FedCM Identity Provider

W3C FedCM (Federated Credential Management API, candidate recommendation 2024) identity-provider-side helpers. Operators running an IdP wire four endpoints per the spec; this module ships response-shape builders + the well-known config emitter.

Endpoints (FedCM §5): - /.well-known/web-identity — discovery - — IdP config doc (FedCM §6.3 IdentityProviderAPIConfig) - accounts_endpoint — returns the user's accounts at this IdP - id_assertion_endpoint — mints the id_token / verifiable credential bound to the relying-party origin

The framework does NOT make the FedCM browser API call itself — that's user-agent surface. Operators wire response builders into their router and supply the per-account session state.

b.fedcm.wellKnown({ provider_urls }) #

Build the /.well-known/web-identity JSON body. provider_urls lists the operator's IdP config URLs (FedCM §5).

res.setHeader("Content-Type", "application/json");
res.end(JSON.stringify(b.fedcm.wellKnown({
  provider_urls: ["https://idp.example/fedcm/config.json"],
})));

b.fedcm.config(opts) #

{
  accounts_endpoint:,
  branding:,
  client_metadata_endpoint:,
  disconnect_endpoint:,
  id_assertion_endpoint:,
  login_url:,
}

Build the IdentityProviderAPIConfig JSON body served at the operator's config_url per FedCM §6.3. Required fields: accounts_endpoint, client_metadata_endpoint, id_assertion_endpoint, login_url, branding (icon / name / colors).

res.end(JSON.stringify(b.fedcm.config({
  accounts_endpoint:        "/fedcm/accounts",
  client_metadata_endpoint: "/fedcm/client_metadata",
  id_assertion_endpoint:    "/fedcm/id_assertion",
  login_url:                "https://idp.example/login",
  branding: { background_color: "#000", color: "#fff", name: "Example IdP" },
})));

b.fedcm.accountsResponse({ accounts }) #

Build the JSON body for the accounts_endpoint response. Each account: { id, name, email, picture?, approved_clients? } Operator supplies the per-user account state.

res.setHeader("Set-Cookie", "Sec-FedCM-CSRF=...");
res.end(JSON.stringify(b.fedcm.accountsResponse({
  accounts: [{
    id: "1234", name: "Alice", email: "alice@example.com",
    approved_clients: ["rp.example"],
  }],
})));

b.fedcm.idAssertionResponse({ token }) #

Build the JSON body for the id_assertion_endpoint response. The operator mints the token (typically a signed JWT or verifiable credential) and the framework wraps it in the FedCM-spec shape.

res.end(JSON.stringify(b.fedcm.idAssertionResponse({ token: jwt })));

b.fedcm.clientMetadataResponse(opts) #

{
  privacy_policy_url:    string,    // required https URL
  terms_of_service_url:  string,    // required https URL
}

Build the JSON body for the FedCM client_metadata_endpoint response. Returns the relying-party policy URLs the browser surfaces during the IdP login prompt (privacy policy + terms of service). Both URLs are validated as https.

res.end(JSON.stringify(b.fedcm.clientMetadataResponse({
  privacy_policy_url:   "https://rp.example/privacy",
  terms_of_service_url: "https://rp.example/tos",
})));

b.fedcm.disconnectResponse(opts) #

{
  account_id: string,   // required — identifier of the account that was disconnected
}

Build the JSON body for the FedCM disconnect_endpoint response. The browser calls this when the user revokes their FedCM grant; the IdP returns the disconnected account id so the browser can update its local state. account_id is REQUIRED per the spec.

res.end(JSON.stringify(b.fedcm.disconnectResponse({ account_id: "1234" })));

Last updated 2026-08-08T16:39:49.652Z by seeder.