v148 · Origin Trial · Identity
Agent Delegation Demo
Step through how an AI agent obtains delegated FedCM credentials to act on a user's behalf — user grants delegation, agent executes tasks with the delegated token, and user revokes access. Includes a live JSON token inspector.
API probe:
IdentityProvider.getUserInfo()Checking…
Current State
Delegation status:
Idle
Requesting agent:
ai-assistant.example.com
Requested scopes:
--:--:--Ready — click "User logs in" to begin.
Delegated Token (JWT claims)
No token yet — complete the grant flow above.
Flow Steps
- 1User initiates FedCM login — navigator.credentials.get({identity:{…}}) called
- 2IDP authenticates user — IdP dialog shown, user selects account
- 3Agent requests delegation — agent calls FedCM with delegation scope
- 4Browser shows consent dialog — user reviews scopes and agent identity
- 5Delegated token issued — JWT with sub_delegation claim returned to agent
The agent holds a delegated credential and makes API calls on the user's behalf. Each call attaches the token in the Authorization header — the API server verifies the delegation claims before responding.
Agent Identity
Agent
ai-assistant.example.com
Token status
No token — grant first
Token expires
—
Available scoped actions:
API Call
Select an action to see the API call…
Response
Response will appear here…
--:--:--Complete tab 1 first, then try the actions above.
Users can revoke delegated access at any time. The browser (or IdP settings page) lists all agents that hold delegated credentials, with their scopes and expiry. Revocation invalidates the token immediately.
Active Delegations
ai-assistant.example.com
calendar.read · email.read · tasks.write
Expires: not yet granted
scheduling-bot.corp.example
calendar.read · calendar.write
Expires: in 23h 42m
Revocation Status
No revocations yet.
Post-revocation probe
After revocation, a token use attempt should be rejected with 401:
--:--:--Click Revoke to invalidate a delegation.