demo · v141

Disclosure Text

The relying party can now choose which alternative fields appear in the FedCM consent disclosure — "Continue to mysite.com using your phone number" vs "…using your username". For phone-first or username-only IdPs, the old "share email and name with this site" sentence didn't even make sense. The fields parameter lets the site customise the disclosure to match what's actually being shared.

checking support…

Choose which fields the site requests in the FedCM call:

Sign in to mysite.com

via IdP idp.example

A
@anika +91 98765 43210
To continue, idp.example will share … with mysite.com.

the call

// Site picks the fields it wants disclosed
const cred = await navigator.credentials.get({
  identity: {
    providers: [{
      configURL: "https://idp.example/fedcm.json",
      clientId: "rp-1234",
      fields: ["tel", "username"],   // ← new in 141; was always ["name", "email"]
    }],
  },
});
// The browser-rendered disclosure surface shows exactly these fields
// — and only the fields the IdP also returns on the accounts endpoint.

why this angle

FedCM's whole-system promise is informed consent — the user sees exactly what's about to be shared before pressing Continue. If the disclosure can only ever say "name and email", a site signing in a user via phone number is now lying to them. The W3C issue thread #435 explicitly tied alternative field disclosure to phone-first / username-first IdPs, because in those flows the user has no email or name to share in the first place. The Chrome 141 change closes the disclosure honesty gap that blocked these IdPs from FedCM adoption.

see also