v148 · Identity · JavaScript

Token Lifecycle Demo

Agentic Federated Login (Chrome 148) extends FedCM to support agents and automated pipelines. This demo walks through the full token lifecycle — request → issue → validate → refresh → expire — showing the state machine an agent uses to manage identity tokens for federated identity providers.

Token state machine t=0s

IDLE

→

REQUESTING

→

ISSUED

→

VALID

→

REFRESHING

→

EXPIRED

Token inspector — current state: idle

stateidle

token_id—

issuer—

subject—

issued_at—

expires_in—

scopes—

refresh_eligible—

Time-to-live

Account Mediation hint TTL profile Auto-refresh at 25% TTL

Browser API probe has not run. The state machine uses the showcase FedCM endpoints when the origin-trial API is unavailable or rejects.

Scenario

Normal flow Request → issue → valid → refresh → valid

Short-lived token Token TTL = 8 s, tests auto-refresh trigger

Provider denial IDP rejects — agent must handle error and retry

Server revoke Token revoked mid-flight by the identity provider

Agent delegation Token issued with agent: true scope extension

Offline refresh Refresh attempted while IDP is unreachable

Event log

Click "Request token" to start the federated login token lifecycle. Use the scenario cards to explore how an agent handles different provider responses.

// Chrome 148: Agentic Federated Login — token request + lifecycle
const credential = await navigator.credentials.get({
  identity: {
    providers: [{
      configURL: 'https://idp.example/fedcm.json',
      clientId:  'my-agent-client-id',
      nonce:     crypto.randomUUID(),
      // Origin-trial agentic metadata; feature-detect before relying on it.
      mode: 'active',
    }],
    context: 'use',
  },
  mediation: 'optional',
});

// Token is in credential.token
const { token, type } = credential;

// This demo models refresh with a backend route because the agentic
// token lifecycle is still origin-trial / explainer-stage.
const refreshed = await fetch('/fedcm/refresh', {
  method: 'POST',
  body: JSON.stringify({ token }),
});

// Revoke (logout)
await IdentityCredential.logoutRPs([{
  url:      'https://rp.example/logout',
  accountId: 'user-123',
}]);

implementation reference

Need the exact API surface, compatibility boundaries, errors, lifecycle, and source links? Read the matching gendn reference ↗

see also

implementation reference