demo · v132
Token Flow Simulator
Chrome 132 changes the default Permissions Policy allowlist for private-state-token-issuance and private-state-token-redemption from self to *. This means cross-origin iframes can now issue and redeem tokens without first-party sites adding an explicit header. Simulate a complete PST issuance + redemption flow with different Permissions-Policy configurations to see what Chrome 132 unlocks.
Checking Private State Token API availability…
| Feature | Pre-132 default (self) | Chrome 132 default (*) | Your header |
|---|
Click "Simulate flow" to walk the issuance + redemption steps.
// Pre-132: publisher MUST add Permissions-Policy header for 3P iframes
// Permissions-Policy: private-state-token-issuance=*,
// private-state-token-redemption=*
// Chrome 132: NO header needed — default is already *
// 3P iframe can call directly:
// Issuance (in 3P iframe — no policy header required in Chrome 132):
await fetch('https://issuer.example/issue', {
privateToken: {
version: 1,
operation: 'token-request',
},
});
// Redemption (in 3P iframe):
await fetch('https://publisher.example/resource', {
privateToken: {
version: 1,
operation: 'token-redemption',
refreshPolicy: 'none',
},
});