Federated Credential Management (FedCM) is a browser standard (W3C Web Incubator / Federated Identity Working Group) designed to provide a privacy-preserving foundation for federated identity ("Sign in with Google/Apple/IdP"). Previously, federated identity depended on third-party cookies in cross-origin iframes or top-level URL redirect parameters (bounce tracking). As modern browsers enforce third-party cookie phaseouts and bounce-tracking mitigations, legacy federation broke. FedCM introduces browser-mediated identity prompts that render natively outside the page DOM.

In legacy federation, an IdP could track a user's browsing habits simply by receiving silent iframe requests whenever the user visited any website embedding its SDK. FedCM resolves this via the Login Status API (navigator.login.setStatus({ status: "logged-in" })). The browser stores a privacy bit for each IdP. If the status is "logged-out", the browser rejects navigator.credentials.get() immediately without making any network request to the IdP, ensuring zero tracking of non-logged-in users.

An IdP must serve a well-known config at /.well-known/web-identity pointing to a JSON manifest. The manifest defines: accounts_endpoint (returning active user sessions), client_metadata_endpoint (privacy policy and terms URLs), id_assertion_endpoint (issuing the signed identity token), and optional endpoints like revocation_endpoint and disconnect_endpoint. All requests carry the Sec-Fetch-Dest: webidentity HTTP header to prevent CSRF.

Auto Re-authentication allows returning users who previously signed in to an application using FedCM to be re-authenticated seamlessly without an interactive prompt. If the Relying Party specifies mediation: "optional" or "conditional", and the browser detects exactly one previously approved account in the IdP accounts response, the browser immediately requests and resolves an identity assertion, slashing authentication latency to tens of milliseconds.