v154 · private verification tokens
What is already here
Private State Tokens ship today, and their two query methods can be called from any page against any issuer. Neither needs a token, a gesture or a permission — which makes them a rare thing in this area: a privacy mechanism you can poke at without setting anything up.
Both methods, against several issuers
| issuer | hasPrivateToken | hasRedemptionRecord | why this one |
|---|---|---|---|
| Not called yet. | |||
A false here is not a failure — it is the honest answer for a browser that has never been issued a token by that origin, which is almost every browser reading this. The interesting rows are the ones that reject: an insecure or malformed issuer is refused before anything is looked up.
Try an issuer of your own
These calls are unmetered and unprompted, which is a deliberate design decision worth noticing: they tell a page nothing it could not learn by attempting a redemption, so there is no reason to gate them — and a page that can check cheaply is a page that will not redeem blindly.
The surface, such as it is
| member | present? | arity | what it answers |
|---|