Federated Credential Management (FedCM) API

Description

The FedCM API allows websites to verify the identity of users via third party websites.

Rationale

Using third party websites for authentication is a common and legitimate way to perform user verification, but right now it requires a lot of hacks where cookies, redirects, and iframes are abused. Those same methods are also used for abusive/illegal tracking of users.

Support for the FedCM API would drastically improve the developer experience and user experience of building and using login flows. It would also allow browsers to tighten security around abusive trackers, since they would no longer have to leave intentional holes in the security that are required for login flows today.

I am proposing this as an investigation effort proposal because there are comments from Mozilla that they do not agree with the existing FedCM API, and they have created new specs that they think are more suited for broad adoption by browsers.

Signals to back up my claims:

Message of support in Webkit standards positions:
https://github.com/WebKit/standards-positions/issues/309#issuecomment-3957066944

Message of support in Mozilla standards positions:
https://github.com/mozilla/standards-positions/issues/618#issuecomment-2473003004

Developer signals feature with 41 likes:
https://github.com/web-platform-dx/developer-signals/issues/208

Focus area proposal from 2026:
https://github.com/web-platform-tests/interop/issues/1098

Investigation Roadmap

The purpose of this investigation effort would be for browser vendors to review the proposed changes and agree on a final specification for FedCM that could then be implemented later, maybe as an interop focus area in 2028.

Current specification:
https://w3c-fedid.github.io/FedCM/

Proposed alterations to specification:
https://github.com/fedidcg/LightweightFedCM

Current WPT tests:
https://wpt.fyi/results/fedcm

Start by reading the current FedCM specification and the proposed LightweightFedCM alterations, then review the current WPT results at wpt.fyi/results/fedcm. Done means browser vendors agree on a final FedCM specification suitable for later implementation or an interop focus area.