What Is FedCM and Why It Matters
The Federated Credential Management API (FedCM) is a web platform feature that enables identity federation on the web in a privacy-preserving manner. FedCM allows users to sign in to websites using their existing accounts with identity providers (IdPs) like Google, Facebook, or Apple, without requiring those IdPs to rely on third-party cookies or cross-site redirects that could be used for tracking.
Key benefits of FedCM:
- Privacy-preserving: Identity providers cannot track which relying parties users are authenticating to
- No third-party cookies required: Works even as browsers phase out third-party tracking cookies
- Browser-mediated: The browser acts as a trusted intermediary between IdPs and relying parties
- Native user experience: Consistent, browser-controlled UI for authentication dialogs
The Chrome Developers FedCM Overview provides comprehensive documentation on these privacy guarantees.
The Privacy-Preserving Approach
FedCM's privacy architecture fundamentally changes how identity information flows between parties. In a traditional OAuth flow, the identity provider sets cookies on its own domain, and when a user initiates sign-in on a relying party website, they are redirected to the identity provider. The identity provider's server can see that this particular user is visiting this particular relying party, creating a record of the user's activity.
In FedCM, the browser becomes the intermediary. When a user clicks "Sign in with Google" on a website, the browser contacts Google's servers directly, without exposing which relying party initiated the request. The browser receives authentication information and presents it to the user in a browser-mediated dialog. If the user approves, the browser provides a credential to the relying party that contains only the information the user and IdP have agreed to share.
For web developers building modern web applications, understanding FedCM is essential as browsers increasingly restrict third-party cookies to protect user privacy. This shift toward privacy-preserving authentication represents a fundamental change in how we implement user identity on the web. Additionally, implementing robust authentication solutions ensures your site maintains both security and discoverability.
Everything you need to implement privacy-preserving authentication
Browser-Mediated Auth
The browser controls the authentication UI, preventing IdPs from tracking RP visits while providing a consistent user experience.
No Third-Party Cookies
Works seamlessly as browsers phase out third-party cookies, future-proofing your authentication infrastructure.
Standard Web API
Built on the existing Web Credentials API with familiar patterns for developers experienced in password autofill and WebAuthn.
Account Management
Users can disconnect IdP accounts through the browser, giving them control over their identity connections.