v148 · origin trial · experimental

Agentic Federated Login

A set of FedCM extensions to help agentic browsers safely log users in to websites using their federated accounts — without relying on the brittle DOM-actuation pattern that current agents fall back to.

Heads up Origin trial in Chrome 148. The API surface is still moving; the explainers below are the canonical reference. Don't ship production code against this yet.

concepts

  1. Login Flow Walkthrough

    Step through the agentic FedCM flow visually, then run a live endpoint trace through the showcase IdP config, accounts, client metadata, assertion, and validation routes.

  2. Login Element Gallery

    Three planning-stage recipes for the declarative <login> element wired to a real FedCM-shaped backend: same-origin login, cross-origin marketplace invitation, and IDP-initiated invitation.

  3. Session State Inspector

    Inspect the live FedCM-shaped token lifecycle — IdP discovery, account selection, signed token issuance, validation, refresh, and revocation — without inventing in-page tokens.

  4. Agent Delegation Demo

    Step through how an AI agent obtains delegated FedCM credentials to act on a user's behalf. Three tabs: user grants delegation (with consent dialog), agent executes scoped API calls using the delegated token, and user revokes access. Live JWT claims inspector shows sub_delegation claim and scopes.

  5. Token Lifecycle Demo

    A real-time state machine — IDLE → REQUESTING → ISSUED → VALID → REFRESHING → EXPIRED — visualised with an interactive token inspector showing ID, issuer, subject, scopes, and a live time-to-live countdown bar. Six scenarios (normal flow, short-lived token, provider denial, server-side revoke, agent delegation, offline refresh) show how an agent handles every outcome.

why it exists

The web is changing as agents take on more user journeys. Most of those journeys require the user to be logged in. Federated login (Sign in with Google, etc) is implemented on top of low-level browser primitives, so an agentic browser today has to use "actuation" — computer vision over the DOM to figure out which button to click and which dialog to fill in. That's slow, fragile, and a security nightmare. This feature builds on FedCM (which already mediates the identity exchange via the browser) with three additions tailored to agent flows: IDP-initiated invitations, a declarative <login> element, and a way to mark sites the user has potentially approved without an explicit click.

references

implementation reference

Need the exact API surface, compatibility boundaries, errors, lifecycle, and source links? Read the matching gendn reference ↗