demo · v135
Migration checklist for payment credential errors
The historical inconsistency was payment-specific: activationless payment credential creation in a cross-origin iframe threw SecurityError, while WebAuthn throws NotAllowedError for the same missing-activation failure. Chrome 135 aligns payment credential creation with WebAuthn, so catch blocks must handle NotAllowedError.
legacy payment path: SecurityError
Chrome 135+: NotAllowedError
before Chrome 135
try {
await navigator.credentials.create({ publicKey, payment });
} catch (error) {
if (error.name === "SecurityError") {
showPaymentIframeFailure();
}
}
Chrome 135+
try {
await navigator.credentials.create({ publicKey, payment });
} catch (error) {
if (error.name === "NotAllowedError") {
showActivationOrCancelHint();
} else if (error.name === "SecurityError") {
showPolicyOrOriginFailure();
}
}