the publisher only has to set the header when they want to restrict.
Chrome 132+ result
allowedThe wildcard default lets the embed attempt PST without rollout coordination.
pre-132 publisher rollout
132+ publisher rollout
headers pre-132
headers 132+
runtime API probe
Builds a real Request with the selected privateToken operation so unsupported browsers and policy errors are visible without contacting a fake issuer.
Choose a scenario, then run the probe.
The wildcard default reduces publisher coordination. The browser still enforces Permissions Policy, issuer key commitments, token availability, and PST protocol errors when a real issuer is contacted.