v145 · Payments · Key Rotation Walkthrough

Key rotation walkthrough

Step through the lifecycle of a browser-bound SPC key — enrolment, first payment, browser profile sync, key rotation, and revocation. Each step calls the backend verifier so you can see server-side state transitions and signature checks.

Backend verifier. Real browser-bound key ceremonies need chrome://flags/#secure-payment-confirmation-browser-bound-keys. This walkthrough uses WebCrypto keys plus the Deno verifier to exercise the same enrollment, payment, replay rejection, rotation, and reset flow.

live lifecycle

—Click "First enrolment" to begin.idle

code

// Browser holds the private key in a TPM-backed slot tied to the
// Chrome profile, not the credential itself. The relying party
// receives the public key alongside each transaction and can ask
// the browser to rotate it without a full re-enrolment.

const cred = await navigator.credentials.create({
  publicKey: { /* ... */ },
  payment: {
    rp: { id: 'pay.example' },
    // Chrome 145: opt into a browser-bound key.
    browserBoundPubKeyCredParams: [{ type: 'public-key', alg: -7 }],
  },
});

see also