frontend

Submit a FedCM token

Changed on Nov 7, 2025

Use this endpoint to submit a token from a FedCM provider through navigator.credentials.get and log the user in. The parameters from navigator.credentials.get must have come from GET self-service/fed-cm/parameters.

post/self-service/fed-cm/token

Request

Base URL
/ (relative, and the document was published on a file host, not at the API’s origin)
URL
/self-service/fed-cm/token
Auth
none declared

Request body

csrf_tokenstring required

CSRFToken is the anti-CSRF token.

noncestring

Nonce is the nonce that was used in the navigator.credentials.get call. If specified, it must match the nonce claim in the token.

tokenstring required

Token contains the result of navigator.credentials.get.

transient_payloadobject

Transient data to pass along to any webhooks.

Example request

{
  "transient_payload": "{}",
  "csrf_token": "csrf_token",
  "nonce": "nonce",
  "token": "token"
}

Response

successfulNativeLogin

session_tokenstring

The Session Token

A session token is equivalent to a session cookie, but it can be sent in the HTTP Authorization Header:

Authorization: bearer ${session-token}

The session token is only issued for API flows, not for Browser flows!

Example response

{
  "session_token": "session_token",
  "session": {
    "tokenized": "tokenized",
    "expires_at": "2000-01-23T04:56:07.000+00:00",
    "devices": [
      {
        "location": "location",
        "id": "046b6c7f-0b8a-43b9-b35d-6489e6daee91",
        "ip_address": "ip_address",
        "user_agent": "user_agent"
      },
      {
        "location": "location",
        "id": "046b6c7f-0b8a-43b9-b35d-6489e6daee91",
        "ip_address": "ip_address",
        "user_agent": "user_agent"
      }
    ],
    "authentication_methods": [
      {
        "completed_at": "2000-01-23T04:56:07.000+00:00",
        "method": "password",
        "provider": "provider",
        "organization": "organization",
        "aal": "aal0"
      },
      {
        "completed_at": "2000-01-23T04:56:07.000+00:00",
        "method": "password",
        "provider": "provider",
        "organization": "organization",
        "aal": "aal0"
      }
    ],
    "authenticator_assurance_level": null,
    "identity": {
      "traits": "",
      "credentials": {
        "key": {
          "updated_at": "2000-01-23T04:56:07.000+00:00",
          "identifiers": [
            "identifiers",
            "identifiers"
          ],
          "created_at": "2000-01-23T04:56:07.000+00:00",
          "type": "password",
          "config": "{}",
          "version": 0
        }
      },
      "state_changed_at": "2000-01-23T04:56:07.000+00:00",
      "created_at": "2000-01-23T04:56:07.000+00:00",
      "external_id": "external_id",
      "recovery_addresses": [
        {
          "updated_at": "2000-01-23T04:56:07.000+00:00",
          "created_at": "2000-01-23T04:56:07.000+00:00",
          "id": "046b6c7f-0b8a-43b9-b35d-6489e6daee91",
          "value": "value",
          "via": "via"
        },
        {
          "updated_at": "2000-01-23T04:56:07.000+00:00",
          "created_at": "2000-01-23T04:56:07.000+00:00",
          "id": "046b6c7f-0b8a-43b9-b35d-6489e6daee91",
          "value": "value",
          "via": "via"
        }
      ],
      "metadata_admin": "",
      "updated_at": "2000-01-23T04:56:07.000+00:00",
      "verifiable_addresses": [
        {
          "updated_at": "2014-01-01T23:28:56.782Z",
          "verified_at": "2000-01-23T04:56:07.000+00:00",
          "verified": true,
          "created_at": "2014-01-01T23:28:56.782Z",
          "id": "046b6c7f-0b8a-43b9-b35d-6489e6daee91",
          "value": "value",
          "status": "status",
          "via": "email"
        },
        {
          "updated_at": "2014-01-01T23:28:56.782Z",
          "verified_at": "2000-01-23T04:56:07.000+00:00",
          "verified": true,
          "created_at": "2014-01-01T23:28:56.782Z",
          "id": "046b6c7f-0b8a-43b9-b35d-6489e6daee91",
          "value": "value",
          "status": "status",
          "via": "email"
        }
      ],
      "organization_id": "organization_id",
      "schema_id": "schema_id",
      "schema_url": "schema_url",
      "id": "046b6c7f-0b8a-43b9-b35d-6489e6daee91",
      "state": "active",
      "metadata_public": ""
    },
    "authenticated_at": "2000-01-23T04:56:07.000+00:00",
    "active": true,
    "id": "046b6c7f-0b8a-43b9-b35d-6489e6daee91",
    "issued_at": "2000-01-23T04:56:07.000+00:00"
  },
  "continue_with": [
    {
      "action": "show_verification_ui",
      "flow": {
        "verifiable_address": "verifiable_address",
        "id": "046b6c7f-0b8a-43b9-b35d-6489e6daee91",
        "url": "url"
      }
    },
    {
      "action": "show_verification_ui",
      "flow": {
        "verifiable_address": "verifiable_address",
        "id": "046b6c7f-0b8a-43b9-b35d-6489e6daee91",
        "url": "url"
      }
    }
  ]
}

Changes

Nov 7, 20255f08e5827b5e Revision changes
- breaking
  the response property //// became optional for the status
- breaking
  added to the /// response property oneOf list for the response status
- warning
  added the new div enum value to the /// response property for the response status
- warning
  added the new passkey enum value to the /// response property for the response status
- warning
  added the new profile enum value to the /// response property for the response status
- warning
  added the new saml enum value to the /// response property for the response status
- warning
  added the new username webauthn enum value to the //////// response property for the response status
- info
  added the new optional request property (media type: application/json)
- info
  added the new optional request property (media type: application/x-www-form-urlencoded)
- info
  added the optional property to the response with the status
- info
  added the optional property // to the response with the status
- info
  added div discriminator mapping keys to the /// response property for the response status
- info
  removed the a enum value from the //////// response property for the response status
- info
  removed the a enum value from the ///// response property for the response status
- info
  removed the a enum value from the ///// response property for the response status
- info
  removed the a enum value from the ///// response property for the response status
- info
  removed the img enum value from the //////// response property for the response status
- info
  removed the img enum value from the ///// response property for the response status
- info
  removed the img enum value from the ///// response property for the response status
- info
  removed the img enum value from the ///// response property for the response status
- info
  removed the input enum value from the ///// response property for the response status
- info
  removed the input enum value from the ///// response property for the response status
- info
  removed the input enum value from the ///// response property for the response status
- info
  removed the input enum value from the ///// response property for the response status
- info
  removed the script enum value from the //////// response property for the response status
- info
  removed the script enum value from the ///// response property for the response status
- info
  removed the script enum value from the ///// response property for the response status
- info
  removed the script enum value from the ///// response property for the response status
- info
  removed the text enum value from the //////// response property for the response status
- info
  removed the text enum value from the ///// response property for the response status
- info
  removed the text enum value from the ///// response property for the response status
- info
  removed the text enum value from the ///// response property for the response status
- info
  removed the v0.6_legacy_session enum value from the /// response property for the response status
Feb 25, 2025df2fe8db7397 Revision changes
- info
  endpoint added

Operation history (3 revisions)