From 2581ba2987799cc5a1fb6d34d23f2637f9e922b3 Mon Sep 17 00:00:00 2001
From: bvandersloot-mozilla
 <90582190+bvandersloot-mozilla@users.noreply.github.com>
Date: Mon, 13 Feb 2023 22:19:56 +0000
Subject: [PATCH] Restructuring pass of core spec information (IDP and Browser
 APIs) (#424)

SHA: 10c8d09c8ca2bb952c5592b8b7d9fea2c01567fb
Reason: push, by samuelgoto

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---
 index.html | 2113 ++++++++++++++++++++++++++--------------------------
 1 file changed, 1052 insertions(+), 1061 deletions(-)

diff --git a/index.html b/index.html
index f1babe225..be9466919 100644
--- a/index.html
+++ b/index.html
@@ -6,7 +6,7 @@
   <link href="https://www.w3.org/StyleSheets/TR/2021/cg-draft" rel="stylesheet">
   <meta content="Bikeshed version 859efb4bd, updated Fri Jan 27 16:04:01 2023 -0800" name="generator">
   <link href="https://fedidcg.github.io/FedCM/" rel="canonical">
-  <meta content="8a33eb440c12c2bbd53dc19452e2c899ed1b1e2c" name="document-revision">
+  <meta content="10c8d09c8ca2bb952c5592b8b7d9fea2c01567fb" name="document-revision">
 <style>
 dl.domintro dt {
     font-family: Menlo, Consolas, "DejaVu Sans Mono", Monaco, monospace;
@@ -616,7 +616,7 @@
   <div class="head">
    <p data-fill-with="logo"><a class="logo" href="https://www.w3.org/"> <img alt="W3C" height="48" src="https://www.w3.org/StyleSheets/TR/2021/logos/W3C" width="72"> </a> </p>
    <h1 class="p-name no-ref" id="title">Federated Credential Management API</h1>
-   <p id="w3c-state"><a href="https://www.w3.org/standards/types#CG-DRAFT">Draft Community Group Report</a>, <time class="dt-updated" datetime="2023-02-09">9 February 2023</time></p>
+   <p id="w3c-state"><a href="https://www.w3.org/standards/types#CG-DRAFT">Draft Community Group Report</a>, <time class="dt-updated" datetime="2023-02-13">13 February 2023</time></p>
    <div data-fill-with="spec-metadata">
     <dl>
      <dt>This version:
@@ -656,22 +656,25 @@ <h2 class="no-num no-toc no-ref" id="contents">Table of Contents</h2>
    <ol class="toc" role="directory">
     <li><a href="#introduction"><span class="secno">1</span> <span class="content">Introduction</span></a>
     <li>
-     <a href="#idp-api"><span class="secno">2</span> <span class="content">The Identity Provider API</span></a>
+     <a href="#browser-api"><span class="secno">2</span> <span class="content">The Browser API</span></a>
      <ol class="toc">
-      <li><a href="#idp-api-well-known"><span class="secno">2.1</span> <span class="content">The Well-Known File</span></a>
-      <li><a href="#idp-api-manifest"><span class="secno">2.2</span> <span class="content">Manifest</span></a>
-      <li><a href="#idp-api-accounts-endpoint"><span class="secno">2.3</span> <span class="content">Accounts List</span></a>
-      <li><a href="#idp-api-client-id-metadata-endpoint"><span class="secno">2.4</span> <span class="content">Client Metadata</span></a>
-      <li><a href="#idp-api-id-assertion-endpoint"><span class="secno">2.5</span> <span class="content">Identity Assertions</span></a>
+      <li><a href="#browser-api-state-machine"><span class="secno">2.1</span> <span class="content">The State Machine</span></a>
+      <li>
+       <a href="#browser-api-identity-credential-interface"><span class="secno">2.2</span> <span class="content">The IdentityCredential Interface</span></a>
+       <ol class="toc">
+        <li><a href="#browser-api-credential-request-options"><span class="secno">2.2.1</span> <span class="content">The CredentialRequestOptions ## {#browser-api-credential-request-options}</span></a>
+        <li><a href="#browser-api-rp-sign-in"><span class="secno">2.2.2</span> <span class="content">The <code>[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</code> internal method ## {#browser-api-rp-sign-in}</span></a>
+       </ol>
      </ol>
     <li>
-     <a href="#browser-api"><span class="secno">3</span> <span class="content">The Browser API</span></a>
+     <a href="#idp-api"><span class="secno">3</span> <span class="content">Identity Provider HTTP API</span></a>
      <ol class="toc">
-      <li><a href="#browser-api-state-machine"><span class="secno">3.1</span> <span class="content">The State Machine</span></a>
-      <li><a href="#browser-api-identity-credential-interface"><span class="secno">3.2</span> <span class="content">The IdentityCredential Interface</span></a>
-      <li><a href="#browser-api-credential-request-options"><span class="secno">3.3</span> <span class="content">The CredentialRequestOptions</span></a>
-      <li><a href="#browser-api-rp-sign-in"><span class="secno">3.4</span> <span class="content">The <code>[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</code> internal method</span></a>
-      <li><a href="#browser-api-backwards-compatibility"><span class="secno">3.5</span> <span class="content">Backwards Compatibility</span></a>
+      <li><a href="#idp-api-well-known"><span class="secno">3.1</span> <span class="content">The Well-Known File</span></a>
+      <li><a href="#idp-api-manifest"><span class="secno">3.2</span> <span class="content">Manifest</span></a>
+      <li><a href="#idp-api-accounts-endpoint"><span class="secno">3.3</span> <span class="content">Accounts List</span></a>
+      <li><a href="#idp-api-client-id-metadata-endpoint"><span class="secno">3.4</span> <span class="content">Client Metadata</span></a>
+      <li><a href="#idp-api-id-assertion-endpoint"><span class="secno">3.5</span> <span class="content">Identity Assertions</span></a>
+      <li><a href="#browser-api-backwards-compatibility"><span class="secno">3.6</span> <span class="content">Backwards Compatibility</span></a>
      </ol>
     <li><a href="#permissions-policy-integration"><span class="secno">4</span> <span class="content">Permissions Policy Integration</span></a>
     <li>
@@ -786,7 +789,7 @@ <h2 class="heading settled" data-level="1" id="introduction"><span class="secno"
    </div>
    <p>At a high level, the Federated Credential Management API works by the
 intermediation of cooperating <a data-link-type="dfn" href="#idp" id="ref-for-idp②">IDP</a>s and <a data-link-type="dfn" href="#rp" id="ref-for-rp②">RP</a>s.</p>
-   <p>The <a href="#idp-api">§ 2 The Identity Provider API</a> defines a set of HTTP APIs that cooperating <a data-link-type="dfn" href="#idp" id="ref-for-idp③">IDP</a>s and <a data-link-type="dfn" href="#idp" id="ref-for-idp④">IDP</a>s exposes as well as the entry points in the <a href="#browser-api">§ 3 The Browser API</a> that they can use.</p>
+   <p>The <a href="#idp-api">§ 3 Identity Provider HTTP API</a> defines a set of HTTP APIs that cooperating <a data-link-type="dfn" href="#idp" id="ref-for-idp③">IDP</a>s and <a data-link-type="dfn" href="#idp" id="ref-for-idp④">IDP</a>s exposes as well as the entry points in the <a href="#browser-api">§ 2 The Browser API</a> that they can use.</p>
 <script type="text/typogram">
 +-----------+                  +-----------+                      +-----------+
 |           |                  |           |                      |           |
@@ -901,479 +904,154 @@ <h2 class="heading settled" data-level="1" id="introduction"><span class="secno"
       |                               |                                 |
      -+-                             -+-                               -+-
 </script>
-   <h2 class="heading settled" data-level="2" id="idp-api"><span class="secno">2. </span><span class="content">The Identity Provider API</span><a class="self-link" href="#idp-api"></a></h2>
-   <p><em>This section is non-normative.</em></p>
-   <p>The <a data-link-type="dfn" href="#idp" id="ref-for-idp⑤">IDP</a> proactively and cooperatively exposes itself as a comformant agent
-by exposing a series of HTTP endpoints:</p>
-   <ol>
-    <li data-md>
-     <p>A <a href="#idp-api-manifest">§ 2.2 Manifest</a> endpoint in an agreed upon location that points to</p>
-    <li data-md>
-     <p>An <a href="#idp-api-accounts-endpoint">§ 2.3 Accounts List</a> endpoint</p>
-    <li data-md>
-     <p>A <a href="#idp-api-client-id-metadata-endpoint">§ 2.4 Client Metadata</a> endpoint</p>
-    <li data-md>
-     <p>An <a href="#idp-api-id-assertion-endpoint">§ 2.5 Identity Assertions</a> endpoint</p>
-   </ol>
-   <p>The <a data-link-type="dfn" href="#idp" id="ref-for-idp⑥">IDP</a> must also host a file at the ".well-known/web-identity" path of its <a data-link-type="dfn" href="https://url.spec.whatwg.org/#host-registrable-domain" id="ref-for-host-registrable-domain">registrable domain</a> that has JSON contents that are convertable to an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderwellknown" id="ref-for-dictdef-identityproviderwellknown">IdentityProviderWellKnown</a></code> object.</p>
-<pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-identityproviderwellknown"><code><c- g>IdentityProviderWellKnown</c-></code></dfn> {
-  <c- b>required</c-> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString"><c- b>USVString</c-></a>> <dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderWellKnown" data-dfn-type="dict-member" data-export data-type="sequence<USVString> " id="dom-identityproviderwellknown-provider_urls"><code><c- g>provider_urls</c-></code></dfn>;
-};
-</pre>
-   <p>The FedCM API introduces the ability for a site to ask the browser to execute a few different
-network requests. It is important for the browser
-to execute these in such a way that it does not allow the user to be tracked (by an attacker
-impersonating an <a data-link-type="dfn" href="#idp" id="ref-for-idp⑦">IDP</a>) on to the site using FedCM. The following table has information about the
-network requests performed:</p>
-<script type="text/typogram">
-┌──────────────────────────┬─────────┬───────────┬──────────┐
-│ Endpoint                 │ cookies │ client_id │ referrer │
-├──────────────────────────┼─────────┼───────────┼──────────┤
-│ manifests                │  no     │  no       │  no      │
-├──────────────────────────┼─────────┼───────────┼──────────┤
-│ accounts_endpoint        │  yes    │  no       │  no      │
-├──────────────────────────┼─────────┼───────────┼──────────┤
-│ client_metadata_endpoint │  no     │  yes      │  yes     │
-├──────────────────────────┼─────────┼───────────┼──────────┤
-│ id_assertion_endpoint    │  yes    │  yes      │  yes     │
-└──────────────────────────┴─────────┴───────────┴──────────┘
-</script>
-   <h3 class="heading settled" data-level="2.1" id="idp-api-well-known"><span class="secno">2.1. </span><span class="content">The Well-Known File</span><a class="self-link" href="#idp-api-well-known"></a></h3>
-   <p class="note" role="note"><span class="marker">NOTE:</span> The browser uses the well-known file to prevent the following attack described <a href="https://github.com/fedidcg/FedCM/issues/230#issuecomment-1067029200">here</a>.</p>
-   <p>The <a data-link-type="dfn" href="#idp" id="ref-for-idp⑧">IDP</a> exposes a well-known file in a pre-defined location, specifically at the "web-identity" file at the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑨">IDPs</a>'s path ".well-known".</p>
-   <p>The well-known file is fetched:</p>
-   <p>(a) <strong>without</strong> cookies,
-(b) <strong>with</strong> the <a data-link-type="http-header" href="https://w3c.github.io/webappsec-fetch-metadata/#http-headerdef-sec-fetch-dest" id="ref-for-http-headerdef-sec-fetch-dest">Sec-Fetch-Dest</a> header set to <code>webidentity</code>, and
-(c) <strong>without</strong> revealing the <a data-link-type="dfn" href="#rp" id="ref-for-rp③">RP</a> in the <a data-link-type="http-header" href="https://fetch.spec.whatwg.org/#http-origin" id="ref-for-http-origin">Origin</a> or <a href="https://httpwg.org/specs/rfc9110.html#field.referer">Referer</a> headers.</p>
-   <p>For example:</p>
-   <div class="example" id="example-c06ffb02">
-    <a class="self-link" href="#example-c06ffb02"></a> 
-<pre class="language-http highlight"><c- nf>GET</c-> <c- nn>/.well-known/web-identity</c-> <c- kr>HTTP</c-><c- o>/</c-><c- m>1.1</c->
-<c- e>Host</c-><c- o>:</c-> <c- l>idp.example</c->
-<c- e>Accept</c-><c- o>:</c-> <c- l>application/json</c->
-<c- e>Sec-Fetch-Dest</c-><c- o>:</c-> <c- l>webidentity</c->
+   <h2 class="heading settled" data-level="2" id="browser-api"><span class="secno">2. </span><span class="content">The Browser API</span><a class="self-link" href="#browser-api"></a></h2>
+   <p>The Browser API exposes APIs to <a data-link-type="dfn" href="#rp" id="ref-for-rp③">RP</a>s and <a data-link-type="dfn" href="#idp" id="ref-for-idp⑤">IDP</a>s to call and intermediates
+the exchange of the user’s identity.</p>
+   <p>The Sign-up and Sign-in APIs are used by the <a data-link-type="dfn" href="#rp" id="ref-for-rp④">RP</a>s to ask the browser
+to intermediate the relationship with the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑥">IDP</a> and the
+provisioning of a token.</p>
+   <p class="note" role="note"><span class="marker">NOTE:</span> The <a data-link-type="dfn" href="#rp" id="ref-for-rp⑤">RP</a> makes no delineation between Sign-up and Sign-in, but
+rather calls the same API indistinguishably.</p>
+   <p>If all goes well, the Relying Party receives back an <code class="idl"><a data-link-type="idl" href="#identitycredential" id="ref-for-identitycredential">IdentityCredential</a></code> which contains a token it can use to authenticate the user.</p>
+   <div class="example" id="example-899750f6">
+    <a class="self-link" href="#example-899750f6"></a> 
+<pre class="language-js highlight"><c- a>const</c-> credential <c- o>=</c-> <c- k>await</c-> navigator<c- p>.</c->credentials<c- p>.</c->get<c- p>({</c->
+  identity<c- o>:</c-> <c- p>{</c->
+    providers<c- o>:</c-> <c- p>[{</c->
+      configURL<c- o>:</c-> <c- u>"https://idp.example/manifest.json"</c-><c- p>,</c->
+      clientId<c- o>:</c-> <c- u>"123"</c-><c- p>,</c->
+    <c- p>}]</c->
+  <c- p>}</c->
+<c- p>});</c->
 </pre>
    </div>
-   <p>The file is parsed expecting a <a data-link-type="dfn" href="#well-known" id="ref-for-well-known">Well-Known</a> JSON object.</p>
-   <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="well-known">Well-Known</dfn> JSON object has the following properties:</p>
+   <p>For fetches that are sent with cookies we include unpartitioned cookies,
+as if the resource was loaded as a same-origin request, e.g.
+regardless of the <a href="https://httpwg.org/http-extensions/draft-ietf-httpbis-rfc6265bis.html#name-the-samesite-attribute-2">SameSite</a> value (which is used when a resource loaded as a third-party, not first-party). This makes it easy
+for an <a data-link-type="dfn" href="#idp" id="ref-for-idp⑦">IDP</a> to adopt the FedCM API without introducing security issues on the API, since the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑥">RP</a> cannot inspect the results from the fetches in any way.</p>
+   <h3 class="heading settled" data-level="2.1" id="browser-api-state-machine"><span class="secno">2.1. </span><span class="content">The State Machine</span><a class="self-link" href="#browser-api-state-machine"></a></h3>
+   <p>Each <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#user-agent" id="ref-for-user-agent②">user agent</a> keeps track of a global <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="state-machine-map">state machine map</dfn>, an initially empty <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map">map</a>. The <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-getting-the-keys" id="ref-for-map-getting-the-keys">keys</a> in the <a data-link-type="dfn" href="#state-machine-map" id="ref-for-state-machine-map">state machine map</a> are triples of the form (<var>rp</var>, <var>idp</var>, <var>account</var>) where <var>rp</var> is
+the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin" id="ref-for-concept-origin">origin</a> of the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑦">RP</a>, <var>idp</var> is the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin" id="ref-for-concept-origin①">origin</a> of the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑧">IDP</a>, and <var>account</var> is a string representing
+an account identifier. The <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-getting-the-values" id="ref-for-map-getting-the-values">values</a> in the <a data-link-type="dfn" href="#state-machine-map" id="ref-for-state-machine-map①">state machine map</a> are <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="accountstate">AccountState</dfn> objects which have
+the following properties:</p>
    <dl>
-    <dt data-md><dfn class="idl-code" data-dfn-for="Well-Known" data-dfn-type="argument" data-export id="dom-well-known-provider_urls"><code>provider_urls</code><a class="self-link" href="#dom-well-known-provider_urls"></a></dfn> (required)
+    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AccountState" data-dfn-type="argument" data-export id="dom-accountstate-registration-state"><code>registration state</code></dfn>
+    <dd data-md>
+     <p>Keeps track of whether the user agent is aware that the user has registered an account on the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑧">RP</a> with the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑨">IDP</a> or not.
+ Can be <dfn class="dfn-paneled idl-code" data-dfn-for="AccountState" data-dfn-type="argument" data-export id="dom-accountstate-registered"><code>registered</code></dfn> or <dfn class="dfn-paneled idl-code" data-dfn-for="AccountState" data-dfn-type="argument" data-export id="dom-accountstate-unregistered"><code>unregistered</code></dfn> (by default).</p>
+    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AccountState" data-dfn-type="argument" data-export id="dom-accountstate-allows-logout"><code>allows logout</code></dfn>
     <dd data-md>
-     <p>A list of URLs that points to valid <a href="#idp-api-manifest">§ 2.2 Manifest</a>s.</p>
+     <p>Boolean which keeps track of whether the user agent would allow the <var>account</var> to be logged
+out via <code class="idl"><a data-link-type="idl">logoutRPs()</a></code>. It is initialized to false by default. Note that
+this value being true does not imply that the user is logged in to the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑨">RP</a> with the
+account, it merely implies that <code class="idl"><a data-link-type="idl">logoutRPs()</a></code> has not yet been called
+on this account after the last successful <code class="idl"><a data-link-type="idl" href="#identitycredential" id="ref-for-identitycredential①">IdentityCredential</a></code> creation with this account.</p>
    </dl>
-   <h3 class="heading settled" data-level="2.2" id="idp-api-manifest"><span class="secno">2.2. </span><span class="content">Manifest</span><a class="self-link" href="#idp-api-manifest"></a></h3>
-   <p>The config endpoint is an endpoint
-which serves as a discovery device to other endpoints provided by the <a data-link-type="dfn" href="#idp" id="ref-for-idp①⓪">IDP</a>.</p>
-   <p>The config endpoint is fetched:</p>
-   <p>(a) <strong>without</strong> cookies,
-(b) <strong>with</strong> the <a data-link-type="http-header" href="https://w3c.github.io/webappsec-fetch-metadata/#http-headerdef-sec-fetch-dest" id="ref-for-http-headerdef-sec-fetch-dest①">Sec-Fetch-Dest</a> header set to <code>webidentity</code>,
-(c) <strong>without</strong> revealing the <a data-link-type="dfn" href="#rp" id="ref-for-rp④">RP</a> in the <a data-link-type="http-header" href="https://fetch.spec.whatwg.org/#http-origin" id="ref-for-http-origin①">Origin</a> or <a href="https://httpwg.org/specs/rfc9110.html#field.referer">Referer</a> headers, and
-(c) <strong>without</strong> following <a href="https://httpwg.org/specs/rfc9110.html#field.location">HTTP redirects</a>.</p>
-   <p>For example:</p>
-   <div class="example" id="example-568d2573">
-    <a class="self-link" href="#example-568d2573"></a> 
-<pre class="language-http highlight"><c- nf>GET</c-> <c- nn>/config.json</c-> <c- kr>HTTP</c-><c- o>/</c-><c- m>1.1</c->
-<c- e>Host</c-><c- o>:</c-> <c- l>idp.example</c->
-<c- e>Accept</c-><c- o>:</c-> <c- l>application/json</c->
-<c- e>Sec-Fetch-Dest</c-><c- o>:</c-> <c- l>webidentity</c->
-</pre>
+   <div class="algorithm" data-algorithm="compute account state">
+     To <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="compute-account-state">compute account state</dfn> given an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderconfig" id="ref-for-dictdef-identityproviderconfig">IdentityProviderConfig</a></code> <var>provider</var>, an <code class="idl"><a data-link-type="idl" href="#dictdef-identityprovideraccount" id="ref-for-dictdef-identityprovideraccount">IdentityProviderAccount</a></code> <var>account</var>, and a <var>globalObject</var>, run the following steps. This returns
+an <a data-link-type="dfn" href="#accountstate" id="ref-for-accountstate">AccountState</a>. 
+    <ol>
+     <li data-md>
+      <p>Let <var>configUrl</var> be the result of running <a data-link-type="dfn" href="#parse-url" id="ref-for-parse-url">parse url</a> with <var>provider</var>’s <code class="idl"><a data-link-type="idl" href="#dom-identityproviderconfig-configurl" id="ref-for-dom-identityproviderconfig-configurl">configURL</a></code> and <var>globalObject</var>.</p>
+     <li data-md>
+      <p>Let <var>idpOrigin</var> be the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin" id="ref-for-concept-origin②">origin</a> corresponding to <var>configUrl</var>.</p>
+     <li data-md>
+      <p>Let <var>rpOrigin</var> be <var>globalObject</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/nav-history-apis.html#concept-document-window" id="ref-for-concept-document-window">associated Document</a>'s <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#concept-document-origin" id="ref-for-concept-document-origin">origin</a>.</p>
+     <li data-md>
+      <p>Let <var>accountId</var> be <var>account</var>’s <code class="idl"><a data-link-type="idl" href="#dom-identityprovideraccount-id" id="ref-for-dom-identityprovideraccount-id">id</a></code>.</p>
+     <li data-md>
+      <p>Let <var>triple</var> be (<var>rpOrigin</var>, <var>idpOrigin</var>, <var>accountId</var>).</p>
+     <li data-md>
+      <p>If <a data-link-type="dfn" href="#state-machine-map" id="ref-for-state-machine-map②">state machine map</a>[<var>triple</var>] does not exist, set <a data-link-type="dfn" href="#state-machine-map" id="ref-for-state-machine-map③">state machine map</a>[<var>triple</var>] to a
+new <a data-link-type="dfn" href="#accountstate" id="ref-for-accountstate①">AccountState</a>.</p>
+     <li data-md>
+      <p>Let <var>accountState</var> be <a data-link-type="dfn" href="#state-machine-map" id="ref-for-state-machine-map④">state machine map</a>[<var>triple</var>].</p>
+     <li data-md>
+      <p>Return <var>accountState</var>.</p>
+    </ol>
    </div>
-   <p>The response body must be a JSON object that can be <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-convert-ecmascript-to-idl-value" id="ref-for-dfn-convert-ecmascript-to-idl-value">converted</a> to an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderapiconfig" id="ref-for-dictdef-identityproviderapiconfig">IdentityProviderAPIConfig</a></code> without an exception.</p>
-<pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-identityprovidericon"><code><c- g>IdentityProviderIcon</c-></code></dfn> {
-  <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString①"><c- b>USVString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="USVString " href="#dom-identityprovidericon-url" id="ref-for-dom-identityprovidericon-url"><c- g>url</c-></a>;
-  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-unsigned-long" id="ref-for-idl-unsigned-long"><c- b>unsigned</c-> <c- b>long</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="unsigned long " href="#dom-identityprovidericon-size" id="ref-for-dom-identityprovidericon-size"><c- g>size</c-></a>;
-};
-
-<c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-identityproviderbranding"><code><c- g>IdentityProviderBranding</c-></code></dfn> {
-  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString②"><c- b>USVString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="USVString " href="#dom-identityproviderbranding-background_color" id="ref-for-dom-identityproviderbranding-background_color"><c- g>background_color</c-></a>;
-  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString③"><c- b>USVString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="USVString " href="#dom-identityproviderbranding-color" id="ref-for-dom-identityproviderbranding-color"><c- g>color</c-></a>;
-  <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence①"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#dictdef-identityprovidericon" id="ref-for-dictdef-identityprovidericon"><c- n>IdentityProviderIcon</c-></a>> <a class="idl-code" data-link-type="dict-member" data-type="sequence<IdentityProviderIcon> " href="#dom-identityproviderbranding-icons" id="ref-for-dom-identityproviderbranding-icons"><c- g>icons</c-></a>;
-};
-
-<c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-identityproviderapiconfig"><code><c- g>IdentityProviderAPIConfig</c-></code></dfn> {
-  <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString④"><c- b>USVString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="USVString " href="#dom-identityproviderapiconfig-accounts_endpoint" id="ref-for-dom-identityproviderapiconfig-accounts_endpoint"><c- g>accounts_endpoint</c-></a>;
-  <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString⑤"><c- b>USVString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="USVString " href="#dom-identityproviderapiconfig-client_metadata_endpoint" id="ref-for-dom-identityproviderapiconfig-client_metadata_endpoint"><c- g>client_metadata_endpoint</c-></a>;
-  <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString⑥"><c- b>USVString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="USVString " href="#dom-identityproviderapiconfig-id_assertion_endpoint" id="ref-for-dom-identityproviderapiconfig-id_assertion_endpoint"><c- g>id_assertion_endpoint</c-></a>;
-  <a data-link-type="idl-name" href="#dictdef-identityproviderbranding" id="ref-for-dictdef-identityproviderbranding"><c- n>IdentityProviderBranding</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="IdentityProviderBranding " href="#dom-identityproviderapiconfig-branding" id="ref-for-dom-identityproviderapiconfig-branding"><c- g>branding</c-></a>;
+   <div class="algorithm" data-algorithm="sign-in">
+     To <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="sign-in">sign-in</dfn> the user with a given an <a data-link-type="dfn" href="#accountstate" id="ref-for-accountstate②">AccountState</a> <var>accountState</var>: 
+    <ol>
+     <li data-md>
+      <p>Assert that <var>accountState</var>’s <code class="idl"><a data-link-type="idl" href="#dom-accountstate-registration-state" id="ref-for-dom-accountstate-registration-state">registration state</a></code> is <code class="idl"><a data-link-type="idl" href="#dom-accountstate-registered" id="ref-for-dom-accountstate-registered">registered</a></code></p>
+     <li data-md>
+      <p>Change <var>accountState</var>’s <code class="idl"><a data-link-type="idl" href="#dom-accountstate-allows-logout" id="ref-for-dom-accountstate-allows-logout">allows logout</a></code> from false to true.</p>
+    </ol>
+   </div>
+   <p>TODO: add an ASCII image to explain how the states fit into the algorithms.</p>
+   <h3 class="heading settled" data-level="2.2" id="browser-api-identity-credential-interface"><span class="secno">2.2. </span><span class="content">The IdentityCredential Interface</span><a class="self-link" href="#browser-api-identity-credential-interface"></a></h3>
+   <p>This specification introduces a new type of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#credential" id="ref-for-credential">Credential</a></code>, called an <code class="idl"><a data-link-type="idl" href="#identitycredential" id="ref-for-identitycredential②">IdentityCredential</a></code>:</p>
+<pre class="idl highlight def">[<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#Exposed" id="ref-for-Exposed"><c- g>Exposed</c-></a>=<c- n>Window</c->, <a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SecureContext" id="ref-for-SecureContext"><c- g>SecureContext</c-></a>]
+<c- b>interface</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="interface" data-export id="identitycredential"><code><c- g>IdentityCredential</c-></code></dfn> : <a data-link-type="idl-name" href="https://w3c.github.io/webappsec-credential-management/#credential" id="ref-for-credential①"><c- n>Credential</c-></a> {
+  <c- b>readonly</c-> <c- b>attribute</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString"><c- b>USVString</c-></a>? <dfn class="dfn-paneled idl-code" data-dfn-for="IdentityCredential" data-dfn-type="attribute" data-export data-readonly data-type="USVString?" id="dom-identitycredential-token"><code><c- g>token</c-></code></dfn>;
 };
 </pre>
-   <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderapiconfig" id="ref-for-dictdef-identityproviderapiconfig①">IdentityProviderAPIConfig</a></code> object’s members have the following semantics:</p>
-   <dl>
-    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderAPIConfig" data-dfn-type="dict-member" data-export id="dom-identityproviderapiconfig-accounts_endpoint"><code>accounts_endpoint</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString⑦">USVString</a></span>
-    <dd data-md>
-     <p>A URL that points to an HTTP API that complies with the <a href="#idp-api-accounts-endpoint">§ 2.3 Accounts List</a> API.</p>
-    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderAPIConfig" data-dfn-type="dict-member" data-export id="dom-identityproviderapiconfig-client_metadata_endpoint"><code>client_metadata_endpoint</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString⑧">USVString</a></span>
-    <dd data-md>
-     <p>A URL that points to an HTTP API that complies with the <a href="#idp-api-client-id-metadata-endpoint">§ 2.4 Client Metadata</a> API.</p>
-    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderAPIConfig" data-dfn-type="dict-member" data-export id="dom-identityproviderapiconfig-id_assertion_endpoint"><code>id_assertion_endpoint</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString⑨">USVString</a></span>
-    <dd data-md>
-     <p>A URL that points to an HTTP API that complies with the <a href="#idp-api-id-assertion-endpoint">§ 2.5 Identity Assertions</a> API.</p>
-    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderAPIConfig" data-dfn-type="dict-member" data-export id="dom-identityproviderapiconfig-branding"><code>branding</code></dfn>, <span> of type <a data-link-type="idl-name" href="#dictdef-identityproviderbranding" id="ref-for-dictdef-identityproviderbranding①">IdentityProviderBranding</a></span>
-    <dd data-md>
-     <p>A set of <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderbranding" id="ref-for-dictdef-identityproviderbranding②">IdentityProviderBranding</a></code> options.</p>
-   </dl>
-   <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderbranding" id="ref-for-dictdef-identityproviderbranding③">IdentityProviderBranding</a></code> enables an <a data-link-type="dfn" href="#idp" id="ref-for-idp①①">IDP</a> to express their branding
-preferences, which may be used by <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#user-agent" id="ref-for-user-agent②">user agents</a> to customize the permission prompt.</p>
-   <p class="note" role="note"><span class="marker">Note:</span> The branding preferences are deliberately designed to be high level
-/ abstract (rather than opinionated about a specific UI structure), to
-enable different <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#user-agent" id="ref-for-user-agent③">user agents</a> to offer different UI experiences and
-for them to evolve independently over time.</p>
-   <p>Its members have the following semantics:</p>
-   <dl>
-    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderBranding" data-dfn-type="dict-member" data-export id="dom-identityproviderbranding-background_color"><code>background_color</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString①⓪">USVString</a></span>
-    <dd data-md>
-     <p>Background <a data-link-type="dfn" href="#color" id="ref-for-color">color</a> for <a data-link-type="dfn" href="#idp" id="ref-for-idp①②">IDP</a>-branded widgets such as buttons.</p>
-    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderBranding" data-dfn-type="dict-member" data-export id="dom-identityproviderbranding-color"><code>color</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString①①">USVString</a></span>
-    <dd data-md>
-     <p><a data-link-type="dfn" href="#color" id="ref-for-color①">color</a> for text on <a data-link-type="dfn" href="#idp" id="ref-for-idp①③">IDP</a> branded widgets.</p>
-    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderBranding" data-dfn-type="dict-member" data-export id="dom-identityproviderbranding-icons"><code>icons</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="#dictdef-identityprovidericon" id="ref-for-dictdef-identityprovidericon①">IdentityProviderIcon</a>></span>
-    <dd data-md>
-     <p>A list of <code class="idl"><a data-link-type="idl" href="#dictdef-identityprovidericon" id="ref-for-dictdef-identityprovidericon②">IdentityProviderIcon</a></code> objects.</p>
-   </dl>
-   <p class="note" role="note"><span class="marker">Note:</span> The branding preferences are deliberately designed to be high level
-/ abstract (rather than opinionated about a specific UI structure), to
-enable different <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#user-agent" id="ref-for-user-agent④">user agents</a> to offer different UI experiences and
-for them to evolve independently over time.</p>
-   <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-identityprovidericon" id="ref-for-dictdef-identityprovidericon③">IdentityProviderIcon</a></code> has members with the following semantics:</p>
    <dl>
-    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderIcon" data-dfn-type="dict-member" data-export id="dom-identityprovidericon-url"><code>url</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString①②">USVString</a></span>
-    <dd data-md>
-     <p>The url pointing to the icon image, which must be square and single resolution
-(not a multi-resolution .ico). The icon needs to comply with the <a href="https://www.w3.org/TR/appmanifest/#icon-masks">maskable</a> specification.</p>
-    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderIcon" data-dfn-type="dict-member" data-export id="dom-identityprovidericon-size"><code>size</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-unsigned-long" id="ref-for-idl-unsigned-long①">unsigned long</a></span>
+    <dt data-md><b><code class="idl"><a data-link-type="idl" href="#dom-identitycredential-token" id="ref-for-dom-identitycredential-token">token</a></code></b>
     <dd data-md>
-     <p>The width/height of the square icon. The size may be omitted if the icon is in a vector
-graphic format (like SVG).</p>
+     <p>The <code class="idl"><a data-link-type="idl" href="#dom-identitycredential-token" id="ref-for-dom-identitycredential-token①">token</a></code>'s attribute getter returns the value it is set to.
+It represents the minted <code class="idl"><a data-link-type="idl" href="#dom-identityprovidertoken-token" id="ref-for-dom-identityprovidertoken-token">token</a></code> provided by the <a data-link-type="dfn" href="#idp" id="ref-for-idp①⓪">IDP</a>.</p>
    </dl>
-   <p class="note" role="note"><span class="marker">Note:</span> the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#user-agent" id="ref-for-user-agent⑤">user agent</a> reserves a square size for the icons provided by the developer. If the
-developer provides an icon that is not square, the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#user-agent" id="ref-for-user-agent⑥">user agent</a> may choose to not display it at
-all, trim the icon and show a square portion of it, or even transform it into a square icon and show
-that.</p>
-   <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="color">color</dfn> is a subset of CSS <a class="production css" data-link-type="type" href="https://drafts.csswg.org/css-color-4/#typedef-color" id="ref-for-typedef-color" title="Expands to: aliceblue | antiquewhite | aqua | aquamarine | azure | beige | bisque | black | blanchedalmond | blue | blueviolet | brown | burlywood | cadetblue | chartreuse | chocolate | coral | cornflowerblue | cornsilk | crimson | currentcolor | cyan | darkblue | darkcyan | darkgoldenrod | darkgray | darkgreen | darkgrey | darkkhaki | darkmagenta | darkolivegreen | darkorange | darkorchid | darkred | darksalmon | darkseagreen | darkslateblue | darkslategray | darkslategrey | darkturquoise | darkviolet | deeppink | deepskyblue | dimgray | dimgrey | dodgerblue | firebrick | floralwhite | forestgreen | fuchsia | gainsboro | ghostwhite | gold | goldenrod | gray | green | greenyellow | grey | honeydew | hotpink | indianred | indigo | ivory | khaki | lavender | lavenderblush | lawngreen | lemonchiffon | lightblue | lightcoral | lightcyan | lightgoldenrodyellow | lightgray | lightgreen | lightgrey | lightpink | lightsalmon | lightseagreen | lightskyblue | lightslategray | lightslategrey | lightsteelblue | lightyellow | lime | limegreen | linen | magenta | maroon | mediumaquamarine | mediumblue | mediumorchid | mediumpurple | mediumseagreen | mediumslateblue | mediumspringgreen | mediumturquoise | mediumvioletred | midnightblue | mintcream | mistyrose | moccasin | navajowhite | navy | none | oldlace | olive | olivedrab | orange | orangered | orchid | palegoldenrod | palegreen | paleturquoise | palevioletred | papayawhip | peachpuff | peru | pink | plum | powderblue | purple | rebeccapurple | red | rosybrown | royalblue | saddlebrown | salmon | sandybrown | seagreen | seashell | sienna | silver | skyblue | slateblue | slategray | slategrey | snow | springgreen | steelblue | tan | teal | thistle | tomato | transparent | turquoise | violet | wheat | white | whitesmoke | yellow | yellowgreen">&lt;color></a> syntax, namely <a class="production css" data-link-type="type" href="https://drafts.csswg.org/css-color-4/#typedef-hex-color" id="ref-for-typedef-hex-color">&lt;hex-color></a>s, <a class="css" data-link-type="maybe" href="https://drafts.csswg.org/css-color-5/#funcdef-hsl" id="ref-for-funcdef-hsl">hsl()</a>s, <a class="css" data-link-type="maybe" href="https://drafts.csswg.org/css-color-5/#funcdef-rgb" id="ref-for-funcdef-rgb">rgb()</a>s and <a class="production css" data-link-type="type" href="https://drafts.csswg.org/css-color-4/#typedef-named-color" id="ref-for-typedef-named-color">&lt;named-color></a>.</p>
-   <p>For example:</p>
-   <div class="example" id="example-450bc437">
-    <a class="self-link" href="#example-450bc437"></a> 
-<pre class="language-json highlight"><c- p>{</c->
-  <c- f>"accounts_endpoint"</c-><c- p>:</c-> <c- u>"/accounts"</c-><c- p>,</c->
-  <c- f>"client_metadata_endpoint"</c-><c- p>:</c-> <c- u>"/metadata"</c-><c- p>,</c->
-  <c- f>"id_assertion_endpoint"</c-><c- p>:</c-> <c- u>"/assertion"</c-><c- p>,</c->
-  <c- f>"branding"</c-><c- p>:</c-> <c- p>{</c->
-    <c- f>"background_color"</c-><c- p>:</c-> <c- u>"green"</c-><c- p>,</c->
-    <c- f>"color"</c-><c- p>:</c-> <c- u>"0xFFEEAA"</c-><c- p>,</c->
-    <c- f>"icons"</c-><c- p>:</c-> <c- p>[{</c->
-      <c- f>"url"</c-><c- p>:</c-> <c- u>"https://idp.example/icon.ico"</c-><c- p>,</c->
-      <c- f>"size"</c-><c- p>:</c-> <c- mi>25</c->
-    <c- p>}]</c->
-  <c- p>}</c->
-<c- p>}</c->
-</pre>
-   </div>
-   <h3 class="heading settled" data-level="2.3" id="idp-api-accounts-endpoint"><span class="secno">2.3. </span><span class="content">Accounts List</span><a class="self-link" href="#idp-api-accounts-endpoint"></a></h3>
-   <p>The accounts list endpoint provides the list of accounts the user has at the <a data-link-type="dfn" href="#idp" id="ref-for-idp①④">IDP</a>.</p>
-   <p>The accounts list endpoint is fetched
-(a) <strong>with</strong> <a data-link-type="dfn" href="#idp" id="ref-for-idp①⑤">IDP</a> cookies,
-(b) <strong>with</strong> the <a data-link-type="http-header" href="https://w3c.github.io/webappsec-fetch-metadata/#http-headerdef-sec-fetch-dest" id="ref-for-http-headerdef-sec-fetch-dest②">Sec-Fetch-Dest</a> header set to <code>webidentity</code>,
-(c) <strong>without</strong> revealing the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑤">RP</a> in the <a data-link-type="http-header" href="https://fetch.spec.whatwg.org/#http-origin" id="ref-for-http-origin②">Origin</a> or <a href="https://httpwg.org/specs/rfc9110.html#field.referer">Referer</a> headers, and
-(d) <strong>without</strong> following <a href="https://httpwg.org/specs/rfc9110.html#field.location">HTTP redirects</a>.</p>
-   <p>For example:</p>
-   <div class="example" id="example-6b4f66fb">
-    <a class="self-link" href="#example-6b4f66fb"></a> 
-<pre class="language-http highlight"><c- nf>GET</c-> <c- nn>/accounts_list</c-> <c- kr>HTTP</c-><c- o>/</c-><c- m>1.1</c->
-<c- e>Host</c-><c- o>:</c-> <c- l>idp.example</c->
-<c- e>Accept</c-><c- o>:</c-> <c- l>application/json</c->
-<c- e>Cookie</c-><c- o>:</c-> <c- l>0x23223</c->
-<c- e>Sec-Fetch-Dest</c-><c- o>:</c-> <c- l>webidentity</c->
+   <p>The main entrypoint in this specification is through the entrypoints exposed
+by the <a data-link-type="biblio" href="https://w3c.github.io/webappsec-credential-management/"><cite>Credential Management</cite></a> API.</p>
+   <h4 class="heading settled" data-level="2.2.1" id="browser-api-credential-request-options"><span class="secno">2.2.1. </span><span class="content">The CredentialRequestOptions ## {#browser-api-credential-request-options}</span><a class="self-link" href="#browser-api-credential-request-options"></a></h4>
+   <p>This specification starts by introducing an extension to the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dictdef-credentialrequestoptions" id="ref-for-dictdef-credentialrequestoptions">CredentialRequestOptions</a></code> object:</p>
+<pre class="idl highlight def"><c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="https://w3c.github.io/webappsec-credential-management/#dictdef-credentialrequestoptions" id="ref-for-dictdef-credentialrequestoptions①"><c- g>CredentialRequestOptions</c-></a> {
+  <a data-link-type="idl-name" href="#dictdef-identitycredentialrequestoptions" id="ref-for-dictdef-identitycredentialrequestoptions"><c- n>IdentityCredentialRequestOptions</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="CredentialRequestOptions" data-dfn-type="dict-member" data-export data-type="IdentityCredentialRequestOptions " id="dom-credentialrequestoptions-identity"><code><c- g>identity</c-></code></dfn>;
+};
 </pre>
-   </div>
-   <p>The response body must be a JSON object that can be <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-convert-ecmascript-to-idl-value" id="ref-for-dfn-convert-ecmascript-to-idl-value①">converted</a> to an <code class="idl"><a data-link-type="idl" href="#dictdef-identityprovideraccountlist" id="ref-for-dictdef-identityprovideraccountlist">IdentityProviderAccountList</a></code> without an exception.</p>
-<pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-identityprovideraccount"><code><c- g>IdentityProviderAccount</c-></code></dfn> {
-  <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString①③"><c- b>USVString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="USVString " href="#dom-identityprovideraccount-id" id="ref-for-dom-identityprovideraccount-id"><c- g>id</c-></a>;
-  <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString①④"><c- b>USVString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="USVString " href="#dom-identityprovideraccount-name" id="ref-for-dom-identityprovideraccount-name"><c- g>name</c-></a>;
-  <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString①⑤"><c- b>USVString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="USVString " href="#dom-identityprovideraccount-email" id="ref-for-dom-identityprovideraccount-email"><c- g>email</c-></a>;
-  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString①⑥"><c- b>USVString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="USVString " href="#dom-identityprovideraccount-given_name" id="ref-for-dom-identityprovideraccount-given_name"><c- g>given_name</c-></a>;
-  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString①⑦"><c- b>USVString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="USVString " href="#dom-identityprovideraccount-picture" id="ref-for-dom-identityprovideraccount-picture"><c- g>picture</c-></a>;
-  <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence②"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString①⑧"><c- b>USVString</c-></a>> <a class="idl-code" data-link-type="dict-member" data-type="sequence<USVString> " href="#dom-identityprovideraccount-approved_clients" id="ref-for-dom-identityprovideraccount-approved_clients"><c- g>approved_clients</c-></a>;
+   <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-identitycredentialrequestoptions" id="ref-for-dictdef-identitycredentialrequestoptions①">IdentityCredentialRequestOptions</a></code> contains a list of <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderconfig" id="ref-for-dictdef-identityproviderconfig①">IdentityProviderConfig</a></code>s that the <a data-link-type="dfn" href="#rp" id="ref-for-rp①⓪">RP</a> supports and has
+pre-registered with (i.e. it has a <code>clientId</code>).</p>
+<pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-identitycredentialrequestoptions"><code><c- g>IdentityCredentialRequestOptions</c-></code></dfn> {
+  <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#dictdef-identityproviderconfig" id="ref-for-dictdef-identityproviderconfig②"><c- n>IdentityProviderConfig</c-></a>> <dfn class="dfn-paneled idl-code" data-dfn-for="IdentityCredentialRequestOptions" data-dfn-type="dict-member" data-export data-type="sequence<IdentityProviderConfig> " id="dom-identitycredentialrequestoptions-providers"><code><c- g>providers</c-></code></dfn>;
 };
-<c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-identityprovideraccountlist"><code><c- g>IdentityProviderAccountList</c-></code></dfn> {
-  <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence③"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#dictdef-identityprovideraccount" id="ref-for-dictdef-identityprovideraccount"><c- n>IdentityProviderAccount</c-></a>> <dfn class="idl-code" data-dfn-for="IdentityProviderAccountList" data-dfn-type="dict-member" data-export data-type="sequence<IdentityProviderAccount> " id="dom-identityprovideraccountlist-accounts"><code><c- g>accounts</c-></code><a class="self-link" href="#dom-identityprovideraccountlist-accounts"></a></dfn>;
+</pre>
+   <p>Each <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderconfig" id="ref-for-dictdef-identityproviderconfig③">IdentityProviderConfig</a></code> represents an <a data-link-type="dfn" href="#idp" id="ref-for-idp①①">IDP</a> that
+the <a data-link-type="dfn" href="#rp" id="ref-for-rp①①">RP</a> supports (e.g. that it has a pre-registration agreement with).</p>
+<pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-identityproviderconfig"><code><c- g>IdentityProviderConfig</c-></code></dfn> {
+  <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString①"><c- b>USVString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderConfig" data-dfn-type="dict-member" data-export data-type="USVString " id="dom-identityproviderconfig-configurl"><code><c- g>configURL</c-></code></dfn>;
+  <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString②"><c- b>USVString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderConfig" data-dfn-type="dict-member" data-export data-type="USVString " id="dom-identityproviderconfig-clientid"><code><c- g>clientId</c-></code></dfn>;
+  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString③"><c- b>USVString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderConfig" data-dfn-type="dict-member" data-export data-type="USVString " id="dom-identityproviderconfig-nonce"><code><c- g>nonce</c-></code></dfn>;
 };
 </pre>
-   <p>Every <code class="idl"><a data-link-type="idl" href="#dictdef-identityprovideraccount" id="ref-for-dictdef-identityprovideraccount①">IdentityProviderAccount</a></code> is expected to have members with the following semantics:</p>
    <dl>
-    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderAccount" data-dfn-type="dict-member" data-export id="dom-identityprovideraccount-id"><code>id</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString①⑨">USVString</a></span>
-    <dd data-md>
-     <p>The account unique identifier.</p>
-    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderAccount" data-dfn-type="dict-member" data-export id="dom-identityprovideraccount-name"><code>name</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString②⓪">USVString</a></span>
-    <dd data-md>
-     <p>The user’s full name.</p>
-    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderAccount" data-dfn-type="dict-member" data-export id="dom-identityprovideraccount-email"><code>email</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString②①">USVString</a></span>
-    <dd data-md>
-     <p>The user’s email address.</p>
-    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderAccount" data-dfn-type="dict-member" data-export id="dom-identityprovideraccount-given_name"><code>given_name</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString②②">USVString</a></span>
+    <dt data-md><b><code class="idl"><a data-link-type="idl" href="#dom-identityproviderconfig-configurl" id="ref-for-dom-identityproviderconfig-configurl①">configURL</a></code></b>
     <dd data-md>
-     <p>The user’s given name.</p>
-    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderAccount" data-dfn-type="dict-member" data-export id="dom-identityprovideraccount-picture"><code>picture</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString②③">USVString</a></span>
+     <p>The URL of the configuration file for the identity provider.</p>
+    <dt data-md><b><code class="idl"><a data-link-type="idl" href="#dom-identityproviderconfig-clientid" id="ref-for-dom-identityproviderconfig-clientid">clientId</a></code></b>
     <dd data-md>
-     <p>URL for the account’s picture.</p>
-    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderAccount" data-dfn-type="dict-member" data-export id="dom-identityprovideraccount-approved_clients"><code>approved_clients</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString②④">USVString</a>></span>
+     <p>The <code class="idl"><a data-link-type="idl" href="#dom-id_assertion_endpoint_request-client_id" id="ref-for-dom-id_assertion_endpoint_request-client_id">client_id</a></code> provided to the <a data-link-type="dfn" href="#rp" id="ref-for-rp①②">RP</a> out of band by the <a data-link-type="dfn" href="#idp" id="ref-for-idp①②">IDP</a></p>
+    <dt data-md><b><code class="idl"><a data-link-type="idl" href="#dom-identityproviderconfig-nonce" id="ref-for-dom-identityproviderconfig-nonce">nonce</a></code></b>
     <dd data-md>
-     <p>A list of <a data-link-type="dfn" href="#rp" id="ref-for-rp⑥">RP</a>s (that gets matched against the requesting <code class="idl"><a data-link-type="idl" href="#dom-identityproviderconfig-clientid" id="ref-for-dom-identityproviderconfig-clientid">clientId</a></code>) this account is already registered with.
-Used in the <a data-link-type="dfn" href="#request-permission-to-sign-up" id="ref-for-request-permission-to-sign-up">request permission to sign-up</a> to allow the <a data-link-type="dfn" href="#idp" id="ref-for-idp①⑥">IDP</a> to control whether to show
-the Privacy Policy and the Terms of Service.</p>
+     <p>A random number of the choice of the <a data-link-type="dfn" href="#rp" id="ref-for-rp①③">RP</a>. It is generally used to associate a client
+session with a <code class="idl"><a data-link-type="idl" href="#dom-identityprovidertoken-token" id="ref-for-dom-identityprovidertoken-token①">token</a></code> and to mitigate replay attacks. Therefore, this value should have
+sufficient entropy such that it would be hard to guess.</p>
    </dl>
-   <p>For example:</p>
-   <div class="example" id="example-50458aa3">
-    <a class="self-link" href="#example-50458aa3"></a> 
-<pre class="language-json highlight"><c- p>{</c->
- <c- f>"accounts"</c-><c- p>:</c-> <c- p>[{</c->
-   <c- f>"id"</c-><c- p>:</c-> <c- u>"1234"</c-><c- p>,</c->
-   <c- f>"given_name"</c-><c- p>:</c-> <c- u>"John"</c-><c- p>,</c->
-   <c- f>"name"</c-><c- p>:</c-> <c- u>"John Doe"</c-><c- p>,</c->
-   <c- f>"email"</c-><c- p>:</c-> <c- u>"john_doe@idp.example"</c-><c- p>,</c->
-   <c- f>"picture"</c-><c- p>:</c-> <c- u>"https://idp.example/profile/123"</c-><c- p>,</c->
-   <c- f>"approved_clients"</c-><c- p>:</c-> <c- p>[</c-><c- u>"123"</c-><c- p>,</c-> <c- u>"456"</c-><c- p>,</c-> <c- u>"789"</c-><c- p>]</c->
-  <c- p>},</c-> <c- p>{</c->
-   <c- f>"id"</c-><c- p>:</c-> <c- u>"5678"</c-><c- p>,</c->
-   <c- f>"given_name"</c-><c- p>:</c-> <c- u>"Johnny"</c-><c- p>,</c->
-   <c- f>"name"</c-><c- p>:</c-> <c- u>"Johnny"</c-><c- p>,</c->
-   <c- f>"email"</c-><c- p>:</c-> <c- u>"johnny@idp.example"</c-><c- p>,</c->
-   <c- f>"picture"</c-><c- p>:</c-> <c- f>"https://idp.example/profile/456"</c->
-   <c- f>"approved_clients"</c-><c- p>:</c-> <c- p>[</c-><c- u>"abc"</c-><c- p>,</c-> <c- u>"def"</c-><c- p>,</c-> <c- u>"ghi"</c-><c- p>]</c->
-  <c- p>}]</c->
-<c- p>}</c->
-</pre>
-   </div>
-   <p class="issue" id="issue-ef9f6ef5"><a class="self-link" href="#issue-ef9f6ef5"></a> <a href="https://github.com/fedidcg/FedCM/issues/218">Clarify</a> the IDP API response when the user is not signed in.</p>
-   <h3 class="heading settled" data-level="2.4" id="idp-api-client-id-metadata-endpoint"><span class="secno">2.4. </span><span class="content">Client Metadata</span><a class="self-link" href="#idp-api-client-id-metadata-endpoint"></a></h3>
-   <p>The client metadata endpoint provides metadata about <a data-link-type="dfn" href="#rp" id="ref-for-rp⑦">RP</a>s.</p>
-   <p>The client medata endpoint is fetched
-(a) <strong>without</strong> cookies,
-(b) <strong>with</strong> the <a data-link-type="http-header" href="https://w3c.github.io/webappsec-fetch-metadata/#http-headerdef-sec-fetch-dest" id="ref-for-http-headerdef-sec-fetch-dest③">Sec-Fetch-Dest</a> header set to <code>webidentity</code>,
-(c) <strong>with</strong> the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑧">RP</a>'s origin in the <a data-link-type="http-header" href="https://fetch.spec.whatwg.org/#http-origin" id="ref-for-http-origin③">Origin</a> header, and
-(d) <strong>without</strong> following <a href="https://httpwg.org/specs/rfc9110.html#field.location">HTTP redirects</a>.</p>
-   <p>The user agent also passes the <strong>client_id</strong>.</p>
-   <p>For example:</p>
-   <div class="example" id="example-2ca55c06">
-    <a class="self-link" href="#example-2ca55c06"></a> 
-<pre class="language-http highlight"><c- nf>GET</c-> <c- nn>/client_medata?client_id=1234</c-> <c- kr>HTTP</c-><c- o>/</c-><c- m>1.1</c->
-<c- e>Host</c-><c- o>:</c-> <c- l>idp.example</c->
-<c- e>Origin</c-><c- o>:</c-> <c- l>https://rp.example/</c->
-<c- e>Accept</c-><c- o>:</c-> <c- l>application/json</c->
-<c- e>Sec-Fetch-Dest</c-><c- o>:</c-> <c- l>webidentity</c->
-</pre>
-   </div>
-   <p>The response body must be a JSON object that can be <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-convert-ecmascript-to-idl-value" id="ref-for-dfn-convert-ecmascript-to-idl-value②">converted</a> to an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderclientmetadata" id="ref-for-dictdef-identityproviderclientmetadata">IdentityProviderClientMetadata</a></code> without an exception.</p>
-<pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-identityproviderclientmetadata"><code><c- g>IdentityProviderClientMetadata</c-></code></dfn> {
-  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString②⑤"><c- b>USVString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="USVString " href="#dom-identityproviderclientmetadata-privacy_policy_url" id="ref-for-dom-identityproviderclientmetadata-privacy_policy_url"><c- g>privacy_policy_url</c-></a>;
-  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString②⑥"><c- b>USVString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="USVString " href="#dom-identityproviderclientmetadata-terms_of_service_url" id="ref-for-dom-identityproviderclientmetadata-terms_of_service_url"><c- g>terms_of_service_url</c-></a>;
-};
-</pre>
-   <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderclientmetadata" id="ref-for-dictdef-identityproviderclientmetadata①">IdentityProviderClientMetadata</a></code> object’s members have the following semantics:</p>
+   <h4 class="heading settled" data-level="2.2.2" id="browser-api-rp-sign-in"><span class="secno">2.2.2. </span><span class="content">The <code>[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</code> internal method ## {#browser-api-rp-sign-in}</span><a class="self-link" href="#browser-api-rp-sign-in"></a></h4>
+   <p>The <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-discoverfromexternalsource-slot" id="ref-for-dom-credential-discoverfromexternalsource-slot">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> algorithm runs in parallel inside the <a href="https://w3c.github.io/webappsec-credential-management/#algorithm-request">Credential Management § algorithm-request</a> to request credentials and returns a
+set of <code class="idl"><a data-link-type="idl" href="#identitycredential" id="ref-for-identitycredential③">IdentityCredential</a></code> for the requested <a data-link-type="dfn" href="#idp" id="ref-for-idp①③">IDP</a>s.</p>
+   <p>This <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-ordinary-object-internal-methods-and-internal-slots" id="ref-for-sec-ordinary-object-internal-methods-and-internal-slots">internal method</a> accepts three arguments:</p>
    <dl>
-    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderClientMetadata" data-dfn-type="dict-member" data-export id="dom-identityproviderclientmetadata-privacy_policy_url"><code>privacy_policy_url</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString②⑦">USVString</a></span>
+    <dt data-md><dfn class="idl-code" data-dfn-for="IdentityCredential/[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)" data-dfn-type="argument" data-export id="dom-identitycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-origin"><code>origin</code><a class="self-link" href="#dom-identitycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-origin"></a></dfn>
     <dd data-md>
-     <p>A link to the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑨">RP</a>'s Privacy Policy.</p>
-    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderClientMetadata" data-dfn-type="dict-member" data-export id="dom-identityproviderclientmetadata-terms_of_service_url"><code>terms_of_service_url</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString②⑧">USVString</a></span>
+     <p>This argument is the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#relevant-settings-object" id="ref-for-relevant-settings-object">relevant settings object</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin" id="ref-for-concept-settings-object-origin">origin</a>, as determined by the
+ calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get">get()</a></code> implementation, i.e., <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#credentialscontainer" id="ref-for-credentialscontainer">CredentialsContainer</a></code>'s <a data-link-type="abstract-op" href="https://w3c.github.io/webappsec-credential-management/#abstract-opdef-request-a-credential" id="ref-for-abstract-opdef-request-a-credential">Request a <code>Credential</code></a> abstract operation.</p>
+    <dt data-md><dfn class="idl-code" data-dfn-for="IdentityCredential/[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)" data-dfn-type="argument" data-export id="dom-identitycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-options"><code>options</code><a class="self-link" href="#dom-identitycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-options"></a></dfn>
+    <dd data-md>
+     <p>This argument is a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dictdef-credentialrequestoptions" id="ref-for-dictdef-credentialrequestoptions②">CredentialRequestOptions</a></code> object whose <code class="idl"><a data-link-type="idl" href="#dom-credentialrequestoptions-identity" id="ref-for-dom-credentialrequestoptions-identity">identity</a></code> member contains an <code class="idl"><a data-link-type="idl" href="#dictdef-identitycredentialrequestoptions" id="ref-for-dictdef-identitycredentialrequestoptions②">IdentityCredentialRequestOptions</a></code> object specifying the exchange options.</p>
+    <dt data-md><dfn class="idl-code" data-dfn-for="IdentityCredential/[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)" data-dfn-type="argument" data-export id="dom-identitycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-sameoriginwithancestors"><code>sameOriginWithAncestors</code><a class="self-link" href="#dom-identitycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-sameoriginwithancestors"></a></dfn>
     <dd data-md>
-     <p>A link to the <a data-link-type="dfn" href="#rp" id="ref-for-rp①⓪">RP</a>'s Terms of Service.</p>
-   </dl>
-   <p>For example:</p>
-   <div class="example" id="example-001e0b0d">
-    <a class="self-link" href="#example-001e0b0d"></a> 
-<pre class="language-json highlight"><c- p>{</c->
-  <c- f>"privacy_policy_url"</c-><c- p>:</c-> <c- u>"https://rp.example/clientmetadata/privacy_policy.html"</c-><c- p>,</c->
-  <c- f>"terms_of_service_url"</c-><c- p>:</c-> <c- u>"https://rp.example/clientmetadata/terms_of_service.html"</c->
-<c- p>}</c->
-</pre>
-   </div>
-   <h3 class="heading settled" data-level="2.5" id="idp-api-id-assertion-endpoint"><span class="secno">2.5. </span><span class="content">Identity Assertions</span><a class="self-link" href="#idp-api-id-assertion-endpoint"></a></h3>
-   <p>The identity assertion endpoint is responsible for minting a new token that contains signed assertions about the user.</p>
-   <p>The identity assertion endpoint is fetched</p>
-   <p>(a) as a <strong>POST</strong> request,
-(b) <strong>with</strong> <a data-link-type="dfn" href="#idp" id="ref-for-idp①⑦">IDP</a> cookies,
-(c) <strong>with</strong> the <a data-link-type="dfn" href="#rp" id="ref-for-rp①①">RP</a>'s origin in the <a data-link-type="http-header" href="https://fetch.spec.whatwg.org/#http-origin" id="ref-for-http-origin④">Origin</a> header, and
-(d) <strong>with</strong> the <a data-link-type="http-header" href="https://w3c.github.io/webappsec-fetch-metadata/#http-headerdef-sec-fetch-dest" id="ref-for-http-headerdef-sec-fetch-dest④">Sec-Fetch-Dest</a> header set to <code>webidentity</code>,
-(e) <strong>without</strong> following <a href="https://httpwg.org/specs/rfc9110.html#field.location">HTTP redirects</a>.</p>
-   <p>It will also contain the following parameters in the request body <code>application/x-www-form-urlencoded</code>:</p>
-   <dl>
-    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="id_assertion_endpoint_request" data-dfn-type="argument" data-export id="dom-id_assertion_endpoint_request-client_id"><code>client_id</code></dfn>
-    <dd data-md>
-     <p>The <a data-link-type="dfn" href="#rp" id="ref-for-rp①②">RP</a>'s unique identifier from the <a data-link-type="dfn" href="#idp" id="ref-for-idp①⑧">IDP</a></p>
-    <dt data-md><dfn class="idl-code" data-dfn-for="id_assertion_endpoint_request" data-dfn-type="argument" data-export id="dom-id_assertion_endpoint_request-nonce"><code>nonce</code><a class="self-link" href="#dom-id_assertion_endpoint_request-nonce"></a></dfn>
-    <dd data-md>
-     <p>The request nonce</p>
-    <dt data-md><dfn class="idl-code" data-dfn-for="id_assertion_endpoint_request" data-dfn-type="argument" data-export id="dom-id_assertion_endpoint_request-account_id"><code>account_id</code><a class="self-link" href="#dom-id_assertion_endpoint_request-account_id"></a></dfn>
-    <dd data-md>
-     <p>The account identifier that was selected.</p>
-    <dt data-md><dfn class="idl-code" data-dfn-for="id_assertion_endpoint_request" data-dfn-type="argument" data-export id="dom-id_assertion_endpoint_request-disclosure_text_shown"><code>disclosure_text_shown</code><a class="self-link" href="#dom-id_assertion_endpoint_request-disclosure_text_shown"></a></dfn>
-    <dd data-md>
-     <p>Whether the user agent has explicitly shown to the user what specific information the <a data-link-type="dfn" href="#idp" id="ref-for-idp①⑨">IDP</a> intends to share with the <a data-link-type="dfn" href="#rp" id="ref-for-rp①③">RP</a> (e.g. "idp.example will share your name, email...
-with rp.example"), used by the <a data-link-type="dfn" href="#request-permission-to-sign-up" id="ref-for-request-permission-to-sign-up①">request permission to sign-up</a> algorithm for new users but
-not by the <a data-link-type="dfn" href="#sign-in" id="ref-for-sign-in">sign-in</a> algorithm for returning users.</p>
-   </dl>
-   <p>For example:</p>
-   <div class="example" id="example-46007906">
-    <a class="self-link" href="#example-46007906"></a> 
-<pre class="language-http highlight"><c- nf>POST</c-> <c- nn>/fedcm_assertion_endpoint</c-> <c- kr>HTTP</c-><c- o>/</c-><c- m>1.1</c->
-<c- e>Host</c-><c- o>:</c-> <c- l>idp.example</c->
-<c- e>Origin</c-><c- o>:</c-> <c- l>https://rp.example/</c->
-<c- e>Content-Type</c-><c- o>:</c-> <c- l>application/x-www-form-urlencoded</c->
-<c- e>Cookie</c-><c- o>:</c-> <c- l>0x23223</c->
-<c- e>Sec-Fetch-Dest</c-><c- o>:</c-> <c- l>webidentity</c->
-account_id=123&amp;client_id=client1234&amp;nonce=Ct60bD&amp;disclosure_text_shown=true
-</pre>
-   </div>
-   <div class="idp-normative-text"> An <a data-link-type="dfn" href="#idp" id="ref-for-idp②⓪">IDP</a> MUST check the <a data-link-type="http-header" href="https://fetch.spec.whatwg.org/#http-origin" id="ref-for-http-origin⑤">Origin</a> header to ensure that a malicious <a data-link-type="dfn" href="#rp" id="ref-for-rp①④">RP</a> does
-not receive an ID token corresponding to another <a data-link-type="dfn" href="#rp" id="ref-for-rp①⑤">RP</a>. In other words, the <a data-link-type="dfn" href="#idp" id="ref-for-idp②①">IDP</a> MUST check that
-the <a data-link-type="http-header" href="https://fetch.spec.whatwg.org/#http-origin" id="ref-for-http-origin⑥">Origin</a> header value is represented by the <code class="idl"><a data-link-type="idl" href="#dom-identityproviderconfig-clientid" id="ref-for-dom-identityproviderconfig-clientid①">clientId</a></code>. As the <code class="idl"><a data-link-type="idl" href="#dom-identityproviderconfig-clientid" id="ref-for-dom-identityproviderconfig-clientid②">clientId</a></code> are <a data-link-type="dfn" href="#idp" id="ref-for-idp②②">IDP</a>-specific, the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#user-agent" id="ref-for-user-agent⑦">user agent</a> cannot perform this check. </div>
-   <p>The response body must be a JSON object that can be <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-convert-ecmascript-to-idl-value" id="ref-for-dfn-convert-ecmascript-to-idl-value③">converted</a> to an <code class="idl"><a data-link-type="idl" href="#dictdef-identityprovidertoken" id="ref-for-dictdef-identityprovidertoken">IdentityProviderToken</a></code> without an exception.</p>
-<pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-identityprovidertoken"><code><c- g>IdentityProviderToken</c-></code></dfn> {
-  <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString②⑨"><c- b>USVString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="USVString " href="#dom-identityprovidertoken-token" id="ref-for-dom-identityprovidertoken-token"><c- g>token</c-></a>;
-};
-</pre>
-   <p>Every <code class="idl"><a data-link-type="idl" href="#dictdef-identityprovidertoken" id="ref-for-dictdef-identityprovidertoken①">IdentityProviderToken</a></code> is expected to have members with the following semantics:</p>
-   <dl>
-    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderToken" data-dfn-type="dict-member" data-export id="dom-identityprovidertoken-token"><code>token</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString③⓪">USVString</a></span>
-    <dd data-md>
-     <p>The resulting token.</p>
-   </dl>
-   <p>The content of the <code class="idl"><a data-link-type="idl" href="#dom-identityprovidertoken-token" id="ref-for-dom-identityprovidertoken-token①">token</a></code> is opaque to the user agent and can contain
-anything that the <a data-link-type="dfn" href="#idp" id="ref-for-idp②③">IDP</a> would like to pass to the <a data-link-type="dfn" href="#rp" id="ref-for-rp①⑥">RP</a> to facilitate the login. For this reason the <a data-link-type="dfn" href="#rp" id="ref-for-rp①⑦">RP</a> is expected to be the party responsible for validating the <code class="idl"><a data-link-type="idl" href="#dom-identityprovidertoken-token" id="ref-for-dom-identityprovidertoken-token②">token</a></code> passed
-along from the <a data-link-type="dfn" href="#idp" id="ref-for-idp②④">IDP</a> using the appropriate token validation
-algorithms defined. One example of how this might be done is defined 
-in <a href="https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation">OIDC Connect Core § IDTokenValidation</a>.</p>
-   <p class="note" role="note"><span class="marker">NOTE:</span> For <a data-link-type="dfn" href="#idp" id="ref-for-idp②⑤">IDPs</a>, it is worth considering how <a href="https://github.com/fedidcg/FedCM/issues/314">portable</a> accounts are.
-Portability is left entirely up to <a data-link-type="dfn" href="#idp" id="ref-for-idp②⑥">IDPs</a>, who can choose
-between a variety of different mechanisms to accomplish it
-(e.g. <a href="https://openid.net/specs/openid-connect-account-porting-1_0.html">OIDC’s Account Porting</a>).</p>
-   <p>For example:</p>
-   <div class="example" id="example-9a912242">
-    <a class="self-link" href="#example-9a912242"></a> 
-<pre class="language-json highlight"><c- p>{</c->
-  <c- f>"token"</c-> <c- p>:</c-> <c- u>"eyJC...J9.eyJzdWTE2...MjM5MDIyfQ.SflV_adQssw....5c"</c->
-<c- p>}</c->
-</pre>
-   </div>
-   <h2 class="heading settled" data-level="3" id="browser-api"><span class="secno">3. </span><span class="content">The Browser API</span><a class="self-link" href="#browser-api"></a></h2>
-   <p>The Browser API exposes APIs to <a data-link-type="dfn" href="#rp" id="ref-for-rp①⑧">RP</a>s and <a data-link-type="dfn" href="#idp" id="ref-for-idp②⑦">IDP</a>s to call and intermediates
-the exchange of the user’s identity.</p>
-   <p>The Sign-up and Sign-in APIs are used by the <a data-link-type="dfn" href="#rp" id="ref-for-rp①⑨">RP</a>s to ask the browser
-to intermediate the relationship with the <a data-link-type="dfn" href="#idp" id="ref-for-idp②⑧">IDP</a> and the
-provisioning of a token.</p>
-   <p class="note" role="note"><span class="marker">NOTE:</span> The <a data-link-type="dfn" href="#rp" id="ref-for-rp②⓪">RP</a> makes no delineation between Sign-up and Sign-in, but
-rather calls the same API indistinguishably.</p>
-   <p>If all goes well, the Relying Party receives back an <code class="idl"><a data-link-type="idl" href="#identitycredential" id="ref-for-identitycredential">IdentityCredential</a></code> which contains a token it can use to authenticate the user.</p>
-   <div class="example" id="example-899750f6">
-    <a class="self-link" href="#example-899750f6"></a> 
-<pre class="language-js highlight"><c- a>const</c-> credential <c- o>=</c-> <c- k>await</c-> navigator<c- p>.</c->credentials<c- p>.</c->get<c- p>({</c->
-  identity<c- o>:</c-> <c- p>{</c->
-    providers<c- o>:</c-> <c- p>[{</c->
-      configURL<c- o>:</c-> <c- u>"https://idp.example/manifest.json"</c-><c- p>,</c->
-      clientId<c- o>:</c-> <c- u>"123"</c-><c- p>,</c->
-    <c- p>}]</c->
-  <c- p>}</c->
-<c- p>});</c->
-</pre>
-   </div>
-   <p>To do so, this specification does three things:</p>
-   <p>First, it introduces a new <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#credential" id="ref-for-credential">Credential</a></code> type, called <code class="idl"><a data-link-type="idl" href="#identitycredential" id="ref-for-identitycredential①">IdentityCredential</a></code>.</p>
-   <p>Second, it introduces an extension to <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dictdef-credentialrequestoptions" id="ref-for-dictdef-credentialrequestoptions">CredentialRequestOptions</a></code>.</p>
-   <p>Lastly, it overrides <code class="idl"><a data-link-type="idl" href="#identitycredential" id="ref-for-identitycredential②">IdentityCredential</a></code>'s implementation of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-discoverfromexternalsource-slot" id="ref-for-dom-credential-discoverfromexternalsource-slot">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code>.</p>
-   <p>For fetches that are sent with cookies we include unpartitioned cookies,
-as if the resource was loaded as a same-origin request, e.g.
-regardless of the <a href="https://httpwg.org/http-extensions/draft-ietf-httpbis-rfc6265bis.html#name-the-samesite-attribute-2">SameSite</a> value (which is used when a resource loaded as a third-party, not first-party). This makes it easy
-for an <a data-link-type="dfn" href="#idp" id="ref-for-idp②⑨">IDP</a> to adopt the FedCM API without introducing security issues on the API, since the <a data-link-type="dfn" href="#rp" id="ref-for-rp②①">RP</a> cannot inspect the results from the fetches in any way.</p>
-   <h3 class="heading settled" data-level="3.1" id="browser-api-state-machine"><span class="secno">3.1. </span><span class="content">The State Machine</span><a class="self-link" href="#browser-api-state-machine"></a></h3>
-   <p>Each <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#user-agent" id="ref-for-user-agent⑧">user agent</a> keeps track of a global <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="state-machine-map">state machine map</dfn>, an initially empty <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map">map</a>. The <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-getting-the-keys" id="ref-for-map-getting-the-keys">keys</a> in the <a data-link-type="dfn" href="#state-machine-map" id="ref-for-state-machine-map">state machine map</a> are triples of the form (<var>rp</var>, <var>idp</var>, <var>account</var>) where <var>rp</var> is
-the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin" id="ref-for-concept-origin">origin</a> of the <a data-link-type="dfn" href="#rp" id="ref-for-rp②②">RP</a>, <var>idp</var> is the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin" id="ref-for-concept-origin①">origin</a> of the <a data-link-type="dfn" href="#idp" id="ref-for-idp③⓪">IDP</a>, and <var>account</var> is a string representing
-an account identifier. The <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-getting-the-values" id="ref-for-map-getting-the-values">values</a> in the <a data-link-type="dfn" href="#state-machine-map" id="ref-for-state-machine-map①">state machine map</a> are <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="accountstate">AccountState</dfn> objects which have
-the following properties:</p>
-   <dl>
-    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AccountState" data-dfn-type="argument" data-export id="dom-accountstate-registration-state"><code>registration state</code></dfn>
-    <dd data-md>
-     <p>Keeps track of whether the user agent is aware that the user has registered an account on the <a data-link-type="dfn" href="#rp" id="ref-for-rp②③">RP</a> with the <a data-link-type="dfn" href="#idp" id="ref-for-idp③①">IDP</a> or not.
- Can be <dfn class="dfn-paneled idl-code" data-dfn-for="AccountState" data-dfn-type="argument" data-export id="dom-accountstate-registered"><code>registered</code></dfn> or <dfn class="dfn-paneled idl-code" data-dfn-for="AccountState" data-dfn-type="argument" data-export id="dom-accountstate-unregistered"><code>unregistered</code></dfn> (by default).</p>
-    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AccountState" data-dfn-type="argument" data-export id="dom-accountstate-allows-logout"><code>allows logout</code></dfn>
-    <dd data-md>
-     <p>Boolean which keeps track of whether the user agent would allow the <var>account</var> to be logged
-out via <code class="idl"><a data-link-type="idl">logoutRPs()</a></code>. It is initialized to false by default. Note that
-this value being true does not imply that the user is logged in to the <a data-link-type="dfn" href="#rp" id="ref-for-rp②④">RP</a> with the
-account, it merely implies that <code class="idl"><a data-link-type="idl">logoutRPs()</a></code> has not yet been called
-on this account after the last successful <code class="idl"><a data-link-type="idl" href="#identitycredential" id="ref-for-identitycredential③">IdentityCredential</a></code> creation with this account.</p>
-   </dl>
-   <p>TODO: add an ASCII image to explain how the states fit into the algorithms.</p>
-   <h3 class="heading settled" data-level="3.2" id="browser-api-identity-credential-interface"><span class="secno">3.2. </span><span class="content">The IdentityCredential Interface</span><a class="self-link" href="#browser-api-identity-credential-interface"></a></h3>
-   <p>This specification introduces a new type of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#credential" id="ref-for-credential①">Credential</a></code>, called an <code class="idl"><a data-link-type="idl" href="#identitycredential" id="ref-for-identitycredential④">IdentityCredential</a></code>:</p>
-<pre class="idl highlight def">[<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#Exposed" id="ref-for-Exposed"><c- g>Exposed</c-></a>=<c- n>Window</c->, <a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SecureContext" id="ref-for-SecureContext"><c- g>SecureContext</c-></a>]
-<c- b>interface</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="interface" data-export id="identitycredential"><code><c- g>IdentityCredential</c-></code></dfn> : <a data-link-type="idl-name" href="https://w3c.github.io/webappsec-credential-management/#credential" id="ref-for-credential②"><c- n>Credential</c-></a> {
-  <c- b>readonly</c-> <c- b>attribute</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString③①"><c- b>USVString</c-></a>? <dfn class="dfn-paneled idl-code" data-dfn-for="IdentityCredential" data-dfn-type="attribute" data-export data-readonly data-type="USVString?" id="dom-identitycredential-token"><code><c- g>token</c-></code></dfn>;
-};
-</pre>
-   <dl>
-    <dt data-md><b><code class="idl"><a data-link-type="idl" href="#dom-identitycredential-token" id="ref-for-dom-identitycredential-token">token</a></code></b>
-    <dd data-md>
-     <p>The <code class="idl"><a data-link-type="idl" href="#dom-identitycredential-token" id="ref-for-dom-identitycredential-token①">token</a></code>'s attribute getter returns the value it is set to.
-It represents the minted <code class="idl"><a data-link-type="idl" href="#dom-identityprovidertoken-token" id="ref-for-dom-identityprovidertoken-token③">token</a></code> provided by the <a data-link-type="dfn" href="#idp" id="ref-for-idp③②">IDP</a>.</p>
-   </dl>
-   <p>The main entrypoint in this specification is through the entrypoints exposed
-by the <a data-link-type="biblio" href="https://w3c.github.io/webappsec-credential-management/"><cite>Credential Management</cite></a> API.</p>
-   <h3 class="heading settled" data-level="3.3" id="browser-api-credential-request-options"><span class="secno">3.3. </span><span class="content">The CredentialRequestOptions</span><a class="self-link" href="#browser-api-credential-request-options"></a></h3>
-   <p>This specification starts by introducing an extension to the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dictdef-credentialrequestoptions" id="ref-for-dictdef-credentialrequestoptions①">CredentialRequestOptions</a></code> object:</p>
-<pre class="idl highlight def"><c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="https://w3c.github.io/webappsec-credential-management/#dictdef-credentialrequestoptions" id="ref-for-dictdef-credentialrequestoptions②"><c- g>CredentialRequestOptions</c-></a> {
-  <a data-link-type="idl-name" href="#dictdef-identitycredentialrequestoptions" id="ref-for-dictdef-identitycredentialrequestoptions"><c- n>IdentityCredentialRequestOptions</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="CredentialRequestOptions" data-dfn-type="dict-member" data-export data-type="IdentityCredentialRequestOptions " id="dom-credentialrequestoptions-identity"><code><c- g>identity</c-></code></dfn>;
-};
-</pre>
-   <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-identitycredentialrequestoptions" id="ref-for-dictdef-identitycredentialrequestoptions①">IdentityCredentialRequestOptions</a></code> contains a list of <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderconfig" id="ref-for-dictdef-identityproviderconfig">IdentityProviderConfig</a></code>s that the <a data-link-type="dfn" href="#rp" id="ref-for-rp②⑤">RP</a> supports and has
-pre-registered with (i.e. it has a <code>clientId</code>).</p>
-<pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-identitycredentialrequestoptions"><code><c- g>IdentityCredentialRequestOptions</c-></code></dfn> {
-  <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence④"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#dictdef-identityproviderconfig" id="ref-for-dictdef-identityproviderconfig①"><c- n>IdentityProviderConfig</c-></a>> <dfn class="dfn-paneled idl-code" data-dfn-for="IdentityCredentialRequestOptions" data-dfn-type="dict-member" data-export data-type="sequence<IdentityProviderConfig> " id="dom-identitycredentialrequestoptions-providers"><code><c- g>providers</c-></code></dfn>;
-};
-</pre>
-   <p>Each <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderconfig" id="ref-for-dictdef-identityproviderconfig②">IdentityProviderConfig</a></code> represents an <a data-link-type="dfn" href="#idp" id="ref-for-idp③③">IDP</a> that
-the <a data-link-type="dfn" href="#rp" id="ref-for-rp②⑥">RP</a> supports (e.g. that it has a pre-registration agreement with).</p>
-<pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-identityproviderconfig"><code><c- g>IdentityProviderConfig</c-></code></dfn> {
-  <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString③②"><c- b>USVString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderConfig" data-dfn-type="dict-member" data-export data-type="USVString " id="dom-identityproviderconfig-configurl"><code><c- g>configURL</c-></code></dfn>;
-  <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString③③"><c- b>USVString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderConfig" data-dfn-type="dict-member" data-export data-type="USVString " id="dom-identityproviderconfig-clientid"><code><c- g>clientId</c-></code></dfn>;
-  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString③④"><c- b>USVString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderConfig" data-dfn-type="dict-member" data-export data-type="USVString " id="dom-identityproviderconfig-nonce"><code><c- g>nonce</c-></code></dfn>;
-};
-</pre>
-   <dl>
-    <dt data-md><b><code class="idl"><a data-link-type="idl" href="#dom-identityproviderconfig-configurl" id="ref-for-dom-identityproviderconfig-configurl">configURL</a></code></b>
-    <dd data-md>
-     <p>The URL of the configuration file for the identity provider.</p>
-    <dt data-md><b><code class="idl"><a data-link-type="idl" href="#dom-identityproviderconfig-clientid" id="ref-for-dom-identityproviderconfig-clientid③">clientId</a></code></b>
-    <dd data-md>
-     <p>The <code class="idl"><a data-link-type="idl" href="#dom-id_assertion_endpoint_request-client_id" id="ref-for-dom-id_assertion_endpoint_request-client_id">client_id</a></code> provided to the <a data-link-type="dfn" href="#rp" id="ref-for-rp②⑦">RP</a> out of band by the <a data-link-type="dfn" href="#idp" id="ref-for-idp③④">IDP</a></p>
-    <dt data-md><b><code class="idl"><a data-link-type="idl" href="#dom-identityproviderconfig-nonce" id="ref-for-dom-identityproviderconfig-nonce">nonce</a></code></b>
-    <dd data-md>
-     <p>A random number of the choice of the <a data-link-type="dfn" href="#rp" id="ref-for-rp②⑧">RP</a>. It is generally used to associate a client
-session with a <code class="idl"><a data-link-type="idl" href="#dom-identityprovidertoken-token" id="ref-for-dom-identityprovidertoken-token④">token</a></code> and to mitigate replay attacks. Therefore, this value should have
-sufficient entropy such that it would be hard to guess.</p>
-   </dl>
-   <h3 class="heading settled" data-level="3.4" id="browser-api-rp-sign-in"><span class="secno">3.4. </span><span class="content">The <code>[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</code> internal method</span><a class="self-link" href="#browser-api-rp-sign-in"></a></h3>
-   <p>The <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-discoverfromexternalsource-slot" id="ref-for-dom-credential-discoverfromexternalsource-slot①">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> algorithm runs in parallel inside the <a href="https://w3c.github.io/webappsec-credential-management/#algorithm-request">Credential Management § algorithm-request</a> to request credentials and returns a
-set of <code class="idl"><a data-link-type="idl" href="#identitycredential" id="ref-for-identitycredential⑤">IdentityCredential</a></code> for the requested <a data-link-type="dfn" href="#idp" id="ref-for-idp③⑤">IDP</a>s.</p>
-   <p>This <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-ordinary-object-internal-methods-and-internal-slots" id="ref-for-sec-ordinary-object-internal-methods-and-internal-slots">internal method</a> accepts three arguments:</p>
-   <dl>
-    <dt data-md><dfn class="idl-code" data-dfn-for="IdentityCredential/[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)" data-dfn-type="argument" data-export id="dom-identitycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-origin"><code>origin</code><a class="self-link" href="#dom-identitycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-origin"></a></dfn>
-    <dd data-md>
-     <p>This argument is the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#relevant-settings-object" id="ref-for-relevant-settings-object">relevant settings object</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin" id="ref-for-concept-settings-object-origin">origin</a>, as determined by the
- calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get">get()</a></code> implementation, i.e., <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#credentialscontainer" id="ref-for-credentialscontainer">CredentialsContainer</a></code>'s <a data-link-type="abstract-op" href="https://w3c.github.io/webappsec-credential-management/#abstract-opdef-request-a-credential" id="ref-for-abstract-opdef-request-a-credential">Request a <code>Credential</code></a> abstract operation.</p>
-    <dt data-md><dfn class="idl-code" data-dfn-for="IdentityCredential/[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)" data-dfn-type="argument" data-export id="dom-identitycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-options"><code>options</code><a class="self-link" href="#dom-identitycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-options"></a></dfn>
-    <dd data-md>
-     <p>This argument is a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dictdef-credentialrequestoptions" id="ref-for-dictdef-credentialrequestoptions③">CredentialRequestOptions</a></code> object whose <code class="idl"><a data-link-type="idl" href="#dom-credentialrequestoptions-identity" id="ref-for-dom-credentialrequestoptions-identity">identity</a></code> member contains an <code class="idl"><a data-link-type="idl" href="#dictdef-identitycredentialrequestoptions" id="ref-for-dictdef-identitycredentialrequestoptions②">IdentityCredentialRequestOptions</a></code> object specifying the exchange options.</p>
-    <dt data-md><dfn class="idl-code" data-dfn-for="IdentityCredential/[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)" data-dfn-type="argument" data-export id="dom-identitycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-sameoriginwithancestors"><code>sameOriginWithAncestors</code><a class="self-link" href="#dom-identitycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-sameoriginwithancestors"></a></dfn>
-    <dd data-md>
-     <p>This argument is a Boolean value which is <code>true</code> if and only if the
- caller’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#environment-settings-object" id="ref-for-environment-settings-object">environment settings object</a> is <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors" id="ref-for-same-origin-with-its-ancestors">same-origin with its ancestors</a>. It is <code>false</code> if caller is cross-origin.</p>
-     <p class="note" role="note"><span class="marker">Note:</span> Invocation of this <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-ordinary-object-internal-methods-and-internal-slots" id="ref-for-sec-ordinary-object-internal-methods-and-internal-slots①">internal method</a> indicates that it was allowed by <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy" id="ref-for-concept-document-permissions-policy">permissions policy</a>, which is evaluated at the <a data-link-type="biblio" href="https://w3c.github.io/webappsec-credential-management/"><cite>Credential Management Level 1</cite></a> level.
-See <a href="#permissions-policy-integration">§ 4 Permissions Policy Integration</a>. As such, <var>sameOriginWithAncestors</var> is unused.</p>
+     <p>This argument is a Boolean value which is <code>true</code> if and only if the
+ caller’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#environment-settings-object" id="ref-for-environment-settings-object">environment settings object</a> is <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors" id="ref-for-same-origin-with-its-ancestors">same-origin with its ancestors</a>. It is <code>false</code> if caller is cross-origin.</p>
+     <p class="note" role="note"><span class="marker">Note:</span> Invocation of this <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-ordinary-object-internal-methods-and-internal-slots" id="ref-for-sec-ordinary-object-internal-methods-and-internal-slots①">internal method</a> indicates that it was allowed by <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy" id="ref-for-concept-document-permissions-policy">permissions policy</a>, which is evaluated at the <a data-link-type="biblio" href="https://w3c.github.io/webappsec-credential-management/"><cite>Credential Management Level 1</cite></a> level.
+See <a href="#permissions-policy-integration">§ 4 Permissions Policy Integration</a>. As such, <var>sameOriginWithAncestors</var> is unused.</p>
    </dl>
    <p class="note" role="note"><span class="marker">NOTE:</span> The <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-mediation" id="ref-for-dom-credentialrequestoptions-mediation">mediation</a></code> flag is currently not used.</p>
    <p>The <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-signal" id="ref-for-dom-credentialrequestoptions-signal">signal</a></code> is used as an abort signal for the
 requests.</p>
    <div class="algorithm" data-algorithm="[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)" data-algorithm-for="IdentityCredential">
-     When the <code class="idl"><a data-link-type="idl" href="#identitycredential" id="ref-for-identitycredential⑥">IdentityCredential</a></code>'s <dfn class="idl-code" data-dfn-for="IdentityCredential" data-dfn-type="method" data-export id="dom-identitycredential-discoverfromexternalsource-slot"><code>[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</code><a class="self-link" href="#dom-identitycredential-discoverfromexternalsource-slot"></a></dfn> algorithm is invoked, the user agent MUST execute the following steps. This returns an <code class="idl"><a data-link-type="idl" href="#identitycredential" id="ref-for-identitycredential⑦">IdentityCredential</a></code> (or throws an error to the caller). 
+     When the <code class="idl"><a data-link-type="idl" href="#identitycredential" id="ref-for-identitycredential④">IdentityCredential</a></code>'s <dfn class="idl-code" data-dfn-for="IdentityCredential" data-dfn-type="method" data-export id="dom-identitycredential-discoverfromexternalsource-slot"><code>[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</code><a class="self-link" href="#dom-identitycredential-discoverfromexternalsource-slot"></a></dfn> algorithm is invoked, the user agent MUST execute the following steps. This returns an <code class="idl"><a data-link-type="idl" href="#identitycredential" id="ref-for-identitycredential⑤">IdentityCredential</a></code> (or throws an error to the caller). 
     <ol>
      <li data-md>
       <p class="assertion">Assert: These steps are running <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/infrastructure.html#in-parallel" id="ref-for-in-parallel">in parallel</a>.</p>
@@ -1381,24 +1059,24 @@ <h3 class="heading settled" data-level="3.4" id="browser-api-rp-sign-in"><span c
       <p class="assertion">Assert: <var>options</var>["<code class="idl"><a data-link-type="idl" href="#dom-credentialrequestoptions-identity" id="ref-for-dom-credentialrequestoptions-identity①">identity</a></code>"]["<code class="idl"><a data-link-type="idl" href="#dom-identitycredentialrequestoptions-providers" id="ref-for-dom-identitycredentialrequestoptions-providers">providers</a></code>"] <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists">exists</a>.</p>
      <li data-md>
       <p class="assertion">Assert: <var>options</var>["<code class="idl"><a data-link-type="idl" href="#dom-credentialrequestoptions-identity" id="ref-for-dom-credentialrequestoptions-identity②">identity</a></code>"]["<code class="idl"><a data-link-type="idl" href="#dom-identitycredentialrequestoptions-providers" id="ref-for-dom-identitycredentialrequestoptions-providers①">providers</a></code>"] <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-size" id="ref-for-list-size">size</a> is 1.</p>
-      <p class="issue" id="issue-ade48fb1"><a class="self-link" href="#issue-ade48fb1"></a> Support choosing accounts from multiple <a data-link-type="dfn" href="#idp" id="ref-for-idp③⑥">IDP</a>s, as described <a href="https://github.com/fedidcg/FedCM/issues/319">here</a>.</p>
+      <p class="issue" id="issue-ade48fb1"><a class="self-link" href="#issue-ade48fb1"></a> Support choosing accounts from multiple <a data-link-type="dfn" href="#idp" id="ref-for-idp①④">IDP</a>s, as described <a href="https://github.com/fedidcg/FedCM/issues/319">here</a>.</p>
      <li data-md>
       <p>Run <code class="idl"><a data-link-type="idl" href="https://html.spec.whatwg.org/multipage/timers-and-user-prompts.html#dom-settimeout" id="ref-for-dom-settimeout">setTimeout()</a></code> passing a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-task" id="ref-for-concept-task">task</a> which throws a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#networkerror" id="ref-for-networkerror">NetworkError</a></code>, after a timeout of 60 seconds.</p>
       <p class="issue" id="issue-adfae20a"><a class="self-link" href="#issue-adfae20a"></a> Do not use <code class="idl"><a data-link-type="idl" href="https://html.spec.whatwg.org/multipage/timers-and-user-prompts.html#dom-settimeout" id="ref-for-dom-settimeout①">setTimeout()</a></code> directly, as that is not correct. See the relevant <a href="https://github.com/fedidcg/FedCM/issues/389">issue</a>.</p>
       <p class="note" role="note"><span class="marker">Note:</span> the purpose of having a timer here is to avoid leaking the reason causing this
 method to throw an error. If there was no such timer, the developer could easily infer
-whether the user has an account with the <a data-link-type="dfn" href="#idp" id="ref-for-idp③⑦">IDP</a> or not, or whether the user closed the UI without granting permission to share the <a data-link-type="dfn" href="#idp" id="ref-for-idp③⑧">IDP</a> account information with the <a data-link-type="dfn" href="#rp" id="ref-for-rp②⑨">RP</a>.</p>
+whether the user has an account with the <a data-link-type="dfn" href="#idp" id="ref-for-idp①⑤">IDP</a> or not, or whether the user closed the UI without granting permission to share the <a data-link-type="dfn" href="#idp" id="ref-for-idp①⑥">IDP</a> account information with the <a data-link-type="dfn" href="#rp" id="ref-for-rp①④">RP</a>.</p>
      <li data-md>
       <p>Let <var>provider</var> be <var>options</var>["<code class="idl"><a data-link-type="idl" href="#dom-credentialrequestoptions-identity" id="ref-for-dom-credentialrequestoptions-identity③">identity</a></code>"]["<code class="idl"><a data-link-type="idl" href="#dom-identitycredentialrequestoptions-providers" id="ref-for-dom-identitycredentialrequestoptions-providers②">providers</a></code>"][0].</p>
      <li data-md>
       <p>Let <var>credential</var> be the result of running <a data-link-type="dfn" href="#create-an-identitycredential" id="ref-for-create-an-identitycredential">create an IdentityCredential</a> with <var>provider</var> and <var>globalObject</var>.</p>
-      <p class="note" role="note"><span class="marker">Note:</span> The <var>globalObject</var> is not currently passed onto the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-discoverfromexternalsource-slot" id="ref-for-dom-credential-discoverfromexternalsource-slot②">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> algorithm. See <a href="https://github.com/w3c/webappsec-credential-management/issues/210">issue</a>.</p>
+      <p class="note" role="note"><span class="marker">Note:</span> The <var>globalObject</var> is not currently passed onto the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-discoverfromexternalsource-slot" id="ref-for-dom-credential-discoverfromexternalsource-slot①">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> algorithm. See <a href="https://github.com/w3c/webappsec-credential-management/issues/210">issue</a>.</p>
      <li data-md>
       <p>If <var>credential</var> is failure, <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#queue-a-global-task" id="ref-for-queue-a-global-task">queue a global task</a> on the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#dom-manipulation-task-source" id="ref-for-dom-manipulation-task-source">DOM manipulation task source</a> to throw a new "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#networkerror" id="ref-for-networkerror①">NetworkError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException">DOMException</a></code>.</p>
     </ol>
    </div>
    <div class="algorithm" data-algorithm="create an IdentityCredential">
-     To <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="create-an-identitycredential">create an IdentityCredential</dfn> given an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderconfig" id="ref-for-dictdef-identityproviderconfig③">IdentityProviderConfig</a></code> <var>provider</var> and a <var>globalObject</var>, run the following steps. This returns an <code class="idl"><a data-link-type="idl" href="#identitycredential" id="ref-for-identitycredential⑧">IdentityCredential</a></code> or
+     To <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="create-an-identitycredential">create an IdentityCredential</dfn> given an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderconfig" id="ref-for-dictdef-identityproviderconfig④">IdentityProviderConfig</a></code> <var>provider</var> and a <var>globalObject</var>, run the following steps. This returns an <code class="idl"><a data-link-type="idl" href="#identitycredential" id="ref-for-identitycredential⑥">IdentityCredential</a></code> or
 failure. 
     <ol>
      <li data-md>
@@ -1414,10 +1092,10 @@ <h3 class="heading settled" data-level="3.4" id="browser-api-rp-sign-in"><span c
       <p>For each <var>account</var> in <var>accountsList</var>:</p>
       <ol>
        <li data-md>
-        <p>If <var>account</var>["<code class="idl"><a data-link-type="idl" href="#dom-identityprovideraccount-picture" id="ref-for-dom-identityprovideraccount-picture①">picture</a></code>"] is present, <a data-link-type="dfn" href="#fetch-the-account-picture" id="ref-for-fetch-the-account-picture">fetch the account picture</a> with <var>account</var> and <var>globalObject</var>.</p>
+        <p>If <var>account</var>["<code class="idl"><a data-link-type="idl" href="#dom-identityprovideraccount-picture" id="ref-for-dom-identityprovideraccount-picture">picture</a></code>"] is present, <a data-link-type="dfn" href="#fetch-the-account-picture" id="ref-for-fetch-the-account-picture">fetch the account picture</a> with <var>account</var> and <var>globalObject</var>.</p>
       </ol>
-      <p class="note" role="note"><span class="marker">Note:</span> The <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#user-agent" id="ref-for-user-agent⑨">user agent</a> may choose to show UI which does not initially require fetching the
-account pictures. In these cases, the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#user-agent" id="ref-for-user-agent①⓪">user agent</a> may delay these fetches until they are
+      <p class="note" role="note"><span class="marker">Note:</span> The <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#user-agent" id="ref-for-user-agent③">user agent</a> may choose to show UI which does not initially require fetching the
+account pictures. In these cases, the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#user-agent" id="ref-for-user-agent④">user agent</a> may delay these fetches until they are
 needed.</p>
      <li data-md>
       <p>If <var>accountsList</var>’s size is 1:</p>
@@ -1428,14 +1106,14 @@ <h3 class="heading settled" data-level="3.4" id="browser-api-rp-sign-in"><span c
         <p>Let <var>accountState</var> be the result of running the <a data-link-type="dfn" href="#compute-account-state" id="ref-for-compute-account-state">compute account state</a> algorithm
 given <var>provider</var>, <var>account</var>, and <var>globalObject</var>.</p>
        <li data-md>
-        <p>If <var>accountState</var>’s <code class="idl"><a data-link-type="idl" href="#dom-accountstate-registration-state" id="ref-for-dom-accountstate-registration-state">registration state</a></code> is <code class="idl"><a data-link-type="idl" href="#dom-accountstate-unregistered" id="ref-for-dom-accountstate-unregistered">unregistered</a></code>,
-let <var>permission</var> be the result of running <a data-link-type="dfn" href="#request-permission-to-sign-up" id="ref-for-request-permission-to-sign-up②">request permission to sign-up</a> algorithm
+        <p>If <var>accountState</var>’s <code class="idl"><a data-link-type="idl" href="#dom-accountstate-registration-state" id="ref-for-dom-accountstate-registration-state①">registration state</a></code> is <code class="idl"><a data-link-type="idl" href="#dom-accountstate-unregistered" id="ref-for-dom-accountstate-unregistered">unregistered</a></code>,
+let <var>permission</var> be the result of running <a data-link-type="dfn" href="#request-permission-to-sign-up" id="ref-for-request-permission-to-sign-up">request permission to sign-up</a> algorithm
 with <var>account</var>, <var>accountState</var>, <var>config</var>, <var>provider</var>, and <var>globalObject</var>.</p>
        <li data-md>
         <p>Otherwise, show a dialog to request user permission to sign in via <var>account</var>, and set the
 result in <var>permission</var>.</p>
        <li data-md>
-        <p>If <var>permission</var>, <a data-link-type="dfn" href="#sign-in" id="ref-for-sign-in①">sign-in</a> with <var>accountState</var>.</p>
+        <p>If <var>permission</var>, <a data-link-type="dfn" href="#sign-in" id="ref-for-sign-in">sign-in</a> with <var>accountState</var>.</p>
       </ol>
      <li data-md>
       <p>Otherwise:</p>
@@ -1448,20 +1126,20 @@ <h3 class="heading settled" data-level="3.4" id="browser-api-rp-sign-in"><span c
         <p>Let <var>accountState</var> be the result of running the <a data-link-type="dfn" href="#compute-account-state" id="ref-for-compute-account-state①">compute account state</a> algorithm
 given <var>provider</var> and <var>account</var>.</p>
        <li data-md>
-        <p>If <var>accountState</var>’s <code class="idl"><a data-link-type="idl" href="#dom-accountstate-registration-state" id="ref-for-dom-accountstate-registration-state①">registration state</a></code> is <code class="idl"><a data-link-type="idl" href="#dom-accountstate-unregistered" id="ref-for-dom-accountstate-unregistered①">unregistered</a></code>:</p>
+        <p>If <var>accountState</var>’s <code class="idl"><a data-link-type="idl" href="#dom-accountstate-registration-state" id="ref-for-dom-accountstate-registration-state②">registration state</a></code> is <code class="idl"><a data-link-type="idl" href="#dom-accountstate-unregistered" id="ref-for-dom-accountstate-unregistered①">unregistered</a></code>:</p>
         <ol>
          <li data-md>
-          <p>Let <var>permission</var> be the result of running the <a data-link-type="dfn" href="#request-permission-to-sign-up" id="ref-for-request-permission-to-sign-up③">request permission to sign-up</a> algorithm with <var>account</var>, <var>accountState</var>, <var>config</var>, <var>provider</var>, and <var>globalObject</var>.</p>
+          <p>Let <var>permission</var> be the result of running the <a data-link-type="dfn" href="#request-permission-to-sign-up" id="ref-for-request-permission-to-sign-up①">request permission to sign-up</a> algorithm with <var>account</var>, <var>accountState</var>, <var>config</var>, <var>provider</var>, and <var>globalObject</var>.</p>
          <li data-md>
-          <p>If <var>permission</var>, <a data-link-type="dfn" href="#sign-in" id="ref-for-sign-in②">sign-in</a> with <var>accountState</var>.</p>
+          <p>If <var>permission</var>, <a data-link-type="dfn" href="#sign-in" id="ref-for-sign-in①">sign-in</a> with <var>accountState</var>.</p>
         </ol>
        <li data-md>
-        <p>Otherwise, <a data-link-type="dfn" href="#sign-in" id="ref-for-sign-in③">sign-in</a> with <var>accountState</var>.</p>
+        <p>Otherwise, <a data-link-type="dfn" href="#sign-in" id="ref-for-sign-in②">sign-in</a> with <var>accountState</var>.</p>
       </ol>
      <li data-md>
-      <p>Wait until the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#user-agent" id="ref-for-user-agent①①">user agent</a>'s dialog is closed.</p>
+      <p>Wait until the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#user-agent" id="ref-for-user-agent⑤">user agent</a>'s dialog is closed.</p>
      <li data-md>
-      <p>If <var>accountState</var>’s <code class="idl"><a data-link-type="idl" href="#dom-accountstate-registration-state" id="ref-for-dom-accountstate-registration-state②">registration state</a></code> is <code class="idl"><a data-link-type="idl" href="#dom-accountstate-unregistered" id="ref-for-dom-accountstate-unregistered②">unregistered</a></code> then return
+      <p>If <var>accountState</var>’s <code class="idl"><a data-link-type="idl" href="#dom-accountstate-registration-state" id="ref-for-dom-accountstate-registration-state③">registration state</a></code> is <code class="idl"><a data-link-type="idl" href="#dom-accountstate-unregistered" id="ref-for-dom-accountstate-unregistered②">unregistered</a></code> then return
 failure.</p>
      <li data-md>
       <p>Let <var>credential</var> be the result of running the <a data-link-type="dfn" href="#fetch-an-identity-assertion" id="ref-for-fetch-an-identity-assertion">fetch an identity assertion</a> algorithm with <var>accountState</var>, <var>account</var>’s <code class="idl"><a data-link-type="idl" href="#dom-identityprovideraccount-id" id="ref-for-dom-identityprovideraccount-id①">id</a></code>, <var>provider</var>, <var>config</var>, and <var>globalObject</var>.</p>
@@ -1470,7 +1148,7 @@ <h3 class="heading settled" data-level="3.4" id="browser-api-rp-sign-in"><span c
     </ol>
    </div>
    <div class="algorithm" data-algorithm="parse url">
-     To <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="parse-url">parse url</dfn> given a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString③⑤">USVString</a></code> <var>stringUrl</var>, a <var>globalObject</var>, and an optional <var>baseUrl</var> (default null), run the following steps. This returns a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url" id="ref-for-concept-url">URL</a> or failure. 
+     To <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="parse-url">parse url</dfn> given a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString④">USVString</a></code> <var>stringUrl</var>, a <var>globalObject</var>, and an optional <var>baseUrl</var> (default null), run the following steps. This returns a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url" id="ref-for-concept-url">URL</a> or failure. 
     <ol>
      <li data-md>
       <p>Let <var>configUrl</var> be null.</p>
@@ -1496,10 +1174,10 @@ <h3 class="heading settled" data-level="3.4" id="browser-api-rp-sign-in"><span c
     <p class="note" role="note"><span class="marker">Note:</span> We queue a task since the <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-fetch" id="ref-for-concept-fetch①">fetch</a> needs to be run within a task, not <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/infrastructure.html#in-parallel" id="ref-for-in-parallel③">in parallel</a>.</p>
    </div>
    <div class="algorithm" data-algorithm="fetch the config file">
-     To <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="fetch-the-config-file">fetch the config file</dfn> given an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderconfig" id="ref-for-dictdef-identityproviderconfig④">IdentityProviderConfig</a></code> <var>provider</var> and <var>globalObject</var>, run the following steps. This returns an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderapiconfig" id="ref-for-dictdef-identityproviderapiconfig②">IdentityProviderAPIConfig</a></code>. 
+     To <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="fetch-the-config-file">fetch the config file</dfn> given an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderconfig" id="ref-for-dictdef-identityproviderconfig⑤">IdentityProviderConfig</a></code> <var>provider</var> and <var>globalObject</var>, run the following steps. This returns an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderapiconfig" id="ref-for-dictdef-identityproviderapiconfig">IdentityProviderAPIConfig</a></code>. 
     <ol>
      <li data-md>
-      <p>Let <var>configUrl</var> be the result of running <a data-link-type="dfn" href="#parse-url" id="ref-for-parse-url">parse url</a> with <var>provider</var>’s <code class="idl"><a data-link-type="idl" href="#dom-identityproviderconfig-configurl" id="ref-for-dom-identityproviderconfig-configurl①">configURL</a></code> and <var>globalObject</var>.</p>
+      <p>Let <var>configUrl</var> be the result of running <a data-link-type="dfn" href="#parse-url" id="ref-for-parse-url①">parse url</a> with <var>provider</var>’s <code class="idl"><a data-link-type="idl" href="#dom-identityproviderconfig-configurl" id="ref-for-dom-identityproviderconfig-configurl②">configURL</a></code> and <var>globalObject</var>.</p>
      <li data-md>
       <p>If <var>configUrl</var> is failure, return failure.</p>
      <li data-md>
@@ -1512,7 +1190,7 @@ <h3 class="heading settled" data-level="3.4" id="browser-api-rp-sign-in"><span c
      <li data-md>
       <p>Set <var>rootUrl</var>’s <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-scheme" id="ref-for-concept-url-scheme">scheme</a> to <var>configUrl</var>’s <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-scheme" id="ref-for-concept-url-scheme①">scheme</a>.</p>
      <li data-md>
-      <p>Set <var>rootUrl</var>’s <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-host" id="ref-for-concept-url-host">host</a> to <var>configUrl</var>’s <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-host" id="ref-for-concept-url-host①">host</a>'s <a data-link-type="dfn" href="https://url.spec.whatwg.org/#host-registrable-domain" id="ref-for-host-registrable-domain①">registrable domain</a>.</p>
+      <p>Set <var>rootUrl</var>’s <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-host" id="ref-for-concept-url-host">host</a> to <var>configUrl</var>’s <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-host" id="ref-for-concept-url-host①">host</a>'s <a data-link-type="dfn" href="https://url.spec.whatwg.org/#host-registrable-domain" id="ref-for-host-registrable-domain">registrable domain</a>.</p>
      <li data-md>
       <p>Set <var>rootUrl</var>’s <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-path" id="ref-for-concept-url-path">path</a> to the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list" id="ref-for-list">list</a> «".well-known", "web-identity"».</p>
      <li data-md>
@@ -1558,14 +1236,14 @@ <h3 class="heading settled" data-level="3.4" id="browser-api-rp-sign-in"><span c
        <li data-md>
         <p>Let <var>json</var> be the result of <a data-link-type="dfn" href="#extract-the-json-fetch-response" id="ref-for-extract-the-json-fetch-response">extract the JSON fetch response</a> from <var>response</var> and <var>responseBody</var>.</p>
        <li data-md>
-        <p><a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-convert-ecmascript-to-idl-value" id="ref-for-dfn-convert-ecmascript-to-idl-value④">Convert</a> <var>json</var> to an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderwellknown" id="ref-for-dictdef-identityproviderwellknown①">IdentityProviderWellKnown</a></code>, <var>discovery</var>.</p>
+        <p><a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-convert-ecmascript-to-idl-value" id="ref-for-dfn-convert-ecmascript-to-idl-value">Convert</a> <var>json</var> to an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderwellknown" id="ref-for-dictdef-identityproviderwellknown">IdentityProviderWellKnown</a></code>, <var>discovery</var>.</p>
        <li data-md>
         <p>If the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-size" id="ref-for-list-size①">size</a> of <var>discovery</var>["<code class="idl"><a data-link-type="idl" href="#dom-identityproviderwellknown-provider_urls" id="ref-for-dom-identityproviderwellknown-provider_urls">provider_urls</a></code>"]
 is greater than 1, set <var>config</var> to failure.</p>
         <p class="issue" id="issue-80d5b61c"><a class="self-link" href="#issue-80d5b61c"></a> <a href="https://github.com/fedidcg/FedCM/issues/333">relax</a> the size of the
 provider_urls array.</p>
        <li data-md>
-        <p>If <var>discovery</var>["<code class="idl"><a data-link-type="idl" href="#dom-identityproviderwellknown-provider_urls" id="ref-for-dom-identityproviderwellknown-provider_urls①">provider_urls</a></code>"][0] <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#string-is" id="ref-for-string-is">is</a> NOT equal to <var>provider</var>’s <code class="idl"><a data-link-type="idl" href="#dom-identityproviderconfig-configurl" id="ref-for-dom-identityproviderconfig-configurl②">configURL</a></code>, set <var>config</var> to failure.</p>
+        <p>If <var>discovery</var>["<code class="idl"><a data-link-type="idl" href="#dom-identityproviderwellknown-provider_urls" id="ref-for-dom-identityproviderwellknown-provider_urls①">provider_urls</a></code>"][0] <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#string-is" id="ref-for-string-is">is</a> NOT equal to <var>provider</var>’s <code class="idl"><a data-link-type="idl" href="#dom-identityproviderconfig-configurl" id="ref-for-dom-identityproviderconfig-configurl③">configURL</a></code>, set <var>config</var> to failure.</p>
       </ol>
      <li data-md>
       <p>Let <var>configRequest</var> be a new <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request" id="ref-for-concept-request③">request</a> as follows:</p>
@@ -1607,7 +1285,7 @@ <h3 class="heading settled" data-level="3.4" id="browser-api-rp-sign-in"><span c
        <li data-md>
         <p>Let <var>json</var> be the result of <a data-link-type="dfn" href="#extract-the-json-fetch-response" id="ref-for-extract-the-json-fetch-response①">extract the JSON fetch response</a> from <var>response</var> and <var>responseBody</var>.</p>
        <li data-md>
-        <p><a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-convert-ecmascript-to-idl-value" id="ref-for-dfn-convert-ecmascript-to-idl-value⑤">Convert</a> <var>json</var> to an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderapiconfig" id="ref-for-dictdef-identityproviderapiconfig③">IdentityProviderAPIConfig</a></code> stored
+        <p><a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-convert-ecmascript-to-idl-value" id="ref-for-dfn-convert-ecmascript-to-idl-value①">Convert</a> <var>json</var> to an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderapiconfig" id="ref-for-dictdef-identityproviderapiconfig①">IdentityProviderAPIConfig</a></code> stored
 in <var>config</var>, unless <var>config</var> has been set to failure.</p>
       </ol>
      <li data-md>
@@ -1616,12 +1294,34 @@ <h3 class="heading settled" data-level="3.4" id="browser-api-rp-sign-in"><span c
       <p>Return <var>config</var>.</p>
     </ol>
    </div>
-   <p class="note" role="note"><span class="marker">NOTE:</span> We use a two-tier file system in order to prevent the <a data-link-type="dfn" href="#idp" id="ref-for-idp③⑨">IDP</a> to easily determine the <a data-link-type="dfn" href="#rp" id="ref-for-rp③⓪">RP</a> that a user is visiting by encoding the information in the config file path. We solve this issue by
-requiring a well-known file to be on the root of the <a data-link-type="dfn" href="#idp" id="ref-for-idp④⓪">IDP</a>. The config file itself can be anywhere, but
-it will not be used if the user agent does not find it in the well-known file. This allows the <a data-link-type="dfn" href="#idp" id="ref-for-idp④①">IDP</a> to keep their actual config files on an arbitary path while allowing the user agent to prevent config file
+   <p class="note" role="note"><span class="marker">NOTE:</span> We use a two-tier file system in order to prevent the <a data-link-type="dfn" href="#idp" id="ref-for-idp①⑦">IDP</a> to easily determine the <a data-link-type="dfn" href="#rp" id="ref-for-rp①⑤">RP</a> that a user is visiting by encoding the information in the config file path. We solve this issue by
+requiring a well-known file to be on the root of the <a data-link-type="dfn" href="#idp" id="ref-for-idp①⑧">IDP</a>. The config file itself can be anywhere, but
+it will not be used if the user agent does not find it in the well-known file. This allows the <a data-link-type="dfn" href="#idp" id="ref-for-idp①⑨">IDP</a> to keep their actual config files on an arbitary path while allowing the user agent to prevent config file
 path manipulation to fingerprint (for instance, by including the RP in the path). See <a href="#manifest-fingerprinting">§ 6.3.1 Manifest Fingerprinting</a>.</p>
+<pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-identityproviderwellknown"><code><c- g>IdentityProviderWellKnown</c-></code></dfn> {
+  <c- b>required</c-> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence①"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString⑤"><c- b>USVString</c-></a>> <a class="idl-code" data-link-type="dict-member" data-type="sequence<USVString> " href="#dom-identityproviderwellknown-provider_urls" id="ref-for-dom-identityproviderwellknown-provider_urls②"><c- g>provider_urls</c-></a>;
+};
+
+<c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-identityprovidericon"><code><c- g>IdentityProviderIcon</c-></code></dfn> {
+  <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString⑥"><c- b>USVString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="USVString " href="#dom-identityprovidericon-url" id="ref-for-dom-identityprovidericon-url"><c- g>url</c-></a>;
+  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-unsigned-long" id="ref-for-idl-unsigned-long"><c- b>unsigned</c-> <c- b>long</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="unsigned long " href="#dom-identityprovidericon-size" id="ref-for-dom-identityprovidericon-size"><c- g>size</c-></a>;
+};
+
+<c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-identityproviderbranding"><code><c- g>IdentityProviderBranding</c-></code></dfn> {
+  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString⑦"><c- b>USVString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="USVString " href="#dom-identityproviderbranding-background_color" id="ref-for-dom-identityproviderbranding-background_color"><c- g>background_color</c-></a>;
+  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString⑧"><c- b>USVString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="USVString " href="#dom-identityproviderbranding-color" id="ref-for-dom-identityproviderbranding-color"><c- g>color</c-></a>;
+  <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence②"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#dictdef-identityprovidericon" id="ref-for-dictdef-identityprovidericon"><c- n>IdentityProviderIcon</c-></a>> <a class="idl-code" data-link-type="dict-member" data-type="sequence<IdentityProviderIcon> " href="#dom-identityproviderbranding-icons" id="ref-for-dom-identityproviderbranding-icons"><c- g>icons</c-></a>;
+};
+
+<c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-identityproviderapiconfig"><code><c- g>IdentityProviderAPIConfig</c-></code></dfn> {
+  <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString⑨"><c- b>USVString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="USVString " href="#dom-identityproviderapiconfig-accounts_endpoint" id="ref-for-dom-identityproviderapiconfig-accounts_endpoint"><c- g>accounts_endpoint</c-></a>;
+  <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString①⓪"><c- b>USVString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="USVString " href="#dom-identityproviderapiconfig-client_metadata_endpoint" id="ref-for-dom-identityproviderapiconfig-client_metadata_endpoint"><c- g>client_metadata_endpoint</c-></a>;
+  <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString①①"><c- b>USVString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="USVString " href="#dom-identityproviderapiconfig-id_assertion_endpoint" id="ref-for-dom-identityproviderapiconfig-id_assertion_endpoint"><c- g>id_assertion_endpoint</c-></a>;
+  <a data-link-type="idl-name" href="#dictdef-identityproviderbranding" id="ref-for-dictdef-identityproviderbranding"><c- n>IdentityProviderBranding</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="IdentityProviderBranding " href="#dom-identityproviderapiconfig-branding" id="ref-for-dom-identityproviderapiconfig-branding"><c- g>branding</c-></a>;
+};
+</pre>
    <div class="algorithm" data-algorithm="fetch the accounts list">
-     To <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="fetch-the-accounts-list">fetch the accounts list</dfn> given an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderapiconfig" id="ref-for-dictdef-identityproviderapiconfig④">IdentityProviderAPIConfig</a></code> <var>config</var>, an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderconfig" id="ref-for-dictdef-identityproviderconfig⑤">IdentityProviderConfig</a></code> <var>provider</var>, and <var>globalObject</var>, run the following steps. This returns an <code class="idl"><a data-link-type="idl" href="#dictdef-identityprovideraccountlist" id="ref-for-dictdef-identityprovideraccountlist①">IdentityProviderAccountList</a></code>. 
+     To <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="fetch-the-accounts-list">fetch the accounts list</dfn> given an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderapiconfig" id="ref-for-dictdef-identityproviderapiconfig②">IdentityProviderAPIConfig</a></code> <var>config</var>, an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderconfig" id="ref-for-dictdef-identityproviderconfig⑥">IdentityProviderConfig</a></code> <var>provider</var>, and <var>globalObject</var>, run the following steps. This returns an <code class="idl"><a data-link-type="idl" href="#dictdef-identityprovideraccountlist" id="ref-for-dictdef-identityprovideraccountlist">IdentityProviderAccountList</a></code>. 
     <ol>
      <li data-md>
       <p>Let <var>accountsUrl</var> be the result of <a data-link-type="dfn" href="#computing-the-manifest-url" id="ref-for-computing-the-manifest-url">computing the manifest URL</a> given <var>provider</var>, <var>config</var>["<code class="idl"><a data-link-type="idl" href="#dom-identityproviderapiconfig-accounts_endpoint" id="ref-for-dom-identityproviderapiconfig-accounts_endpoint①">accounts_endpoint</a></code>"], and <var>globalObject</var>.</p>
@@ -1672,7 +1372,7 @@ <h3 class="heading settled" data-level="3.4" id="browser-api-rp-sign-in"><span c
        <li data-md>
         <p>Let <var>json</var> be the result of <a data-link-type="dfn" href="#extract-the-json-fetch-response" id="ref-for-extract-the-json-fetch-response②">extract the JSON fetch response</a> from <var>response</var> and <var>responseBody</var>.</p>
        <li data-md>
-        <p><a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-convert-ecmascript-to-idl-value" id="ref-for-dfn-convert-ecmascript-to-idl-value⑥">Convert</a> <var>json</var> to an <code class="idl"><a data-link-type="idl" href="#dictdef-identityprovideraccountlist" id="ref-for-dictdef-identityprovideraccountlist②">IdentityProviderAccountList</a></code>, and
+        <p><a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-convert-ecmascript-to-idl-value" id="ref-for-dfn-convert-ecmascript-to-idl-value②">Convert</a> <var>json</var> to an <code class="idl"><a data-link-type="idl" href="#dictdef-identityprovideraccountlist" id="ref-for-dictdef-identityprovideraccountlist①">IdentityProviderAccountList</a></code>, and
 store the result in <var>accountsList</var>.</p>
       </ol>
       <p class="issue" id="issue-db10ab61"><a class="self-link" href="#issue-db10ab61"></a> We should validate the accounts list returned here for repeated ids, as described <a href="https://github.com/fedidcg/FedCM/issues/336">here</a>.</p>
@@ -1682,6 +1382,18 @@ <h3 class="heading settled" data-level="3.4" id="browser-api-rp-sign-in"><span c
       <p>Return <var>accountsList</var>.</p>
     </ol>
    </div>
+<pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-identityprovideraccount"><code><c- g>IdentityProviderAccount</c-></code></dfn> {
+  <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString①②"><c- b>USVString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="USVString " href="#dom-identityprovideraccount-id" id="ref-for-dom-identityprovideraccount-id②"><c- g>id</c-></a>;
+  <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString①③"><c- b>USVString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="USVString " href="#dom-identityprovideraccount-name" id="ref-for-dom-identityprovideraccount-name"><c- g>name</c-></a>;
+  <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString①④"><c- b>USVString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="USVString " href="#dom-identityprovideraccount-email" id="ref-for-dom-identityprovideraccount-email"><c- g>email</c-></a>;
+  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString①⑤"><c- b>USVString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="USVString " href="#dom-identityprovideraccount-given_name" id="ref-for-dom-identityprovideraccount-given_name"><c- g>given_name</c-></a>;
+  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString①⑥"><c- b>USVString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="USVString " href="#dom-identityprovideraccount-picture" id="ref-for-dom-identityprovideraccount-picture①"><c- g>picture</c-></a>;
+  <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence③"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString①⑦"><c- b>USVString</c-></a>> <a class="idl-code" data-link-type="dict-member" data-type="sequence<USVString> " href="#dom-identityprovideraccount-approved_clients" id="ref-for-dom-identityprovideraccount-approved_clients"><c- g>approved_clients</c-></a>;
+};
+<c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-identityprovideraccountlist"><code><c- g>IdentityProviderAccountList</c-></code></dfn> {
+  <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence④"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#dictdef-identityprovideraccount" id="ref-for-dictdef-identityprovideraccount①"><c- n>IdentityProviderAccount</c-></a>> <dfn class="idl-code" data-dfn-for="IdentityProviderAccountList" data-dfn-type="dict-member" data-export data-type="sequence<IdentityProviderAccount> " id="dom-identityprovideraccountlist-accounts"><code><c- g>accounts</c-></code><a class="self-link" href="#dom-identityprovideraccountlist-accounts"></a></dfn>;
+};
+</pre>
    <div class="algorithm" data-algorithm="fetch the account picture">
      To <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="fetch-the-account-picture">fetch the account picture</dfn> given an <code class="idl"><a data-link-type="idl" href="#dictdef-identityprovideraccount" id="ref-for-dictdef-identityprovideraccount②">IdentityProviderAccount</a></code> <var>account</var> and a <var>globalObject</var>, run the following steps: 
     <ol>
@@ -1726,18 +1438,18 @@ <h3 class="heading settled" data-level="3.4" id="browser-api-rp-sign-in"><span c
     </ol>
    </div>
    <div class="algorithm" data-algorithm="fetch an identity assertion">
-     To <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="fetch-an-identity-assertion">fetch an identity assertion</dfn> given an <a data-link-type="dfn" href="#accountstate" id="ref-for-accountstate">AccountState</a> <var>accountState</var>, a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString③⑥">USVString</a></code> <var>accountId</var>, an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderconfig" id="ref-for-dictdef-identityproviderconfig⑥">IdentityProviderConfig</a></code> <var>provider</var>, an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderapiconfig" id="ref-for-dictdef-identityproviderapiconfig⑤">IdentityProviderAPIConfig</a></code> <var>config</var>, and <var>globalObject</var>, run the following steps. This returns an <code class="idl"><a data-link-type="idl" href="#identitycredential" id="ref-for-identitycredential⑨">IdentityCredential</a></code>. 
+     To <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="fetch-an-identity-assertion">fetch an identity assertion</dfn> given an <a data-link-type="dfn" href="#accountstate" id="ref-for-accountstate③">AccountState</a> <var>accountState</var>, a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString①⑧">USVString</a></code> <var>accountId</var>, an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderconfig" id="ref-for-dictdef-identityproviderconfig⑦">IdentityProviderConfig</a></code> <var>provider</var>, an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderapiconfig" id="ref-for-dictdef-identityproviderapiconfig③">IdentityProviderAPIConfig</a></code> <var>config</var>, and <var>globalObject</var>, run the following steps. This returns an <code class="idl"><a data-link-type="idl" href="#identitycredential" id="ref-for-identitycredential⑦">IdentityCredential</a></code>. 
     <ol>
      <li data-md>
-      <p>Assert <var>accountState</var>’s <code class="idl"><a data-link-type="idl" href="#dom-accountstate-registration-state" id="ref-for-dom-accountstate-registration-state③">registration state</a></code> is <code class="idl"><a data-link-type="idl" href="#dom-accountstate-registered" id="ref-for-dom-accountstate-registered">registered</a></code>.</p>
+      <p>Assert <var>accountState</var>’s <code class="idl"><a data-link-type="idl" href="#dom-accountstate-registration-state" id="ref-for-dom-accountstate-registration-state④">registration state</a></code> is <code class="idl"><a data-link-type="idl" href="#dom-accountstate-registered" id="ref-for-dom-accountstate-registered①">registered</a></code>.</p>
      <li data-md>
-      <p>Assert <var>accountState</var>’s <code class="idl"><a data-link-type="idl" href="#dom-accountstate-allows-logout" id="ref-for-dom-accountstate-allows-logout">allows logout</a></code> is true.</p>
+      <p>Assert <var>accountState</var>’s <code class="idl"><a data-link-type="idl" href="#dom-accountstate-allows-logout" id="ref-for-dom-accountstate-allows-logout①">allows logout</a></code> is true.</p>
      <li data-md>
       <p>Let <var>idTokenUrl</var> be the result of <a data-link-type="dfn" href="#computing-the-manifest-url" id="ref-for-computing-the-manifest-url①">computing the manifest URL</a> given <var>provider</var>, <var>config</var>["<code class="idl"><a data-link-type="idl" href="#dom-identityproviderapiconfig-id_assertion_endpoint" id="ref-for-dom-identityproviderapiconfig-id_assertion_endpoint①">id_assertion_endpoint</a></code>"], and <var>globalObject</var>.</p>
      <li data-md>
       <p>If <var>idTokenUrl</var> is failure, return failure.</p>
      <li data-md>
-      <p>Let <var>requestBody</var> be a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#string" id="ref-for-string">string</a> resulting in concatenating "client_id=", <var>provider</var>’s <code class="idl"><a data-link-type="idl" href="#dom-identityproviderconfig-clientid" id="ref-for-dom-identityproviderconfig-clientid④">clientId</a></code>, "&amp;nonce=", <var>provider</var>’s <code class="idl"><a data-link-type="idl" href="#dom-identityproviderconfig-nonce" id="ref-for-dom-identityproviderconfig-nonce①">nonce</a></code>, "&amp;account_id=", and <var>accountId</var>.</p>
+      <p>Let <var>requestBody</var> be a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#string" id="ref-for-string">string</a> resulting in concatenating "client_id=", <var>provider</var>’s <code class="idl"><a data-link-type="idl" href="#dom-identityproviderconfig-clientid" id="ref-for-dom-identityproviderconfig-clientid①">clientId</a></code>, "&amp;nonce=", <var>provider</var>’s <code class="idl"><a data-link-type="idl" href="#dom-identityproviderconfig-nonce" id="ref-for-dom-identityproviderconfig-nonce①">nonce</a></code>, "&amp;account_id=", and <var>accountId</var>.</p>
      <li data-md>
       <p>Let <var>request</var> be a new <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request" id="ref-for-concept-request⑥">request</a> as follows:</p>
       <dl>
@@ -1767,7 +1479,7 @@ <h3 class="heading settled" data-level="3.4" id="browser-api-rp-sign-in"><span c
         <p>"webidentity"</p>
        <dt data-md><a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-origin" id="ref-for-concept-request-origin④">origin</a>
        <dd data-md>
-        <p><a data-link-type="dfn" href="#rp" id="ref-for-rp③①">RP</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin" id="ref-for-concept-origin②">origin</a> (TODO)</p>
+        <p><a data-link-type="dfn" href="#rp" id="ref-for-rp①⑥">RP</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin" id="ref-for-concept-origin③">origin</a> (TODO)</p>
        <dt data-md><a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-header-list" id="ref-for-concept-request-header-list③">header list</a>
        <dd data-md>
         <p>a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list" id="ref-for-list④">list</a> containing a single <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-header" id="ref-for-concept-header③">header</a> with <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-header-name" id="ref-for-concept-header-name③">name</a> set to <code>Accept</code> and <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-header-value" id="ref-for-concept-header-value③">value</a> set to <code>application/x-www-form-urlencoded</code></p>
@@ -1783,9 +1495,9 @@ <h3 class="heading settled" data-level="3.4" id="browser-api-rp-sign-in"><span c
        <li data-md>
         <p>Let <var>json</var> be the result of <a data-link-type="dfn" href="#extract-the-json-fetch-response" id="ref-for-extract-the-json-fetch-response③">extract the JSON fetch response</a> from <var>response</var> and <var>responseBody</var>.</p>
        <li data-md>
-        <p><a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-convert-ecmascript-to-idl-value" id="ref-for-dfn-convert-ecmascript-to-idl-value⑦">Convert</a> <var>json</var> to an <code class="idl"><a data-link-type="idl" href="#dictdef-identityprovidertoken" id="ref-for-dictdef-identityprovidertoken②">IdentityProviderToken</a></code>, <var>token</var>.</p>
+        <p><a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-convert-ecmascript-to-idl-value" id="ref-for-dfn-convert-ecmascript-to-idl-value③">Convert</a> <var>json</var> to an <code class="idl"><a data-link-type="idl" href="#dictdef-identityprovidertoken" id="ref-for-dictdef-identityprovidertoken">IdentityProviderToken</a></code>, <var>token</var>.</p>
        <li data-md>
-        <p>Let <var>credential</var> be a new <code class="idl"><a data-link-type="idl" href="#identitycredential" id="ref-for-identitycredential①⓪">IdentityCredential</a></code> given <var>globalObject</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-global-object-realm" id="ref-for-concept-global-object-realm">realm</a>.</p>
+        <p>Let <var>credential</var> be a new <code class="idl"><a data-link-type="idl" href="#identitycredential" id="ref-for-identitycredential⑧">IdentityCredential</a></code> given <var>globalObject</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-global-object-realm" id="ref-for-concept-global-object-realm">realm</a>.</p>
        <li data-md>
         <p>Set <var>credential</var>’s <code class="idl"><a data-link-type="idl" href="#dom-identitycredential-token" id="ref-for-dom-identitycredential-token②">token</a></code> to <var>token</var>.</p>
       </ol>
@@ -1795,29 +1507,10 @@ <h3 class="heading settled" data-level="3.4" id="browser-api-rp-sign-in"><span c
       <p>Return <var>credential</var>.</p>
     </ol>
    </div>
-   <div class="algorithm" data-algorithm="compute account state">
-     To <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="compute-account-state">compute account state</dfn> given an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderconfig" id="ref-for-dictdef-identityproviderconfig⑦">IdentityProviderConfig</a></code> <var>provider</var>, an <code class="idl"><a data-link-type="idl" href="#dictdef-identityprovideraccount" id="ref-for-dictdef-identityprovideraccount③">IdentityProviderAccount</a></code> <var>account</var>, and a <var>globalObject</var>, run the following steps. This returns
-an <a data-link-type="dfn" href="#accountstate" id="ref-for-accountstate①">AccountState</a>. 
-    <ol>
-     <li data-md>
-      <p>Let <var>configUrl</var> be the result of running <a data-link-type="dfn" href="#parse-url" id="ref-for-parse-url①">parse url</a> with <var>provider</var>’s <code class="idl"><a data-link-type="idl" href="#dom-identityproviderconfig-configurl" id="ref-for-dom-identityproviderconfig-configurl③">configURL</a></code> and <var>globalObject</var>.</p>
-     <li data-md>
-      <p>Let <var>idpOrigin</var> be the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin" id="ref-for-concept-origin③">origin</a> corresponding to <var>configUrl</var>.</p>
-     <li data-md>
-      <p>Let <var>rpOrigin</var> be <var>globalObject</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/nav-history-apis.html#concept-document-window" id="ref-for-concept-document-window">associated Document</a>'s <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#concept-document-origin" id="ref-for-concept-document-origin">origin</a>.</p>
-     <li data-md>
-      <p>Let <var>accountId</var> be <var>account</var>’s <code class="idl"><a data-link-type="idl" href="#dom-identityprovideraccount-id" id="ref-for-dom-identityprovideraccount-id②">id</a></code>.</p>
-     <li data-md>
-      <p>Let <var>triple</var> be (<var>rpOrigin</var>, <var>idpOrigin</var>, <var>accountId</var>).</p>
-     <li data-md>
-      <p>If <a data-link-type="dfn" href="#state-machine-map" id="ref-for-state-machine-map②">state machine map</a>[<var>triple</var>] does not exist, set <a data-link-type="dfn" href="#state-machine-map" id="ref-for-state-machine-map③">state machine map</a>[<var>triple</var>] to a
-new <a data-link-type="dfn" href="#accountstate" id="ref-for-accountstate②">AccountState</a>.</p>
-     <li data-md>
-      <p>Let <var>accountState</var> be <a data-link-type="dfn" href="#state-machine-map" id="ref-for-state-machine-map④">state machine map</a>[<var>triple</var>].</p>
-     <li data-md>
-      <p>Return <var>accountState</var>.</p>
-    </ol>
-   </div>
+<pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-identityprovidertoken"><code><c- g>IdentityProviderToken</c-></code></dfn> {
+  <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString①⑨"><c- b>USVString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="USVString " href="#dom-identityprovidertoken-token" id="ref-for-dom-identityprovidertoken-token②"><c- g>token</c-></a>;
+};
+</pre>
    <div class="algorithm" data-algorithm="computing the manifest URL">
      When <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="computing-the-manifest-url">computing the manifest URL</dfn> given an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderconfig" id="ref-for-dictdef-identityproviderconfig⑧">IdentityProviderConfig</a></code> <var>provider</var>, a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#string" id="ref-for-string①">string</a> <var>manifestString</var>, and <var>globalObject</var>, perform the following steps. This returns a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url" id="ref-for-concept-url②">URL</a> or failure. 
     <ol>
@@ -1862,33 +1555,33 @@ <h3 class="heading settled" data-level="3.4" id="browser-api-rp-sign-in"><span c
     </ol>
    </div>
    <div class="algorithm" data-algorithm="request permission to sign-up">
-     To <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="request-permission-to-sign-up">request permission to sign-up</dfn> the user with a given an <code class="idl"><a data-link-type="idl" href="#dictdef-identityprovideraccount" id="ref-for-dictdef-identityprovideraccount④">IdentityProviderAccount</a></code> <var>account</var>, an <a data-link-type="dfn" href="#accountstate" id="ref-for-accountstate③">AccountState</a> <var>accountState</var>, an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderapiconfig" id="ref-for-dictdef-identityproviderapiconfig⑥">IdentityProviderAPIConfig</a></code> <var>config</var>, an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderconfig" id="ref-for-dictdef-identityproviderconfig⑨">IdentityProviderConfig</a></code> <var>provider</var>, and a <var>globalObject</var>, run the following steps. This returns a boolean. 
+     To <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="request-permission-to-sign-up">request permission to sign-up</dfn> the user with a given an <code class="idl"><a data-link-type="idl" href="#dictdef-identityprovideraccount" id="ref-for-dictdef-identityprovideraccount③">IdentityProviderAccount</a></code> <var>account</var>, an <a data-link-type="dfn" href="#accountstate" id="ref-for-accountstate④">AccountState</a> <var>accountState</var>, an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderapiconfig" id="ref-for-dictdef-identityproviderapiconfig④">IdentityProviderAPIConfig</a></code> <var>config</var>, an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderconfig" id="ref-for-dictdef-identityproviderconfig⑨">IdentityProviderConfig</a></code> <var>provider</var>, and a <var>globalObject</var>, run the following steps. This returns a boolean. 
     <ol>
      <li data-md>
       <p class="assertion">Assert: These steps are running <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/infrastructure.html#in-parallel" id="ref-for-in-parallel④">in parallel</a>.</p>
      <li data-md>
       <p>Let <var>metadata</var> be the result of running <a data-link-type="dfn" href="#fetch-the-client-metadata" id="ref-for-fetch-the-client-metadata">fetch the client metadata</a> with <var>config</var>, <var>provider</var>, and <var>globalObject</var>.</p>
      <li data-md>
-      <p>If <var>metadata</var> is not null, <var>metadata</var>["<code class="idl"><a data-link-type="idl" href="#dom-identityproviderclientmetadata-privacy_policy_url" id="ref-for-dom-identityproviderclientmetadata-privacy_policy_url①">privacy_policy_url</a></code>"]
-is defined and the <var>provider</var>’s <code class="idl"><a data-link-type="idl" href="#dom-identityproviderconfig-clientid" id="ref-for-dom-identityproviderconfig-clientid⑤">clientId</a></code> is not in the list of <var>account</var>["<code class="idl"><a data-link-type="idl" href="#dom-identityprovideraccount-approved_clients" id="ref-for-dom-identityprovideraccount-approved_clients①">approved_clients</a></code>"], then display the <var>metadata</var>["<code class="idl"><a data-link-type="idl" href="#dom-identityproviderclientmetadata-privacy_policy_url" id="ref-for-dom-identityproviderclientmetadata-privacy_policy_url②">privacy_policy_url</a></code>"] link.</p>
+      <p>If <var>metadata</var> is not null, <var>metadata</var>["<code class="idl"><a data-link-type="idl" href="#dom-identityproviderclientmetadata-privacy_policy_url" id="ref-for-dom-identityproviderclientmetadata-privacy_policy_url">privacy_policy_url</a></code>"]
+is defined and the <var>provider</var>’s <code class="idl"><a data-link-type="idl" href="#dom-identityproviderconfig-clientid" id="ref-for-dom-identityproviderconfig-clientid②">clientId</a></code> is not in the list of <var>account</var>["<code class="idl"><a data-link-type="idl" href="#dom-identityprovideraccount-approved_clients" id="ref-for-dom-identityprovideraccount-approved_clients①">approved_clients</a></code>"], then display the <var>metadata</var>["<code class="idl"><a data-link-type="idl" href="#dom-identityproviderclientmetadata-privacy_policy_url" id="ref-for-dom-identityproviderclientmetadata-privacy_policy_url①">privacy_policy_url</a></code>"] link.</p>
      <li data-md>
-      <p>If <var>metadata</var> is not null, <var>metadata</var>["<code class="idl"><a data-link-type="idl" href="#dom-identityproviderclientmetadata-terms_of_service_url" id="ref-for-dom-identityproviderclientmetadata-terms_of_service_url①">terms_of_service_url</a></code>"]
-is defined, and the <var>provider</var>’s <code class="idl"><a data-link-type="idl" href="#dom-identityproviderconfig-clientid" id="ref-for-dom-identityproviderconfig-clientid⑥">clientId</a></code> is not in the list of <var>account</var>["<code class="idl"><a data-link-type="idl" href="#dom-identityprovideraccount-approved_clients" id="ref-for-dom-identityprovideraccount-approved_clients②">approved_clients</a></code>"], then display the <var>metadata</var>["<code class="idl"><a data-link-type="idl" href="#dom-identityproviderclientmetadata-terms_of_service_url" id="ref-for-dom-identityproviderclientmetadata-terms_of_service_url②">terms_of_service_url</a></code>"] link.</p>
+      <p>If <var>metadata</var> is not null, <var>metadata</var>["<code class="idl"><a data-link-type="idl" href="#dom-identityproviderclientmetadata-terms_of_service_url" id="ref-for-dom-identityproviderclientmetadata-terms_of_service_url">terms_of_service_url</a></code>"]
+is defined, and the <var>provider</var>’s <code class="idl"><a data-link-type="idl" href="#dom-identityproviderconfig-clientid" id="ref-for-dom-identityproviderconfig-clientid③">clientId</a></code> is not in the list of <var>account</var>["<code class="idl"><a data-link-type="idl" href="#dom-identityprovideraccount-approved_clients" id="ref-for-dom-identityprovideraccount-approved_clients②">approved_clients</a></code>"], then display the <var>metadata</var>["<code class="idl"><a data-link-type="idl" href="#dom-identityproviderclientmetadata-terms_of_service_url" id="ref-for-dom-identityproviderclientmetadata-terms_of_service_url①">terms_of_service_url</a></code>"] link.</p>
      <li data-md>
-      <p>Prompt the user to gather explicit intent to create an account. The user agent MAY use the <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderbranding" id="ref-for-dictdef-identityproviderbranding④">IdentityProviderBranding</a></code> to inform the style choices of its UI.</p>
+      <p>Prompt the user to gather explicit intent to create an account. The user agent MAY use the <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderbranding" id="ref-for-dictdef-identityproviderbranding①">IdentityProviderBranding</a></code> to inform the style choices of its UI.</p>
      <li data-md>
       <p>If the user does not grant permission, return false.</p>
      <li data-md>
-      <p>Change <var>accountState</var>’s <code class="idl"><a data-link-type="idl" href="#dom-accountstate-registration-state" id="ref-for-dom-accountstate-registration-state④">registration state</a></code> from <code class="idl"><a data-link-type="idl" href="#dom-accountstate-unregistered" id="ref-for-dom-accountstate-unregistered③">unregistered</a></code> to <code class="idl"><a data-link-type="idl" href="#dom-accountstate-registered" id="ref-for-dom-accountstate-registered①">registered</a></code>.</p>
+      <p>Change <var>accountState</var>’s <code class="idl"><a data-link-type="idl" href="#dom-accountstate-registration-state" id="ref-for-dom-accountstate-registration-state⑤">registration state</a></code> from <code class="idl"><a data-link-type="idl" href="#dom-accountstate-unregistered" id="ref-for-dom-accountstate-unregistered③">unregistered</a></code> to <code class="idl"><a data-link-type="idl" href="#dom-accountstate-registered" id="ref-for-dom-accountstate-registered②">registered</a></code>.</p>
      <li data-md>
-      <p>Change <var>accountState</var>’s <code class="idl"><a data-link-type="idl" href="#dom-accountstate-allows-logout" id="ref-for-dom-accountstate-allows-logout①">allows logout</a></code> from false to true.</p>
+      <p>Change <var>accountState</var>’s <code class="idl"><a data-link-type="idl" href="#dom-accountstate-allows-logout" id="ref-for-dom-accountstate-allows-logout②">allows logout</a></code> from false to true.</p>
      <li data-md>
       <p>Return true.</p>
     </ol>
    </div>
    <div class="algorithm" data-algorithm="fetch the client metadata">
-     To <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="fetch-the-client-metadata">fetch the client metadata</dfn> given an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderapiconfig" id="ref-for-dictdef-identityproviderapiconfig⑦">IdentityProviderAPIConfig</a></code> <var>config</var> and
-an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderconfig" id="ref-for-dictdef-identityproviderconfig①⓪">IdentityProviderConfig</a></code> <var>provider</var>, run the following steps. This returns an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderclientmetadata" id="ref-for-dictdef-identityproviderclientmetadata②">IdentityProviderClientMetadata</a></code> or null. 
+     To <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="fetch-the-client-metadata">fetch the client metadata</dfn> given an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderapiconfig" id="ref-for-dictdef-identityproviderapiconfig⑤">IdentityProviderAPIConfig</a></code> <var>config</var> and
+an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderconfig" id="ref-for-dictdef-identityproviderconfig①⓪">IdentityProviderConfig</a></code> <var>provider</var>, run the following steps. This returns an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderclientmetadata" id="ref-for-dictdef-identityproviderclientmetadata">IdentityProviderClientMetadata</a></code> or null. 
     <ol>
      <li data-md>
       <p>Let <var>clientMetadataUrl</var> be the result of <a data-link-type="dfn" href="#computing-the-manifest-url" id="ref-for-computing-the-manifest-url②">computing the manifest URL</a> given <var>provider</var>, <var>config</var>["<code class="idl"><a data-link-type="idl" href="#dom-identityproviderapiconfig-client_metadata_endpoint" id="ref-for-dom-identityproviderapiconfig-client_metadata_endpoint①">client_metadata_endpoint</a></code>"], and <var>globalObject</var>.</p>
@@ -1917,7 +1610,7 @@ <h3 class="heading settled" data-level="3.4" id="browser-api-rp-sign-in"><span c
         <p>"webidentity"</p>
        <dt data-md><a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-origin" id="ref-for-concept-request-origin⑤">origin</a>
        <dd data-md>
-        <p><a data-link-type="dfn" href="#rp" id="ref-for-rp③②">RP</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin" id="ref-for-concept-origin④">origin</a> (TODO)</p>
+        <p><a data-link-type="dfn" href="#rp" id="ref-for-rp①⑦">RP</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin" id="ref-for-concept-origin④">origin</a> (TODO)</p>
        <dt data-md><a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-header-list" id="ref-for-concept-request-header-list④">header list</a>
        <dd data-md>
         <p>a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list" id="ref-for-list⑤">list</a> containing a single <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-header" id="ref-for-concept-header④">header</a> with <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-header-name" id="ref-for-concept-header-name④">name</a> set to <code>Accept</code> and <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-header-value" id="ref-for-concept-header-value④">value</a> set to <code>application/json</code></p>
@@ -1933,7 +1626,7 @@ <h3 class="heading settled" data-level="3.4" id="browser-api-rp-sign-in"><span c
        <li data-md>
         <p>Let <var>json</var> be the result of <a data-link-type="dfn" href="#extract-the-json-fetch-response" id="ref-for-extract-the-json-fetch-response④">extract the JSON fetch response</a> from <var>response</var> and <var>responseBody</var>.</p>
        <li data-md>
-        <p><a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-convert-ecmascript-to-idl-value" id="ref-for-dfn-convert-ecmascript-to-idl-value⑧">Convert</a> <var>json</var> to an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderclientmetadata" id="ref-for-dictdef-identityproviderclientmetadata③">IdentityProviderClientMetadata</a></code>,
+        <p><a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-convert-ecmascript-to-idl-value" id="ref-for-dfn-convert-ecmascript-to-idl-value④">Convert</a> <var>json</var> to an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderclientmetadata" id="ref-for-dictdef-identityproviderclientmetadata①">IdentityProviderClientMetadata</a></code>,
 and store the result in <var>metadata</var>.</p>
       </ol>
      <li data-md>
@@ -1942,117 +1635,425 @@ <h3 class="heading settled" data-level="3.4" id="browser-api-rp-sign-in"><span c
       <p>Return <var>metadata</var>.</p>
     </ol>
    </div>
+<pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-identityproviderclientmetadata"><code><c- g>IdentityProviderClientMetadata</c-></code></dfn> {
+  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString②⓪"><c- b>USVString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="USVString " href="#dom-identityproviderclientmetadata-privacy_policy_url" id="ref-for-dom-identityproviderclientmetadata-privacy_policy_url②"><c- g>privacy_policy_url</c-></a>;
+  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString②①"><c- b>USVString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="USVString " href="#dom-identityproviderclientmetadata-terms_of_service_url" id="ref-for-dom-identityproviderclientmetadata-terms_of_service_url②"><c- g>terms_of_service_url</c-></a>;
+};
+</pre>
    <div class="algorithm" data-algorithm="select an account">
-     To <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="select-an-account">select an account</dfn> given an <var>accountsList</var>, run the following steps. This returns an <code class="idl"><a data-link-type="idl" href="#dictdef-identityprovideraccount" id="ref-for-dictdef-identityprovideraccount⑤">IdentityProviderAccount</a></code> or failure. 
+     To <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="select-an-account">select an account</dfn> given an <var>accountsList</var>, run the following steps. This returns an <code class="idl"><a data-link-type="idl" href="#dictdef-identityprovideraccount" id="ref-for-dictdef-identityprovideraccount④">IdentityProviderAccount</a></code> or failure. 
     <ol>
      <li data-md>
       <p>Assert <var>accountsList</var>’s <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-size" id="ref-for-list-size②">size</a> is greater than 1.</p>
      <li data-md>
       <p>Display an account chooser displaying the options from <var>accountsList</var>.</p>
      <li data-md>
-      <p>Let <var>account</var> be the <code class="idl"><a data-link-type="idl" href="#dictdef-identityprovideraccount" id="ref-for-dictdef-identityprovideraccount⑥">IdentityProviderAccount</a></code> of the account that the user
+      <p>Let <var>account</var> be the <code class="idl"><a data-link-type="idl" href="#dictdef-identityprovideraccount" id="ref-for-dictdef-identityprovideraccount⑤">IdentityProviderAccount</a></code> of the account that the user
 manually selects from the accounts chooser, or failure if no account is selected.</p>
      <li data-md>
       <p>Return <var>account</var>.</p>
     </ol>
    </div>
-   <div class="algorithm" data-algorithm="sign-in">
-     To <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="sign-in">sign-in</dfn> the user with a given an <a data-link-type="dfn" href="#accountstate" id="ref-for-accountstate④">AccountState</a> <var>accountState</var>: 
-    <ol>
-     <li data-md>
-      <p>Assert that <var>accountState</var>’s <code class="idl"><a data-link-type="idl" href="#dom-accountstate-registration-state" id="ref-for-dom-accountstate-registration-state⑤">registration state</a></code> is <code class="idl"><a data-link-type="idl" href="#dom-accountstate-registered" id="ref-for-dom-accountstate-registered②">registered</a></code></p>
-     <li data-md>
-      <p>Change <var>accountState</var>’s <code class="idl"><a data-link-type="idl" href="#dom-accountstate-allows-logout" id="ref-for-dom-accountstate-allows-logout②">allows logout</a></code> from false to true.</p>
-    </ol>
-   </div>
-   <h3 class="heading settled" data-level="3.5" id="browser-api-backwards-compatibility"><span class="secno">3.5. </span><span class="content">Backwards Compatibility</span><a class="self-link" href="#browser-api-backwards-compatibility"></a></h3>
-   <p class="note" role="note"><span class="marker">Note:</span> go over how we are planning to deal with backwards compatibility.</p>
-   <h2 class="heading settled" data-level="4" id="permissions-policy-integration"><span class="secno">4. </span><span class="content">Permissions Policy Integration</span><a class="self-link" href="#permissions-policy-integration"></a></h2>
-   <p>FedCM defines a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-permissions-policy/#policy-controlled-feature" id="ref-for-policy-controlled-feature">policy-controlled feature</a> identified by the string <code>"<dfn class="dfn-paneled" data-dfn-type="dfn" data-export id="identity-credentials-get">identity-credentials-get</dfn>"</code>.
-Its <a data-link-type="dfn" href="https://w3c.github.io/webappsec-permissions-policy/#policy-controlled-feature-default-allowlist" id="ref-for-policy-controlled-feature-default-allowlist">default allowlist</a> is <code>"self"</code>.</p>
-   <p>A <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document" id="ref-for-document">Document</a></code>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy" id="ref-for-concept-document-permissions-policy①">permissions policy</a> determines whether any content
-in that document is allowed to obtain a credential object using the <a href="#browser-api">Browser API</a>.
-Attempting to invoke <code><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①">navigator.credentials.get({identity:..., ...})</a></code> in documents that are not <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use" id="ref-for-allowed-to-use">allowed to use</a> the <a data-link-type="dfn" href="#identity-credentials-get" id="ref-for-identity-credentials-get">identity-credentials-get</a> feature will result
-in <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#a-promise-rejected-with" id="ref-for-a-promise-rejected-with">a promise rejected with</a> a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException④">DOMException</a></code>.</p>
-   <p>This restriction can be controlled using the mechanisms described in <a data-link-type="biblio" href="https://w3c.github.io/webappsec-permissions-policy"><cite>Permissions Policy</cite></a>.</p>
-   <p class="note" role="note"><span class="marker">Note:</span> Algorithms specified in <a data-link-type="biblio" href="https://w3c.github.io/webappsec-credential-management/"><cite>Credential Management Level 1</cite></a> perform the actual
-permissions policy evaluation. This is because such policy evaluation needs to
-occur when there is access to the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#current-settings-object" id="ref-for-current-settings-object">current settings object</a>. The <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-ordinary-object-internal-methods-and-internal-slots" id="ref-for-sec-ordinary-object-internal-methods-and-internal-slots②">internal method</a>s
-modified by this specification do not have such access since they are invoked <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/infrastructure.html#in-parallel" id="ref-for-in-parallel⑤">in parallel</a> by <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#credentialscontainer" id="ref-for-credentialscontainer①">CredentialsContainer</a></code>'s <a data-link-type="abstract-op" href="https://w3c.github.io/webappsec-credential-management/#abstract-opdef-request-a-credential" id="ref-for-abstract-opdef-request-a-credential①">Request a <code>Credential</code></a> abstract operation.</p>
-   <h2 class="heading settled" data-level="5" id="security"><span class="secno">5. </span><span class="content">Security</span><a class="self-link" href="#security"></a></h2>
-   <p>This section provides a few of the security considerations for the FedCM API. Note that there is a
-separate section for <a href="#privacy">§ 6 Privacy</a> considerations.</p>
-   <h3 class="heading settled" data-level="5.1" id="content-security-policy"><span class="secno">5.1. </span><span class="content">Content Security Policy</span><a class="self-link" href="#content-security-policy"></a></h3>
-   <p>The first fetches triggered by the FedCM API are the manifest list, which is public, and the
-config file. Imagine a malicious script included by (and running as) the <a data-link-type="dfn" href="#rp" id="ref-for-rp③③">RP</a> attempting to
-execute the FedCM API calls to a malicious <a data-link-type="dfn" href="#idp" id="ref-for-idp④②">IDP</a>, one which is not trusted by the <a data-link-type="dfn" href="#rp" id="ref-for-rp③④">RP</a>. If the
-call is successful, this would introduce browser UI on the <a data-link-type="dfn" href="#rp" id="ref-for-rp③⑤">RP</a> with sign in options into a
-malicious <a data-link-type="dfn" href="#idp" id="ref-for-idp④③">IDP</a>. This malicious<a data-link-type="dfn" href="#idp" id="ref-for-idp④④">IDP</a> could then attempt to trick the user. The protection
-against this attack is the <a data-link-type="biblio" href="https://w3c.github.io/webappsec-csp/"><cite>Content Security Policy Level 3</cite></a> check, which would fail because the origin of the manifest of
-the malicious <a data-link-type="dfn" href="#idp" id="ref-for-idp④⑤">IDP</a> would not be an origin included in the allowlist specified by the <a data-link-type="biblio" href="https://w3c.github.io/webappsec-csp/"><cite>Content Security Policy Level 3</cite></a> of
-the <a data-link-type="dfn" href="#rp" id="ref-for-rp③⑥">RP</a>, hence preventing the undesired FedCM UI from being shown. Since any subsequent fetches
-are same origin with respect to the config file or at least dependent on the contents of the
-config file, they do not require additional checks.</p>
-   <p>The non-same-origin fetches include, for example, the brand icon. The user agent does not perform a <a data-link-type="biblio" href="https://w3c.github.io/webappsec-csp/"><cite>Content Security Policy Level 3</cite></a> check on these because they are directly specified from the manifest. In addition, the
-rendering of this image is performed by the user agent, and as such this image cannot affect the <a data-link-type="dfn" href="#rp" id="ref-for-rp③⑦">RP</a> site nor can they be inspected by the <a data-link-type="dfn" href="#rp" id="ref-for-rp③⑧">RP</a> in any way.</p>
-   <h3 class="heading settled" data-level="5.2" id="sec-fetch-dest-header"><span class="secno">5.2. </span><span class="content">Sec-Fetch-Dest Header</span><a class="self-link" href="#sec-fetch-dest-header"></a></h3>
+   <h2 class="heading settled" data-level="3" id="idp-api"><span class="secno">3. </span><span class="content">Identity Provider HTTP API</span><a class="self-link" href="#idp-api"></a></h2>
    <p><em>This section is non-normative.</em></p>
-   <p>The FedCM API introduces several non-static endpoints on the <a data-link-type="dfn" href="#idp" id="ref-for-idp④⑥">IDP</a>, so these need to be protected
-from XSS attacks. In order to do so, the FedCM API introduces a new value for the <a data-link-type="http-header" href="https://w3c.github.io/webappsec-fetch-metadata/#http-headerdef-sec-fetch-dest" id="ref-for-http-headerdef-sec-fetch-dest⑤">Sec-Fetch-Dest</a> header, a <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#forbidden-request-header" id="ref-for-forbidden-request-header">forbidden request-header</a>. The requests initiated by the FedCM API
-have a <code>webidentity</code> value for this header. The value cannot be set by random websites, so the <a data-link-type="dfn" href="#idp" id="ref-for-idp④⑦">IDP</a> can be confident that the request was originated by the FedCM browser rather than sent by a
-websites trying to run an XSS attack. An <a data-link-type="dfn" href="#idp" id="ref-for-idp④⑧">IDP</a> must to check for this header’s value in the
-credentialed requests it receives, which ensures that the request was initiated by the user agent,
-based on the FedCM API. A malicious actor cannot spam FedCM API calls, so this is sufficient
-protection for the new <a data-link-type="dfn" href="#idp" id="ref-for-idp④⑨">IDP</a> endpoints.</p>
-   <h3 class="heading settled" data-level="5.3" id="browser-surface-impersonation"><span class="secno">5.3. </span><span class="content">Browser Surface Impersonation</span><a class="self-link" href="#browser-surface-impersonation"></a></h3>
-   <p>The FedCM API introduces new (trusted) user agent UI, and the user agent may choose to show the UI
-entirely on top of the page’s contents, if anything because the page was the one responsible for
-this UI. This introduces a potential concern of a malicious site to try to replicate the FedCM UI,
-gain the user’s trust that the user is interacting with a trusted browser surface, and gather
-information from the user that they would only give to the browser rather than the site (e.g.
-usernames/passwords of <strong>another</strong> site). This would be hard to achieve because the FedCM UI uses
-metadata about the user accounts of the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑤⓪">IDP</a>, which the malicious website doesn’t have access to.
-If this is a malicious site, it would not know the user accounts unless the user is already
-compromised. However, the site could have some guess of the user identity, so the browser is
-encouraged to provide UI that is hard to replicate and that clearly presents the domains of the
-parties involved in the website’s FedCM call. Overall, an attacker trying to impersonate the browser
-using exclusively UI that is accessible to the content area (e.g. iframes) to attempt to retrieve
-sensitive information from the user would be noticeably different from the FedCM UI. Finally,
-because the FedCM UI can only be queried from the top-level frame (or potentially from an iframe
-with explicit permission from the top-level frame), the priviledged UI surface is only shown when
-the top-level frame wants it so. A sneaky iframe cannot force the FedCM UI to occlude important
-content from the main page.</p>
-   <h2 class="heading settled" data-level="6" id="privacy"><span class="secno">6. </span><span class="content">Privacy</span><a class="self-link" href="#privacy"></a></h2>
-   <p>This section is intended to provide a comprehensive overview of the privacy risks associated with
-federated identity on the web for the purpose of measuring the privacy risks and benefits of
-proposed browser intermediation designs.</p>
-   <h3 class="heading settled" data-level="6.1" id="privacy-principals"><span class="secno">6.1. </span><span class="content">Principals</span><a class="self-link" href="#privacy-principals"></a></h3>
-   <p>This section describes the four principals that would participate in an invocation of the API and
-expectations around their behavior.</p>
+   <p>The <a data-link-type="dfn" href="#idp" id="ref-for-idp②⓪">IDP</a> proactively and cooperatively exposes itself as a comformant agent
+by exposing a series of HTTP endpoints:</p>
    <ol>
     <li data-md>
-     <p>The <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#user-agent" id="ref-for-user-agent①②">user agent</a> implements <a href="#browser-api">§ 3 The Browser API</a> and controls the execution contexts for the <a data-link-type="dfn" href="#rp" id="ref-for-rp③⑨">RP</a> and <a data-link-type="dfn" href="#idp" id="ref-for-idp⑤①">IDP</a> content. The <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#user-agent" id="ref-for-user-agent①③">user agent</a> is assumed to be trusted by the user, and transitively
-trusted by the <a data-link-type="dfn" href="#rp" id="ref-for-rp④⓪">RP</a> and <a data-link-type="dfn" href="#idp" id="ref-for-idp⑤②">IDP</a>.</p>
+     <p><a href="#idp-api-well-known">§ 3.1 The Well-Known File</a> that points to a Manifest</p>
     <li data-md>
-     <p><a data-link-type="dfn" href="#rp" id="ref-for-rp④①">RP</a>s are websites that invoke the FedCM API for the purpose of
-authenticating a user to their account or for requesting information about that user. Since any
-site can invoke the API, <a data-link-type="dfn" href="#rp" id="ref-for-rp④②">RP</a>s cannot necessarily be trusted to limit the user information it
-collects or use that information in an acceptable way.</p>
+     <p>A <a href="#idp-api-manifest">§ 3.2 Manifest</a> endpoint in an agreed upon location that points to</p>
     <li data-md>
-     <p><a data-link-type="dfn" href="#idp" id="ref-for-idp⑤③">IDP</a>s are third-party websites that are the target of a FedCM call to
-attempt to fetch a token. Usually,the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑤④">IDP</a> has a higher level of trust than the <a data-link-type="dfn" href="#rp" id="ref-for-rp④③">RP</a> since it already has the user’s personal information, but it is possible that the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑤⑤">IDP</a> might use the user’s information in non-approved ways. In addition, it is possible that the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑤⑥">IDP</a> specified in the API call may not be an <a data-link-type="dfn" href="#idp" id="ref-for-idp⑤⑦">IDP</a> the user knows about. In this case, it
-likely does not have personal user information in advance.</p>
+     <p>An <a href="#idp-api-accounts-endpoint">§ 3.3 Accounts List</a> endpoint</p>
     <li data-md>
-     <p>A <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="tracker">tracker</dfn> is a third-party website that is not an <a data-link-type="dfn" href="#idp" id="ref-for-idp⑤⑧">IDP</a> but could abuse the FedCM API
-exclusively for the purpose of tracking a user as they visit various websites. A <a data-link-type="dfn" href="#tracker" id="ref-for-tracker">tracker</a> may
-be injected by the <a data-link-type="dfn" href="#rp" id="ref-for-rp④④">RP</a> with or without their knowledge (e.g. injected into one of the various
-script tags that the <a data-link-type="dfn" href="#rp" id="ref-for-rp④⑤">RP</a> embeds that is loaded dynamically), but they usually do not modify
-the UI of the website, so that it is harder to detect the tracking. A <a data-link-type="dfn" href="#tracker" id="ref-for-tracker①">tracker</a> that
-successfully adds tracking scripts for users in various websites may then use this information
-for various purposes, such as selling the information about the user. It should not be possible
-for <a data-link-type="dfn" href="#tracker" id="ref-for-tracker②">trackers</a> to use the FedCM API to track users across the web.</p>
+     <p>A <a href="#idp-api-client-id-metadata-endpoint">§ 3.4 Client Metadata</a> endpoint</p>
+    <li data-md>
+     <p>An <a href="#idp-api-id-assertion-endpoint">§ 3.5 Identity Assertions</a> endpoint</p>
    </ol>
-   <p>Based on the above, the privacy discussion makes the following assumptions:</p>
+   <p>The FedCM API introduces the ability for a site to ask the browser to execute a few different
+network requests. It is important for the browser
+to execute these in such a way that it does not allow the user to be tracked (by an attacker
+impersonating an <a data-link-type="dfn" href="#idp" id="ref-for-idp②①">IDP</a>) on to the site using FedCM. The following table has information about the
+network requests performed:</p>
+<script type="text/typogram">
+┌──────────────────────────┬─────────┬───────────┬──────────┐
+│ Endpoint                 │ cookies │ client_id │ referrer │
+├──────────────────────────┼─────────┼───────────┼──────────┤
+│ manifests                │  no     │  no       │  no      │
+├──────────────────────────┼─────────┼───────────┼──────────┤
+│ accounts_endpoint        │  yes    │  no       │  no      │
+├──────────────────────────┼─────────┼───────────┼──────────┤
+│ client_metadata_endpoint │  no     │  yes      │  yes     │
+├──────────────────────────┼─────────┼───────────┼──────────┤
+│ id_assertion_endpoint    │  yes    │  yes      │  yes     │
+└──────────────────────────┴─────────┴───────────┴──────────┘
+</script>
+   <h3 class="heading settled" data-level="3.1" id="idp-api-well-known"><span class="secno">3.1. </span><span class="content">The Well-Known File</span><a class="self-link" href="#idp-api-well-known"></a></h3>
+   <p class="note" role="note"><span class="marker">NOTE:</span> The browser uses the well-known file to prevent the following attack described <a href="https://github.com/fedidcg/FedCM/issues/230#issuecomment-1067029200">here</a>.</p>
+   <p>The <a data-link-type="dfn" href="#idp" id="ref-for-idp②②">IDP</a> exposes a well-known file in a pre-defined location, specifically at the "web-identity" file at the <a data-link-type="dfn" href="#idp" id="ref-for-idp②③">IDPs</a>'s path ".well-known".</p>
+   <p>The well-known file is fetched:</p>
+   <p>(a) <strong>without</strong> cookies,
+(b) <strong>with</strong> the <a data-link-type="http-header" href="https://w3c.github.io/webappsec-fetch-metadata/#http-headerdef-sec-fetch-dest" id="ref-for-http-headerdef-sec-fetch-dest">Sec-Fetch-Dest</a> header set to <code>webidentity</code>, and
+(c) <strong>without</strong> revealing the <a data-link-type="dfn" href="#rp" id="ref-for-rp①⑧">RP</a> in the <a data-link-type="http-header" href="https://fetch.spec.whatwg.org/#http-origin" id="ref-for-http-origin">Origin</a> or <a href="https://httpwg.org/specs/rfc9110.html#field.referer">Referer</a> headers.</p>
+   <p>For example:</p>
+   <div class="example" id="example-c06ffb02">
+    <a class="self-link" href="#example-c06ffb02"></a> 
+<pre class="language-http highlight"><c- nf>GET</c-> <c- nn>/.well-known/web-identity</c-> <c- kr>HTTP</c-><c- o>/</c-><c- m>1.1</c->
+<c- e>Host</c-><c- o>:</c-> <c- l>idp.example</c->
+<c- e>Accept</c-><c- o>:</c-> <c- l>application/json</c->
+<c- e>Sec-Fetch-Dest</c-><c- o>:</c-> <c- l>webidentity</c->
+</pre>
+   </div>
+   <p>The file is parsed expecting a <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderwellknown" id="ref-for-dictdef-identityproviderwellknown①">IdentityProviderWellKnown</a></code> JSON object.</p>
+   <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderwellknown" id="ref-for-dictdef-identityproviderwellknown②">IdentityProviderWellKnown</a></code> JSON object has the following semantics:</p>
+   <dl>
+    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderWellKnown" data-dfn-type="dict-member" data-export id="dom-identityproviderwellknown-provider_urls"><code>provider_urls</code></dfn> (required), <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString②②">USVString</a>></span>
+    <dd data-md>
+     <p>A list of URLs that points to valid <a href="#idp-api-manifest">§ 3.2 Manifest</a>s.</p>
+   </dl>
+   <h3 class="heading settled" data-level="3.2" id="idp-api-manifest"><span class="secno">3.2. </span><span class="content">Manifest</span><a class="self-link" href="#idp-api-manifest"></a></h3>
+   <p>The config endpoint is an endpoint
+which serves as a discovery device to other endpoints provided by the <a data-link-type="dfn" href="#idp" id="ref-for-idp②④">IDP</a>.</p>
+   <p>The config endpoint is fetched:</p>
+   <p>(a) <strong>without</strong> cookies,
+(b) <strong>with</strong> the <a data-link-type="http-header" href="https://w3c.github.io/webappsec-fetch-metadata/#http-headerdef-sec-fetch-dest" id="ref-for-http-headerdef-sec-fetch-dest①">Sec-Fetch-Dest</a> header set to <code>webidentity</code>,
+(c) <strong>without</strong> revealing the <a data-link-type="dfn" href="#rp" id="ref-for-rp①⑨">RP</a> in the <a data-link-type="http-header" href="https://fetch.spec.whatwg.org/#http-origin" id="ref-for-http-origin①">Origin</a> or <a href="https://httpwg.org/specs/rfc9110.html#field.referer">Referer</a> headers, and
+(c) <strong>without</strong> following <a href="https://httpwg.org/specs/rfc9110.html#field.location">HTTP redirects</a>.</p>
+   <p>For example:</p>
+   <div class="example" id="example-568d2573">
+    <a class="self-link" href="#example-568d2573"></a> 
+<pre class="language-http highlight"><c- nf>GET</c-> <c- nn>/config.json</c-> <c- kr>HTTP</c-><c- o>/</c-><c- m>1.1</c->
+<c- e>Host</c-><c- o>:</c-> <c- l>idp.example</c->
+<c- e>Accept</c-><c- o>:</c-> <c- l>application/json</c->
+<c- e>Sec-Fetch-Dest</c-><c- o>:</c-> <c- l>webidentity</c->
+</pre>
+   </div>
+   <p>The response body must be a JSON object that can be <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-convert-ecmascript-to-idl-value" id="ref-for-dfn-convert-ecmascript-to-idl-value⑤">converted</a> to an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderapiconfig" id="ref-for-dictdef-identityproviderapiconfig⑥">IdentityProviderAPIConfig</a></code> without an exception.</p>
+   <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderapiconfig" id="ref-for-dictdef-identityproviderapiconfig⑦">IdentityProviderAPIConfig</a></code> object’s members have the following semantics:</p>
+   <dl>
+    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderAPIConfig" data-dfn-type="dict-member" data-export id="dom-identityproviderapiconfig-accounts_endpoint"><code>accounts_endpoint</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString②③">USVString</a></span>
+    <dd data-md>
+     <p>A URL that points to an HTTP API that complies with the <a href="#idp-api-accounts-endpoint">§ 3.3 Accounts List</a> API.</p>
+    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderAPIConfig" data-dfn-type="dict-member" data-export id="dom-identityproviderapiconfig-client_metadata_endpoint"><code>client_metadata_endpoint</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString②④">USVString</a></span>
+    <dd data-md>
+     <p>A URL that points to an HTTP API that complies with the <a href="#idp-api-client-id-metadata-endpoint">§ 3.4 Client Metadata</a> API.</p>
+    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderAPIConfig" data-dfn-type="dict-member" data-export id="dom-identityproviderapiconfig-id_assertion_endpoint"><code>id_assertion_endpoint</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString②⑤">USVString</a></span>
+    <dd data-md>
+     <p>A URL that points to an HTTP API that complies with the <a href="#idp-api-id-assertion-endpoint">§ 3.5 Identity Assertions</a> API.</p>
+    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderAPIConfig" data-dfn-type="dict-member" data-export id="dom-identityproviderapiconfig-branding"><code>branding</code></dfn>, <span> of type <a data-link-type="idl-name" href="#dictdef-identityproviderbranding" id="ref-for-dictdef-identityproviderbranding②">IdentityProviderBranding</a></span>
+    <dd data-md>
+     <p>A set of <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderbranding" id="ref-for-dictdef-identityproviderbranding③">IdentityProviderBranding</a></code> options.</p>
+   </dl>
+   <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderbranding" id="ref-for-dictdef-identityproviderbranding④">IdentityProviderBranding</a></code> enables an <a data-link-type="dfn" href="#idp" id="ref-for-idp②⑤">IDP</a> to express their branding
+preferences, which may be used by <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#user-agent" id="ref-for-user-agent⑥">user agents</a> to customize the permission prompt.</p>
+   <p class="note" role="note"><span class="marker">Note:</span> The branding preferences are deliberately designed to be high level
+/ abstract (rather than opinionated about a specific UI structure), to
+enable different <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#user-agent" id="ref-for-user-agent⑦">user agents</a> to offer different UI experiences and
+for them to evolve independently over time.</p>
+   <p>Its members have the following semantics:</p>
+   <dl>
+    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderBranding" data-dfn-type="dict-member" data-export id="dom-identityproviderbranding-background_color"><code>background_color</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString②⑥">USVString</a></span>
+    <dd data-md>
+     <p>Background <a data-link-type="dfn" href="#color" id="ref-for-color">color</a> for <a data-link-type="dfn" href="#idp" id="ref-for-idp②⑥">IDP</a>-branded widgets such as buttons.</p>
+    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderBranding" data-dfn-type="dict-member" data-export id="dom-identityproviderbranding-color"><code>color</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString②⑦">USVString</a></span>
+    <dd data-md>
+     <p><a data-link-type="dfn" href="#color" id="ref-for-color①">color</a> for text on <a data-link-type="dfn" href="#idp" id="ref-for-idp②⑦">IDP</a> branded widgets.</p>
+    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderBranding" data-dfn-type="dict-member" data-export id="dom-identityproviderbranding-icons"><code>icons</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="#dictdef-identityprovidericon" id="ref-for-dictdef-identityprovidericon①">IdentityProviderIcon</a>></span>
+    <dd data-md>
+     <p>A list of <code class="idl"><a data-link-type="idl" href="#dictdef-identityprovidericon" id="ref-for-dictdef-identityprovidericon②">IdentityProviderIcon</a></code> objects.</p>
+   </dl>
+   <p class="note" role="note"><span class="marker">Note:</span> The branding preferences are deliberately designed to be high level
+/ abstract (rather than opinionated about a specific UI structure), to
+enable different <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#user-agent" id="ref-for-user-agent⑧">user agents</a> to offer different UI experiences and
+for them to evolve independently over time.</p>
+   <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-identityprovidericon" id="ref-for-dictdef-identityprovidericon③">IdentityProviderIcon</a></code> has members with the following semantics:</p>
+   <dl>
+    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderIcon" data-dfn-type="dict-member" data-export id="dom-identityprovidericon-url"><code>url</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString②⑧">USVString</a></span>
+    <dd data-md>
+     <p>The url pointing to the icon image, which must be square and single resolution
+(not a multi-resolution .ico). The icon needs to comply with the <a href="https://www.w3.org/TR/appmanifest/#icon-masks">maskable</a> specification.</p>
+    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderIcon" data-dfn-type="dict-member" data-export id="dom-identityprovidericon-size"><code>size</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-unsigned-long" id="ref-for-idl-unsigned-long①">unsigned long</a></span>
+    <dd data-md>
+     <p>The width/height of the square icon. The size may be omitted if the icon is in a vector
+graphic format (like SVG).</p>
+   </dl>
+   <p class="note" role="note"><span class="marker">Note:</span> the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#user-agent" id="ref-for-user-agent⑨">user agent</a> reserves a square size for the icons provided by the developer. If the
+developer provides an icon that is not square, the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#user-agent" id="ref-for-user-agent①⓪">user agent</a> may choose to not display it at
+all, trim the icon and show a square portion of it, or even transform it into a square icon and show
+that.</p>
+   <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="color">color</dfn> is a subset of CSS <a class="production css" data-link-type="type" href="https://drafts.csswg.org/css-color-4/#typedef-color" id="ref-for-typedef-color" title="Expands to: aliceblue | antiquewhite | aqua | aquamarine | azure | beige | bisque | black | blanchedalmond | blue | blueviolet | brown | burlywood | cadetblue | chartreuse | chocolate | coral | cornflowerblue | cornsilk | crimson | currentcolor | cyan | darkblue | darkcyan | darkgoldenrod | darkgray | darkgreen | darkgrey | darkkhaki | darkmagenta | darkolivegreen | darkorange | darkorchid | darkred | darksalmon | darkseagreen | darkslateblue | darkslategray | darkslategrey | darkturquoise | darkviolet | deeppink | deepskyblue | dimgray | dimgrey | dodgerblue | firebrick | floralwhite | forestgreen | fuchsia | gainsboro | ghostwhite | gold | goldenrod | gray | green | greenyellow | grey | honeydew | hotpink | indianred | indigo | ivory | khaki | lavender | lavenderblush | lawngreen | lemonchiffon | lightblue | lightcoral | lightcyan | lightgoldenrodyellow | lightgray | lightgreen | lightgrey | lightpink | lightsalmon | lightseagreen | lightskyblue | lightslategray | lightslategrey | lightsteelblue | lightyellow | lime | limegreen | linen | magenta | maroon | mediumaquamarine | mediumblue | mediumorchid | mediumpurple | mediumseagreen | mediumslateblue | mediumspringgreen | mediumturquoise | mediumvioletred | midnightblue | mintcream | mistyrose | moccasin | navajowhite | navy | none | oldlace | olive | olivedrab | orange | orangered | orchid | palegoldenrod | palegreen | paleturquoise | palevioletred | papayawhip | peachpuff | peru | pink | plum | powderblue | purple | rebeccapurple | red | rosybrown | royalblue | saddlebrown | salmon | sandybrown | seagreen | seashell | sienna | silver | skyblue | slateblue | slategray | slategrey | snow | springgreen | steelblue | tan | teal | thistle | tomato | transparent | turquoise | violet | wheat | white | whitesmoke | yellow | yellowgreen">&lt;color></a> syntax, namely <a class="production css" data-link-type="type" href="https://drafts.csswg.org/css-color-4/#typedef-hex-color" id="ref-for-typedef-hex-color">&lt;hex-color></a>s, <a class="css" data-link-type="maybe" href="https://drafts.csswg.org/css-color-5/#funcdef-hsl" id="ref-for-funcdef-hsl">hsl()</a>s, <a class="css" data-link-type="maybe" href="https://drafts.csswg.org/css-color-5/#funcdef-rgb" id="ref-for-funcdef-rgb">rgb()</a>s and <a class="production css" data-link-type="type" href="https://drafts.csswg.org/css-color-4/#typedef-named-color" id="ref-for-typedef-named-color">&lt;named-color></a>.</p>
+   <p>For example:</p>
+   <div class="example" id="example-450bc437">
+    <a class="self-link" href="#example-450bc437"></a> 
+<pre class="language-json highlight"><c- p>{</c->
+  <c- f>"accounts_endpoint"</c-><c- p>:</c-> <c- u>"/accounts"</c-><c- p>,</c->
+  <c- f>"client_metadata_endpoint"</c-><c- p>:</c-> <c- u>"/metadata"</c-><c- p>,</c->
+  <c- f>"id_assertion_endpoint"</c-><c- p>:</c-> <c- u>"/assertion"</c-><c- p>,</c->
+  <c- f>"branding"</c-><c- p>:</c-> <c- p>{</c->
+    <c- f>"background_color"</c-><c- p>:</c-> <c- u>"green"</c-><c- p>,</c->
+    <c- f>"color"</c-><c- p>:</c-> <c- u>"0xFFEEAA"</c-><c- p>,</c->
+    <c- f>"icons"</c-><c- p>:</c-> <c- p>[{</c->
+      <c- f>"url"</c-><c- p>:</c-> <c- u>"https://idp.example/icon.ico"</c-><c- p>,</c->
+      <c- f>"size"</c-><c- p>:</c-> <c- mi>25</c->
+    <c- p>}]</c->
+  <c- p>}</c->
+<c- p>}</c->
+</pre>
+   </div>
+   <h3 class="heading settled" data-level="3.3" id="idp-api-accounts-endpoint"><span class="secno">3.3. </span><span class="content">Accounts List</span><a class="self-link" href="#idp-api-accounts-endpoint"></a></h3>
+   <p>The accounts list endpoint provides the list of accounts the user has at the <a data-link-type="dfn" href="#idp" id="ref-for-idp②⑧">IDP</a>.</p>
+   <p>The accounts list endpoint is fetched
+(a) <strong>with</strong> <a data-link-type="dfn" href="#idp" id="ref-for-idp②⑨">IDP</a> cookies,
+(b) <strong>with</strong> the <a data-link-type="http-header" href="https://w3c.github.io/webappsec-fetch-metadata/#http-headerdef-sec-fetch-dest" id="ref-for-http-headerdef-sec-fetch-dest②">Sec-Fetch-Dest</a> header set to <code>webidentity</code>,
+(c) <strong>without</strong> revealing the <a data-link-type="dfn" href="#rp" id="ref-for-rp②⓪">RP</a> in the <a data-link-type="http-header" href="https://fetch.spec.whatwg.org/#http-origin" id="ref-for-http-origin②">Origin</a> or <a href="https://httpwg.org/specs/rfc9110.html#field.referer">Referer</a> headers, and
+(d) <strong>without</strong> following <a href="https://httpwg.org/specs/rfc9110.html#field.location">HTTP redirects</a>.</p>
+   <p>For example:</p>
+   <div class="example" id="example-6b4f66fb">
+    <a class="self-link" href="#example-6b4f66fb"></a> 
+<pre class="language-http highlight"><c- nf>GET</c-> <c- nn>/accounts_list</c-> <c- kr>HTTP</c-><c- o>/</c-><c- m>1.1</c->
+<c- e>Host</c-><c- o>:</c-> <c- l>idp.example</c->
+<c- e>Accept</c-><c- o>:</c-> <c- l>application/json</c->
+<c- e>Cookie</c-><c- o>:</c-> <c- l>0x23223</c->
+<c- e>Sec-Fetch-Dest</c-><c- o>:</c-> <c- l>webidentity</c->
+</pre>
+   </div>
+   <p>The response body must be a JSON object that can be <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-convert-ecmascript-to-idl-value" id="ref-for-dfn-convert-ecmascript-to-idl-value⑥">converted</a> to an <code class="idl"><a data-link-type="idl" href="#dictdef-identityprovideraccountlist" id="ref-for-dictdef-identityprovideraccountlist②">IdentityProviderAccountList</a></code> without an exception.</p>
+   <p>Every <code class="idl"><a data-link-type="idl" href="#dictdef-identityprovideraccount" id="ref-for-dictdef-identityprovideraccount⑥">IdentityProviderAccount</a></code> is expected to have members with the following semantics:</p>
+   <dl>
+    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderAccount" data-dfn-type="dict-member" data-export id="dom-identityprovideraccount-id"><code>id</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString②⑨">USVString</a></span>
+    <dd data-md>
+     <p>The account unique identifier.</p>
+    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderAccount" data-dfn-type="dict-member" data-export id="dom-identityprovideraccount-name"><code>name</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString③⓪">USVString</a></span>
+    <dd data-md>
+     <p>The user’s full name.</p>
+    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderAccount" data-dfn-type="dict-member" data-export id="dom-identityprovideraccount-email"><code>email</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString③①">USVString</a></span>
+    <dd data-md>
+     <p>The user’s email address.</p>
+    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderAccount" data-dfn-type="dict-member" data-export id="dom-identityprovideraccount-given_name"><code>given_name</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString③②">USVString</a></span>
+    <dd data-md>
+     <p>The user’s given name.</p>
+    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderAccount" data-dfn-type="dict-member" data-export id="dom-identityprovideraccount-picture"><code>picture</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString③③">USVString</a></span>
+    <dd data-md>
+     <p>URL for the account’s picture.</p>
+    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderAccount" data-dfn-type="dict-member" data-export id="dom-identityprovideraccount-approved_clients"><code>approved_clients</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString③④">USVString</a>></span>
+    <dd data-md>
+     <p>A list of <a data-link-type="dfn" href="#rp" id="ref-for-rp②①">RP</a>s (that gets matched against the requesting <code class="idl"><a data-link-type="idl" href="#dom-identityproviderconfig-clientid" id="ref-for-dom-identityproviderconfig-clientid④">clientId</a></code>) this account is already registered with.
+Used in the <a data-link-type="dfn" href="#request-permission-to-sign-up" id="ref-for-request-permission-to-sign-up②">request permission to sign-up</a> to allow the <a data-link-type="dfn" href="#idp" id="ref-for-idp③⓪">IDP</a> to control whether to show
+the Privacy Policy and the Terms of Service.</p>
+   </dl>
+   <p>For example:</p>
+   <div class="example" id="example-50458aa3">
+    <a class="self-link" href="#example-50458aa3"></a> 
+<pre class="language-json highlight"><c- p>{</c->
+ <c- f>"accounts"</c-><c- p>:</c-> <c- p>[{</c->
+   <c- f>"id"</c-><c- p>:</c-> <c- u>"1234"</c-><c- p>,</c->
+   <c- f>"given_name"</c-><c- p>:</c-> <c- u>"John"</c-><c- p>,</c->
+   <c- f>"name"</c-><c- p>:</c-> <c- u>"John Doe"</c-><c- p>,</c->
+   <c- f>"email"</c-><c- p>:</c-> <c- u>"john_doe@idp.example"</c-><c- p>,</c->
+   <c- f>"picture"</c-><c- p>:</c-> <c- u>"https://idp.example/profile/123"</c-><c- p>,</c->
+   <c- f>"approved_clients"</c-><c- p>:</c-> <c- p>[</c-><c- u>"123"</c-><c- p>,</c-> <c- u>"456"</c-><c- p>,</c-> <c- u>"789"</c-><c- p>]</c->
+  <c- p>},</c-> <c- p>{</c->
+   <c- f>"id"</c-><c- p>:</c-> <c- u>"5678"</c-><c- p>,</c->
+   <c- f>"given_name"</c-><c- p>:</c-> <c- u>"Johnny"</c-><c- p>,</c->
+   <c- f>"name"</c-><c- p>:</c-> <c- u>"Johnny"</c-><c- p>,</c->
+   <c- f>"email"</c-><c- p>:</c-> <c- u>"johnny@idp.example"</c-><c- p>,</c->
+   <c- f>"picture"</c-><c- p>:</c-> <c- f>"https://idp.example/profile/456"</c->
+   <c- f>"approved_clients"</c-><c- p>:</c-> <c- p>[</c-><c- u>"abc"</c-><c- p>,</c-> <c- u>"def"</c-><c- p>,</c-> <c- u>"ghi"</c-><c- p>]</c->
+  <c- p>}]</c->
+<c- p>}</c->
+</pre>
+   </div>
+   <p class="issue" id="issue-ef9f6ef5"><a class="self-link" href="#issue-ef9f6ef5"></a> <a href="https://github.com/fedidcg/FedCM/issues/218">Clarify</a> the IDP API response when the user is not signed in.</p>
+   <h3 class="heading settled" data-level="3.4" id="idp-api-client-id-metadata-endpoint"><span class="secno">3.4. </span><span class="content">Client Metadata</span><a class="self-link" href="#idp-api-client-id-metadata-endpoint"></a></h3>
+   <p>The client metadata endpoint provides metadata about <a data-link-type="dfn" href="#rp" id="ref-for-rp②②">RP</a>s.</p>
+   <p>The client medata endpoint is fetched
+(a) <strong>without</strong> cookies,
+(b) <strong>with</strong> the <a data-link-type="http-header" href="https://w3c.github.io/webappsec-fetch-metadata/#http-headerdef-sec-fetch-dest" id="ref-for-http-headerdef-sec-fetch-dest③">Sec-Fetch-Dest</a> header set to <code>webidentity</code>,
+(c) <strong>with</strong> the <a data-link-type="dfn" href="#rp" id="ref-for-rp②③">RP</a>'s origin in the <a data-link-type="http-header" href="https://fetch.spec.whatwg.org/#http-origin" id="ref-for-http-origin③">Origin</a> header, and
+(d) <strong>without</strong> following <a href="https://httpwg.org/specs/rfc9110.html#field.location">HTTP redirects</a>.</p>
+   <p>The user agent also passes the <strong>client_id</strong>.</p>
+   <p>For example:</p>
+   <div class="example" id="example-2ca55c06">
+    <a class="self-link" href="#example-2ca55c06"></a> 
+<pre class="language-http highlight"><c- nf>GET</c-> <c- nn>/client_medata?client_id=1234</c-> <c- kr>HTTP</c-><c- o>/</c-><c- m>1.1</c->
+<c- e>Host</c-><c- o>:</c-> <c- l>idp.example</c->
+<c- e>Origin</c-><c- o>:</c-> <c- l>https://rp.example/</c->
+<c- e>Accept</c-><c- o>:</c-> <c- l>application/json</c->
+<c- e>Sec-Fetch-Dest</c-><c- o>:</c-> <c- l>webidentity</c->
+</pre>
+   </div>
+   <p>The response body must be a JSON object that can be <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-convert-ecmascript-to-idl-value" id="ref-for-dfn-convert-ecmascript-to-idl-value⑦">converted</a> to an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderclientmetadata" id="ref-for-dictdef-identityproviderclientmetadata②">IdentityProviderClientMetadata</a></code> without an exception.</p>
+   <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderclientmetadata" id="ref-for-dictdef-identityproviderclientmetadata③">IdentityProviderClientMetadata</a></code> object’s members have the following semantics:</p>
+   <dl>
+    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderClientMetadata" data-dfn-type="dict-member" data-export id="dom-identityproviderclientmetadata-privacy_policy_url"><code>privacy_policy_url</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString③⑤">USVString</a></span>
+    <dd data-md>
+     <p>A link to the <a data-link-type="dfn" href="#rp" id="ref-for-rp②④">RP</a>'s Privacy Policy.</p>
+    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderClientMetadata" data-dfn-type="dict-member" data-export id="dom-identityproviderclientmetadata-terms_of_service_url"><code>terms_of_service_url</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString③⑥">USVString</a></span>
+    <dd data-md>
+     <p>A link to the <a data-link-type="dfn" href="#rp" id="ref-for-rp②⑤">RP</a>'s Terms of Service.</p>
+   </dl>
+   <p>For example:</p>
+   <div class="example" id="example-001e0b0d">
+    <a class="self-link" href="#example-001e0b0d"></a> 
+<pre class="language-json highlight"><c- p>{</c->
+  <c- f>"privacy_policy_url"</c-><c- p>:</c-> <c- u>"https://rp.example/clientmetadata/privacy_policy.html"</c-><c- p>,</c->
+  <c- f>"terms_of_service_url"</c-><c- p>:</c-> <c- u>"https://rp.example/clientmetadata/terms_of_service.html"</c->
+<c- p>}</c->
+</pre>
+   </div>
+   <h3 class="heading settled" data-level="3.5" id="idp-api-id-assertion-endpoint"><span class="secno">3.5. </span><span class="content">Identity Assertions</span><a class="self-link" href="#idp-api-id-assertion-endpoint"></a></h3>
+   <p>The identity assertion endpoint is responsible for minting a new token that contains signed assertions about the user.</p>
+   <p>The identity assertion endpoint is fetched</p>
+   <p>(a) as a <strong>POST</strong> request,
+(b) <strong>with</strong> <a data-link-type="dfn" href="#idp" id="ref-for-idp③①">IDP</a> cookies,
+(c) <strong>with</strong> the <a data-link-type="dfn" href="#rp" id="ref-for-rp②⑥">RP</a>'s origin in the <a data-link-type="http-header" href="https://fetch.spec.whatwg.org/#http-origin" id="ref-for-http-origin④">Origin</a> header, and
+(d) <strong>with</strong> the <a data-link-type="http-header" href="https://w3c.github.io/webappsec-fetch-metadata/#http-headerdef-sec-fetch-dest" id="ref-for-http-headerdef-sec-fetch-dest④">Sec-Fetch-Dest</a> header set to <code>webidentity</code>,
+(e) <strong>without</strong> following <a href="https://httpwg.org/specs/rfc9110.html#field.location">HTTP redirects</a>.</p>
+   <p>It will also contain the following parameters in the request body <code>application/x-www-form-urlencoded</code>:</p>
+   <dl>
+    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="id_assertion_endpoint_request" data-dfn-type="argument" data-export id="dom-id_assertion_endpoint_request-client_id"><code>client_id</code></dfn>
+    <dd data-md>
+     <p>The <a data-link-type="dfn" href="#rp" id="ref-for-rp②⑦">RP</a>'s unique identifier from the <a data-link-type="dfn" href="#idp" id="ref-for-idp③②">IDP</a></p>
+    <dt data-md><dfn class="idl-code" data-dfn-for="id_assertion_endpoint_request" data-dfn-type="argument" data-export id="dom-id_assertion_endpoint_request-nonce"><code>nonce</code><a class="self-link" href="#dom-id_assertion_endpoint_request-nonce"></a></dfn>
+    <dd data-md>
+     <p>The request nonce</p>
+    <dt data-md><dfn class="idl-code" data-dfn-for="id_assertion_endpoint_request" data-dfn-type="argument" data-export id="dom-id_assertion_endpoint_request-account_id"><code>account_id</code><a class="self-link" href="#dom-id_assertion_endpoint_request-account_id"></a></dfn>
+    <dd data-md>
+     <p>The account identifier that was selected.</p>
+    <dt data-md><dfn class="idl-code" data-dfn-for="id_assertion_endpoint_request" data-dfn-type="argument" data-export id="dom-id_assertion_endpoint_request-disclosure_text_shown"><code>disclosure_text_shown</code><a class="self-link" href="#dom-id_assertion_endpoint_request-disclosure_text_shown"></a></dfn>
+    <dd data-md>
+     <p>Whether the user agent has explicitly shown to the user what specific information the <a data-link-type="dfn" href="#idp" id="ref-for-idp③③">IDP</a> intends to share with the <a data-link-type="dfn" href="#rp" id="ref-for-rp②⑧">RP</a> (e.g. "idp.example will share your name, email...
+with rp.example"), used by the <a data-link-type="dfn" href="#request-permission-to-sign-up" id="ref-for-request-permission-to-sign-up③">request permission to sign-up</a> algorithm for new users but
+not by the <a data-link-type="dfn" href="#sign-in" id="ref-for-sign-in③">sign-in</a> algorithm for returning users.</p>
+   </dl>
+   <p>For example:</p>
+   <div class="example" id="example-46007906">
+    <a class="self-link" href="#example-46007906"></a> 
+<pre class="language-http highlight"><c- nf>POST</c-> <c- nn>/fedcm_assertion_endpoint</c-> <c- kr>HTTP</c-><c- o>/</c-><c- m>1.1</c->
+<c- e>Host</c-><c- o>:</c-> <c- l>idp.example</c->
+<c- e>Origin</c-><c- o>:</c-> <c- l>https://rp.example/</c->
+<c- e>Content-Type</c-><c- o>:</c-> <c- l>application/x-www-form-urlencoded</c->
+<c- e>Cookie</c-><c- o>:</c-> <c- l>0x23223</c->
+<c- e>Sec-Fetch-Dest</c-><c- o>:</c-> <c- l>webidentity</c->
+account_id=123&amp;client_id=client1234&amp;nonce=Ct60bD&amp;disclosure_text_shown=true
+</pre>
+   </div>
+   <div class="idp-normative-text"> An <a data-link-type="dfn" href="#idp" id="ref-for-idp③④">IDP</a> MUST check the <a data-link-type="http-header" href="https://fetch.spec.whatwg.org/#http-origin" id="ref-for-http-origin⑤">Origin</a> header to ensure that a malicious <a data-link-type="dfn" href="#rp" id="ref-for-rp②⑨">RP</a> does
+not receive an ID token corresponding to another <a data-link-type="dfn" href="#rp" id="ref-for-rp③⓪">RP</a>. In other words, the <a data-link-type="dfn" href="#idp" id="ref-for-idp③⑤">IDP</a> MUST check that
+the <a data-link-type="http-header" href="https://fetch.spec.whatwg.org/#http-origin" id="ref-for-http-origin⑥">Origin</a> header value is represented by the <code class="idl"><a data-link-type="idl" href="#dom-identityproviderconfig-clientid" id="ref-for-dom-identityproviderconfig-clientid⑤">clientId</a></code>. As the <code class="idl"><a data-link-type="idl" href="#dom-identityproviderconfig-clientid" id="ref-for-dom-identityproviderconfig-clientid⑥">clientId</a></code> are <a data-link-type="dfn" href="#idp" id="ref-for-idp③⑥">IDP</a>-specific, the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#user-agent" id="ref-for-user-agent①①">user agent</a> cannot perform this check. </div>
+   <p class="note" role="note"><span class="marker">Note:</span> An <a data-link-type="dfn" href="#idp" id="ref-for-idp③⑦">IDP</a> should validate the nonce, if present, to prevent CSRF-style attacks.</p>
+   <p>The response body must be a JSON object that can be <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-convert-ecmascript-to-idl-value" id="ref-for-dfn-convert-ecmascript-to-idl-value⑧">converted</a> to an <code class="idl"><a data-link-type="idl" href="#dictdef-identityprovidertoken" id="ref-for-dictdef-identityprovidertoken①">IdentityProviderToken</a></code> without an exception.</p>
+   <p>Every <code class="idl"><a data-link-type="idl" href="#dictdef-identityprovidertoken" id="ref-for-dictdef-identityprovidertoken②">IdentityProviderToken</a></code> is expected to have members with the following semantics:</p>
+   <dl>
+    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderToken" data-dfn-type="dict-member" data-export id="dom-identityprovidertoken-token"><code>token</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString③⑦">USVString</a></span>
+    <dd data-md>
+     <p>The resulting token.</p>
+   </dl>
+   <p>The content of the <code class="idl"><a data-link-type="idl" href="#dom-identityprovidertoken-token" id="ref-for-dom-identityprovidertoken-token③">token</a></code> is opaque to the user agent and can contain
+anything that the <a data-link-type="dfn" href="#idp" id="ref-for-idp③⑧">IDP</a> would like to pass to the <a data-link-type="dfn" href="#rp" id="ref-for-rp③①">RP</a> to facilitate the login. For this reason the <a data-link-type="dfn" href="#rp" id="ref-for-rp③②">RP</a> is expected to be the party responsible for validating the <code class="idl"><a data-link-type="idl" href="#dom-identityprovidertoken-token" id="ref-for-dom-identityprovidertoken-token④">token</a></code> passed
+along from the <a data-link-type="dfn" href="#idp" id="ref-for-idp③⑨">IDP</a> using the appropriate token validation
+algorithms defined. One example of how this might be done is defined 
+in <a href="https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation">OIDC Connect Core § IDTokenValidation</a>.</p>
+   <p class="note" role="note"><span class="marker">NOTE:</span> For <a data-link-type="dfn" href="#idp" id="ref-for-idp④⓪">IDPs</a>, it is worth considering how <a href="https://github.com/fedidcg/FedCM/issues/314">portable</a> accounts are.
+Portability is left entirely up to <a data-link-type="dfn" href="#idp" id="ref-for-idp④①">IDPs</a>, who can choose
+between a variety of different mechanisms to accomplish it
+(e.g. <a href="https://openid.net/specs/openid-connect-account-porting-1_0.html">OIDC’s Account Porting</a>).</p>
+   <p>For example:</p>
+   <div class="example" id="example-9a912242">
+    <a class="self-link" href="#example-9a912242"></a> 
+<pre class="language-json highlight"><c- p>{</c->
+  <c- f>"token"</c-> <c- p>:</c-> <c- u>"eyJC...J9.eyJzdWTE2...MjM5MDIyfQ.SflV_adQssw....5c"</c->
+<c- p>}</c->
+</pre>
+   </div>
+   <h3 class="heading settled" data-level="3.6" id="browser-api-backwards-compatibility"><span class="secno">3.6. </span><span class="content">Backwards Compatibility</span><a class="self-link" href="#browser-api-backwards-compatibility"></a></h3>
+   <p class="note" role="note"><span class="marker">Note:</span> go over how we are planning to deal with backwards compatibility.</p>
+   <h2 class="heading settled" data-level="4" id="permissions-policy-integration"><span class="secno">4. </span><span class="content">Permissions Policy Integration</span><a class="self-link" href="#permissions-policy-integration"></a></h2>
+   <p>FedCM defines a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-permissions-policy/#policy-controlled-feature" id="ref-for-policy-controlled-feature">policy-controlled feature</a> identified by the string <code>"<dfn class="dfn-paneled" data-dfn-type="dfn" data-export id="identity-credentials-get">identity-credentials-get</dfn>"</code>.
+Its <a data-link-type="dfn" href="https://w3c.github.io/webappsec-permissions-policy/#policy-controlled-feature-default-allowlist" id="ref-for-policy-controlled-feature-default-allowlist">default allowlist</a> is <code>"self"</code>.</p>
+   <p>A <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document" id="ref-for-document">Document</a></code>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy" id="ref-for-concept-document-permissions-policy①">permissions policy</a> determines whether any content
+in that document is allowed to obtain a credential object using the <a href="#browser-api">Browser API</a>.
+Attempting to invoke <code><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①">navigator.credentials.get({identity:..., ...})</a></code> in documents that are not <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use" id="ref-for-allowed-to-use">allowed to use</a> the <a data-link-type="dfn" href="#identity-credentials-get" id="ref-for-identity-credentials-get">identity-credentials-get</a> feature will result
+in <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#a-promise-rejected-with" id="ref-for-a-promise-rejected-with">a promise rejected with</a> a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException④">DOMException</a></code>.</p>
+   <p>This restriction can be controlled using the mechanisms described in <a data-link-type="biblio" href="https://w3c.github.io/webappsec-permissions-policy"><cite>Permissions Policy</cite></a>.</p>
+   <p class="note" role="note"><span class="marker">Note:</span> Algorithms specified in <a data-link-type="biblio" href="https://w3c.github.io/webappsec-credential-management/"><cite>Credential Management Level 1</cite></a> perform the actual
+permissions policy evaluation. This is because such policy evaluation needs to
+occur when there is access to the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#current-settings-object" id="ref-for-current-settings-object">current settings object</a>. The <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-ordinary-object-internal-methods-and-internal-slots" id="ref-for-sec-ordinary-object-internal-methods-and-internal-slots②">internal method</a>s
+modified by this specification do not have such access since they are invoked <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/infrastructure.html#in-parallel" id="ref-for-in-parallel⑤">in parallel</a> by <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#credentialscontainer" id="ref-for-credentialscontainer①">CredentialsContainer</a></code>'s <a data-link-type="abstract-op" href="https://w3c.github.io/webappsec-credential-management/#abstract-opdef-request-a-credential" id="ref-for-abstract-opdef-request-a-credential①">Request a <code>Credential</code></a> abstract operation.</p>
+   <h2 class="heading settled" data-level="5" id="security"><span class="secno">5. </span><span class="content">Security</span><a class="self-link" href="#security"></a></h2>
+   <p>This section provides a few of the security considerations for the FedCM API. Note that there is a
+separate section for <a href="#privacy">§ 6 Privacy</a> considerations.</p>
+   <h3 class="heading settled" data-level="5.1" id="content-security-policy"><span class="secno">5.1. </span><span class="content">Content Security Policy</span><a class="self-link" href="#content-security-policy"></a></h3>
+   <p>The first fetches triggered by the FedCM API are the manifest list, which is public, and the
+config file. Imagine a malicious script included by (and running as) the <a data-link-type="dfn" href="#rp" id="ref-for-rp③③">RP</a> attempting to
+execute the FedCM API calls to a malicious <a data-link-type="dfn" href="#idp" id="ref-for-idp④②">IDP</a>, one which is not trusted by the <a data-link-type="dfn" href="#rp" id="ref-for-rp③④">RP</a>. If the
+call is successful, this would introduce browser UI on the <a data-link-type="dfn" href="#rp" id="ref-for-rp③⑤">RP</a> with sign in options into a
+malicious <a data-link-type="dfn" href="#idp" id="ref-for-idp④③">IDP</a>. This malicious<a data-link-type="dfn" href="#idp" id="ref-for-idp④④">IDP</a> could then attempt to trick the user. The protection
+against this attack is the <a data-link-type="biblio" href="https://w3c.github.io/webappsec-csp/"><cite>Content Security Policy Level 3</cite></a> check, which would fail because the origin of the manifest of
+the malicious <a data-link-type="dfn" href="#idp" id="ref-for-idp④⑤">IDP</a> would not be an origin included in the allowlist specified by the <a data-link-type="biblio" href="https://w3c.github.io/webappsec-csp/"><cite>Content Security Policy Level 3</cite></a> of
+the <a data-link-type="dfn" href="#rp" id="ref-for-rp③⑥">RP</a>, hence preventing the undesired FedCM UI from being shown. Since any subsequent fetches
+are same origin with respect to the config file or at least dependent on the contents of the
+config file, they do not require additional checks.</p>
+   <p>The non-same-origin fetches include, for example, the brand icon. The user agent does not perform a <a data-link-type="biblio" href="https://w3c.github.io/webappsec-csp/"><cite>Content Security Policy Level 3</cite></a> check on these because they are directly specified from the manifest. In addition, the
+rendering of this image is performed by the user agent, and as such this image cannot affect the <a data-link-type="dfn" href="#rp" id="ref-for-rp③⑦">RP</a> site nor can they be inspected by the <a data-link-type="dfn" href="#rp" id="ref-for-rp③⑧">RP</a> in any way.</p>
+   <h3 class="heading settled" data-level="5.2" id="sec-fetch-dest-header"><span class="secno">5.2. </span><span class="content">Sec-Fetch-Dest Header</span><a class="self-link" href="#sec-fetch-dest-header"></a></h3>
+   <p><em>This section is non-normative.</em></p>
+   <p>The FedCM API introduces several non-static endpoints on the <a data-link-type="dfn" href="#idp" id="ref-for-idp④⑥">IDP</a>, so these need to be protected
+from XSS attacks. In order to do so, the FedCM API introduces a new value for the <a data-link-type="http-header" href="https://w3c.github.io/webappsec-fetch-metadata/#http-headerdef-sec-fetch-dest" id="ref-for-http-headerdef-sec-fetch-dest⑤">Sec-Fetch-Dest</a> header, a <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#forbidden-request-header" id="ref-for-forbidden-request-header">forbidden request-header</a>. The requests initiated by the FedCM API
+have a <code>webidentity</code> value for this header. The value cannot be set by random websites, so the <a data-link-type="dfn" href="#idp" id="ref-for-idp④⑦">IDP</a> can be confident that the request was originated by the FedCM browser rather than sent by a
+websites trying to run an XSS attack. An <a data-link-type="dfn" href="#idp" id="ref-for-idp④⑧">IDP</a> must to check for this header’s value in the
+credentialed requests it receives, which ensures that the request was initiated by the user agent,
+based on the FedCM API. A malicious actor cannot spam FedCM API calls, so this is sufficient
+protection for the new <a data-link-type="dfn" href="#idp" id="ref-for-idp④⑨">IDP</a> endpoints.</p>
+   <h3 class="heading settled" data-level="5.3" id="browser-surface-impersonation"><span class="secno">5.3. </span><span class="content">Browser Surface Impersonation</span><a class="self-link" href="#browser-surface-impersonation"></a></h3>
+   <p>The FedCM API introduces new (trusted) user agent UI, and the user agent may choose to show the UI
+entirely on top of the page’s contents, if anything because the page was the one responsible for
+this UI. This introduces a potential concern of a malicious site to try to replicate the FedCM UI,
+gain the user’s trust that the user is interacting with a trusted browser surface, and gather
+information from the user that they would only give to the browser rather than the site (e.g.
+usernames/passwords of <strong>another</strong> site). This would be hard to achieve because the FedCM UI uses
+metadata about the user accounts of the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑤⓪">IDP</a>, which the malicious website doesn’t have access to.
+If this is a malicious site, it would not know the user accounts unless the user is already
+compromised. However, the site could have some guess of the user identity, so the browser is
+encouraged to provide UI that is hard to replicate and that clearly presents the domains of the
+parties involved in the website’s FedCM call. Overall, an attacker trying to impersonate the browser
+using exclusively UI that is accessible to the content area (e.g. iframes) to attempt to retrieve
+sensitive information from the user would be noticeably different from the FedCM UI. Finally,
+because the FedCM UI can only be queried from the top-level frame (or potentially from an iframe
+with explicit permission from the top-level frame), the priviledged UI surface is only shown when
+the top-level frame wants it so. A sneaky iframe cannot force the FedCM UI to occlude important
+content from the main page.</p>
+   <h2 class="heading settled" data-level="6" id="privacy"><span class="secno">6. </span><span class="content">Privacy</span><a class="self-link" href="#privacy"></a></h2>
+   <p>This section is intended to provide a comprehensive overview of the privacy risks associated with
+federated identity on the web for the purpose of measuring the privacy risks and benefits of
+proposed browser intermediation designs.</p>
+   <h3 class="heading settled" data-level="6.1" id="privacy-principals"><span class="secno">6.1. </span><span class="content">Principals</span><a class="self-link" href="#privacy-principals"></a></h3>
+   <p>This section describes the four principals that would participate in an invocation of the API and
+expectations around their behavior.</p>
+   <ol>
+    <li data-md>
+     <p>The <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#user-agent" id="ref-for-user-agent①②">user agent</a> implements <a href="#browser-api">§ 2 The Browser API</a> and controls the execution contexts for the <a data-link-type="dfn" href="#rp" id="ref-for-rp③⑨">RP</a> and <a data-link-type="dfn" href="#idp" id="ref-for-idp⑤①">IDP</a> content. The <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#user-agent" id="ref-for-user-agent①③">user agent</a> is assumed to be trusted by the user, and transitively
+trusted by the <a data-link-type="dfn" href="#rp" id="ref-for-rp④⓪">RP</a> and <a data-link-type="dfn" href="#idp" id="ref-for-idp⑤②">IDP</a>.</p>
+    <li data-md>
+     <p><a data-link-type="dfn" href="#rp" id="ref-for-rp④①">RP</a>s are websites that invoke the FedCM API for the purpose of
+authenticating a user to their account or for requesting information about that user. Since any
+site can invoke the API, <a data-link-type="dfn" href="#rp" id="ref-for-rp④②">RP</a>s cannot necessarily be trusted to limit the user information it
+collects or use that information in an acceptable way.</p>
+    <li data-md>
+     <p><a data-link-type="dfn" href="#idp" id="ref-for-idp⑤③">IDP</a>s are third-party websites that are the target of a FedCM call to
+attempt to fetch a token. Usually,the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑤④">IDP</a> has a higher level of trust than the <a data-link-type="dfn" href="#rp" id="ref-for-rp④③">RP</a> since it already has the user’s personal information, but it is possible that the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑤⑤">IDP</a> might use the user’s information in non-approved ways. In addition, it is possible that the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑤⑥">IDP</a> specified in the API call may not be an <a data-link-type="dfn" href="#idp" id="ref-for-idp⑤⑦">IDP</a> the user knows about. In this case, it
+likely does not have personal user information in advance.</p>
+    <li data-md>
+     <p>A <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="tracker">tracker</dfn> is a third-party website that is not an <a data-link-type="dfn" href="#idp" id="ref-for-idp⑤⑧">IDP</a> but could abuse the FedCM API
+exclusively for the purpose of tracking a user as they visit various websites. A <a data-link-type="dfn" href="#tracker" id="ref-for-tracker">tracker</a> may
+be injected by the <a data-link-type="dfn" href="#rp" id="ref-for-rp④④">RP</a> with or without their knowledge (e.g. injected into one of the various
+script tags that the <a data-link-type="dfn" href="#rp" id="ref-for-rp④⑤">RP</a> embeds that is loaded dynamically), but they usually do not modify
+the UI of the website, so that it is harder to detect the tracking. A <a data-link-type="dfn" href="#tracker" id="ref-for-tracker①">tracker</a> that
+successfully adds tracking scripts for users in various websites may then use this information
+for various purposes, such as selling the information about the user. It should not be possible
+for <a data-link-type="dfn" href="#tracker" id="ref-for-tracker②">trackers</a> to use the FedCM API to track users across the web.</p>
+   </ol>
+   <p>Based on the above, the privacy discussion makes the following assumptions:</p>
    <ol>
     <li data-md>
      <p>It is not acceptable for an <a data-link-type="dfn" href="#rp" id="ref-for-rp④⑥">RP</a>, <a data-link-type="dfn" href="#idp" id="ref-for-idp⑤⑨">IDP</a>, or <a data-link-type="dfn" href="#tracker" id="ref-for-tracker③">tracker</a> to learn that a specific user visited a
@@ -2138,7 +2139,7 @@ <h4 class="heading settled" data-level="6.3.1" id="manifest-fingerprinting"><spa
    <p>Here, the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑥③">RP</a> includes identifies itself when fetching the manifest from the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑦⑧">IDP</a>. This
 coupled with the credentialed fetches that the FedCM API performs would enable the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑦⑨">IDP</a> to easily
 track the website that the user is visiting, without requiring any permission from the user. Our
-mitigation to this problem is to use the <a href="#idp-api-well-known">§ 2.1 The Well-Known File</a> file. We enforce a specifically named
+mitigation to this problem is to use the <a href="#idp-api-well-known">§ 3.1 The Well-Known File</a> file. We enforce a specifically named
 file at the root of the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑧⓪">IDP</a>'s domain to ensure that the file name does not introduce
 fingerprints about the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑥④">RP</a> being visited.</p>
    <p>The whole manifest could be in this location, but we instead choose to only point to the real
@@ -3051,164 +3052,160 @@ <h3 class="no-ref no-num heading settled" id="w3c-conformant-algorithms"><span c
   <h2 class="no-num no-ref heading settled" id="index"><span class="content">Index</span><a class="self-link" href="#index"></a></h2>
   <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="content">Terms defined by this specification</span><a class="self-link" href="#index-defined-here"></a></h3>
   <ul class="index">
-   <li><a href="#dom-identityprovideraccountlist-accounts">accounts</a><span>, in § 2.3</span>
-   <li><a href="#dom-identityproviderapiconfig-accounts_endpoint">accounts_endpoint</a><span>, in § 2.2</span>
-   <li><a href="#accountstate">AccountState</a><span>, in § 3.1</span>
-   <li><a href="#dom-identityprovideraccount-approved_clients">approved_clients</a><span>, in § 2.3</span>
-   <li><a href="#dom-identityproviderbranding-background_color">background_color</a><span>, in § 2.2</span>
-   <li><a href="#dom-identityproviderapiconfig-branding">branding</a><span>, in § 2.2</span>
-   <li><a href="#dom-identityproviderconfig-clientid">clientId</a><span>, in § 3.3</span>
-   <li><a href="#dom-identityproviderapiconfig-client_metadata_endpoint">client_metadata_endpoint</a><span>, in § 2.2</span>
+   <li><a href="#dom-identityprovideraccountlist-accounts">accounts</a><span>, in § 2.2.2</span>
+   <li><a href="#dom-identityproviderapiconfig-accounts_endpoint">accounts_endpoint</a><span>, in § 3.2</span>
+   <li><a href="#accountstate">AccountState</a><span>, in § 2.1</span>
+   <li><a href="#dom-identityprovideraccount-approved_clients">approved_clients</a><span>, in § 3.3</span>
+   <li><a href="#dom-identityproviderbranding-background_color">background_color</a><span>, in § 3.2</span>
+   <li><a href="#dom-identityproviderapiconfig-branding">branding</a><span>, in § 3.2</span>
+   <li><a href="#dom-identityproviderconfig-clientid">clientId</a><span>, in § 2.2.1</span>
+   <li><a href="#dom-identityproviderapiconfig-client_metadata_endpoint">client_metadata_endpoint</a><span>, in § 3.2</span>
    <li>
     color
     <ul>
-     <li><a href="#color">definition of</a><span>, in § 2.2</span>
-     <li><a href="#dom-identityproviderbranding-color">dict-member for IdentityProviderBranding</a><span>, in § 2.2</span>
+     <li><a href="#color">definition of</a><span>, in § 3.2</span>
+     <li><a href="#dom-identityproviderbranding-color">dict-member for IdentityProviderBranding</a><span>, in § 3.2</span>
     </ul>
-   <li><a href="#compute-account-state">compute account state</a><span>, in § 3.4</span>
-   <li><a href="#computing-the-manifest-url">computing the manifest URL</a><span>, in § 3.4</span>
-   <li><a href="#dom-identityproviderconfig-configurl">configURL</a><span>, in § 3.3</span>
-   <li><a href="#create-an-identitycredential">create an IdentityCredential</a><span>, in § 3.4</span>
-   <li><a href="#dom-identitycredential-discoverfromexternalsource-slot">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a><span>, in § 3.4</span>
-   <li><a href="#dom-identityprovideraccount-email">email</a><span>, in § 2.3</span>
-   <li><a href="#extract-the-json-fetch-response">extract the JSON fetch response</a><span>, in § 3.4</span>
-   <li><a href="#fetch-an-identity-assertion">fetch an identity assertion</a><span>, in § 3.4</span>
-   <li><a href="#fetch-request">fetch request</a><span>, in § 3.4</span>
-   <li><a href="#fetch-the-account-picture">fetch the account picture</a><span>, in § 3.4</span>
-   <li><a href="#fetch-the-accounts-list">fetch the accounts list</a><span>, in § 3.4</span>
-   <li><a href="#fetch-the-client-metadata">fetch the client metadata</a><span>, in § 3.4</span>
-   <li><a href="#fetch-the-config-file">fetch the config file</a><span>, in § 3.4</span>
-   <li><a href="#dom-identityprovideraccount-given_name">given_name</a><span>, in § 2.3</span>
-   <li><a href="#dom-identityproviderbranding-icons">icons</a><span>, in § 2.2</span>
-   <li><a href="#dom-identityprovideraccount-id">id</a><span>, in § 2.3</span>
-   <li><a href="#dom-identityproviderapiconfig-id_assertion_endpoint">id_assertion_endpoint</a><span>, in § 2.2</span>
-   <li><a href="#dom-credentialrequestoptions-identity">identity</a><span>, in § 3.3</span>
-   <li><a href="#identitycredential">IdentityCredential</a><span>, in § 3.2</span>
-   <li><a href="#dictdef-identitycredentialrequestoptions">IdentityCredentialRequestOptions</a><span>, in § 3.3</span>
+   <li><a href="#compute-account-state">compute account state</a><span>, in § 2.1</span>
+   <li><a href="#computing-the-manifest-url">computing the manifest URL</a><span>, in § 2.2.2</span>
+   <li><a href="#dom-identityproviderconfig-configurl">configURL</a><span>, in § 2.2.1</span>
+   <li><a href="#create-an-identitycredential">create an IdentityCredential</a><span>, in § 2.2.2</span>
+   <li><a href="#dom-identitycredential-discoverfromexternalsource-slot">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a><span>, in § 2.2.2</span>
+   <li><a href="#dom-identityprovideraccount-email">email</a><span>, in § 3.3</span>
+   <li><a href="#extract-the-json-fetch-response">extract the JSON fetch response</a><span>, in § 2.2.2</span>
+   <li><a href="#fetch-an-identity-assertion">fetch an identity assertion</a><span>, in § 2.2.2</span>
+   <li><a href="#fetch-request">fetch request</a><span>, in § 2.2.2</span>
+   <li><a href="#fetch-the-account-picture">fetch the account picture</a><span>, in § 2.2.2</span>
+   <li><a href="#fetch-the-accounts-list">fetch the accounts list</a><span>, in § 2.2.2</span>
+   <li><a href="#fetch-the-client-metadata">fetch the client metadata</a><span>, in § 2.2.2</span>
+   <li><a href="#fetch-the-config-file">fetch the config file</a><span>, in § 2.2.2</span>
+   <li><a href="#dom-identityprovideraccount-given_name">given_name</a><span>, in § 3.3</span>
+   <li><a href="#dom-identityproviderbranding-icons">icons</a><span>, in § 3.2</span>
+   <li><a href="#dom-identityprovideraccount-id">id</a><span>, in § 3.3</span>
+   <li><a href="#dom-identityproviderapiconfig-id_assertion_endpoint">id_assertion_endpoint</a><span>, in § 3.2</span>
+   <li><a href="#dom-credentialrequestoptions-identity">identity</a><span>, in § 2.2.1</span>
+   <li><a href="#identitycredential">IdentityCredential</a><span>, in § 2.2</span>
+   <li><a href="#dictdef-identitycredentialrequestoptions">IdentityCredentialRequestOptions</a><span>, in § 2.2.1</span>
    <li><a href="#identity-credentials-get">identity-credentials-get</a><span>, in § 4</span>
-   <li><a href="#dictdef-identityprovideraccount">IdentityProviderAccount</a><span>, in § 2.3</span>
-   <li><a href="#dictdef-identityprovideraccountlist">IdentityProviderAccountList</a><span>, in § 2.3</span>
-   <li><a href="#dictdef-identityproviderapiconfig">IdentityProviderAPIConfig</a><span>, in § 2.2</span>
-   <li><a href="#dictdef-identityproviderbranding">IdentityProviderBranding</a><span>, in § 2.2</span>
-   <li><a href="#dictdef-identityproviderclientmetadata">IdentityProviderClientMetadata</a><span>, in § 2.4</span>
-   <li><a href="#dictdef-identityproviderconfig">IdentityProviderConfig</a><span>, in § 3.3</span>
-   <li><a href="#dictdef-identityprovidericon">IdentityProviderIcon</a><span>, in § 2.2</span>
-   <li><a href="#dictdef-identityprovidertoken">IdentityProviderToken</a><span>, in § 2.5</span>
-   <li><a href="#dictdef-identityproviderwellknown">IdentityProviderWellKnown</a><span>, in § 2</span>
+   <li><a href="#dictdef-identityprovideraccount">IdentityProviderAccount</a><span>, in § 2.2.2</span>
+   <li><a href="#dictdef-identityprovideraccountlist">IdentityProviderAccountList</a><span>, in § 2.2.2</span>
+   <li><a href="#dictdef-identityproviderapiconfig">IdentityProviderAPIConfig</a><span>, in § 2.2.2</span>
+   <li><a href="#dictdef-identityproviderbranding">IdentityProviderBranding</a><span>, in § 2.2.2</span>
+   <li><a href="#dictdef-identityproviderclientmetadata">IdentityProviderClientMetadata</a><span>, in § 2.2.2</span>
+   <li><a href="#dictdef-identityproviderconfig">IdentityProviderConfig</a><span>, in § 2.2.1</span>
+   <li><a href="#dictdef-identityprovidericon">IdentityProviderIcon</a><span>, in § 2.2.2</span>
+   <li><a href="#dictdef-identityprovidertoken">IdentityProviderToken</a><span>, in § 2.2.2</span>
+   <li><a href="#dictdef-identityproviderwellknown">IdentityProviderWellKnown</a><span>, in § 2.2.2</span>
    <li><a href="#idp">IDP</a><span>, in § 1</span>
-   <li><a href="#dom-identityprovideraccount-name">name</a><span>, in § 2.3</span>
-   <li><a href="#dom-identityproviderconfig-nonce">nonce</a><span>, in § 3.3</span>
-   <li><a href="#parse-url">parse url</a><span>, in § 3.4</span>
-   <li><a href="#dom-identityprovideraccount-picture">picture</a><span>, in § 2.3</span>
-   <li><a href="#dom-identityproviderclientmetadata-privacy_policy_url">privacy_policy_url</a><span>, in § 2.4</span>
-   <li><a href="#dom-identitycredentialrequestoptions-providers">providers</a><span>, in § 3.3</span>
-   <li><a href="#dom-identityproviderwellknown-provider_urls">provider_urls</a><span>, in § 2</span>
-   <li><a href="#request-permission-to-sign-up">request permission to sign-up</a><span>, in § 3.4</span>
+   <li><a href="#dom-identityprovideraccount-name">name</a><span>, in § 3.3</span>
+   <li><a href="#dom-identityproviderconfig-nonce">nonce</a><span>, in § 2.2.1</span>
+   <li><a href="#parse-url">parse url</a><span>, in § 2.2.2</span>
+   <li><a href="#dom-identityprovideraccount-picture">picture</a><span>, in § 3.3</span>
+   <li><a href="#dom-identityproviderclientmetadata-privacy_policy_url">privacy_policy_url</a><span>, in § 3.4</span>
+   <li><a href="#dom-identitycredentialrequestoptions-providers">providers</a><span>, in § 2.2.1</span>
+   <li><a href="#dom-identityproviderwellknown-provider_urls">provider_urls</a><span>, in § 3.1</span>
+   <li><a href="#request-permission-to-sign-up">request permission to sign-up</a><span>, in § 2.2.2</span>
    <li><a href="#rp">RP</a><span>, in § 1</span>
-   <li><a href="#select-an-account">select an account</a><span>, in § 3.4</span>
-   <li><a href="#sign-in">sign-in</a><span>, in § 3.4</span>
-   <li><a href="#dom-identityprovidericon-size">size</a><span>, in § 2.2</span>
-   <li><a href="#state-machine-map">state machine map</a><span>, in § 3.1</span>
-   <li><a href="#dom-identityproviderclientmetadata-terms_of_service_url">terms_of_service_url</a><span>, in § 2.4</span>
+   <li><a href="#select-an-account">select an account</a><span>, in § 2.2.2</span>
+   <li><a href="#sign-in">sign-in</a><span>, in § 2.1</span>
+   <li><a href="#dom-identityprovidericon-size">size</a><span>, in § 3.2</span>
+   <li><a href="#state-machine-map">state machine map</a><span>, in § 2.1</span>
+   <li><a href="#dom-identityproviderclientmetadata-terms_of_service_url">terms_of_service_url</a><span>, in § 3.4</span>
    <li>
     token
     <ul>
-     <li><a href="#dom-identitycredential-token">attribute for IdentityCredential</a><span>, in § 3.2</span>
-     <li><a href="#dom-identityprovidertoken-token">dict-member for IdentityProviderToken</a><span>, in § 2.5</span>
+     <li><a href="#dom-identitycredential-token">attribute for IdentityCredential</a><span>, in § 2.2</span>
+     <li><a href="#dom-identityprovidertoken-token">dict-member for IdentityProviderToken</a><span>, in § 3.5</span>
     </ul>
    <li><a href="#tracker">tracker</a><span>, in § 6.1</span>
-   <li><a href="#dom-identityprovidericon-url">url</a><span>, in § 2.2</span>
-   <li><a href="#well-known">Well-Known</a><span>, in § 2.1</span>
+   <li><a href="#dom-identityprovidericon-url">url</a><span>, in § 3.2</span>
   </ul>
   <aside class="dfn-panel" data-for="term-for-credential">
    <a href="https://w3c.github.io/webappsec-credential-management/#credential">https://w3c.github.io/webappsec-credential-management/#credential</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-credential">3. The Browser API</a>
-    <li><a href="#ref-for-credential①">3.2. The IdentityCredential Interface</a> <a href="#ref-for-credential②">(2)</a>
+    <li><a href="#ref-for-credential">2.2. The IdentityCredential Interface</a> <a href="#ref-for-credential①">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-dictdef-credentialrequestoptions">
    <a href="https://w3c.github.io/webappsec-credential-management/#dictdef-credentialrequestoptions">https://w3c.github.io/webappsec-credential-management/#dictdef-credentialrequestoptions</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dictdef-credentialrequestoptions">3. The Browser API</a>
-    <li><a href="#ref-for-dictdef-credentialrequestoptions①">3.3. The CredentialRequestOptions</a> <a href="#ref-for-dictdef-credentialrequestoptions②">(2)</a>
-    <li><a href="#ref-for-dictdef-credentialrequestoptions③">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
+    <li><a href="#ref-for-dictdef-credentialrequestoptions">2.2.1. The CredentialRequestOptions ## {#browser-api-credential-request-options}</a> <a href="#ref-for-dictdef-credentialrequestoptions①">(2)</a>
+    <li><a href="#ref-for-dictdef-credentialrequestoptions②">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-credentialscontainer">
    <a href="https://w3c.github.io/webappsec-credential-management/#credentialscontainer">https://w3c.github.io/webappsec-credential-management/#credentialscontainer</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-credentialscontainer">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
+    <li><a href="#ref-for-credentialscontainer">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
     <li><a href="#ref-for-credentialscontainer①">4. Permissions Policy Integration</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-abstract-opdef-request-a-credential">
    <a href="https://w3c.github.io/webappsec-credential-management/#abstract-opdef-request-a-credential">https://w3c.github.io/webappsec-credential-management/#abstract-opdef-request-a-credential</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-abstract-opdef-request-a-credential">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
+    <li><a href="#ref-for-abstract-opdef-request-a-credential">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
     <li><a href="#ref-for-abstract-opdef-request-a-credential①">4. Permissions Policy Integration</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-dom-credential-discoverfromexternalsource-slot">
    <a href="https://w3c.github.io/webappsec-credential-management/#dom-credential-discoverfromexternalsource-slot">https://w3c.github.io/webappsec-credential-management/#dom-credential-discoverfromexternalsource-slot</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-credential-discoverfromexternalsource-slot">3. The Browser API</a>
-    <li><a href="#ref-for-dom-credential-discoverfromexternalsource-slot①">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-dom-credential-discoverfromexternalsource-slot②">(2)</a>
+    <li><a href="#ref-for-dom-credential-discoverfromexternalsource-slot">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-dom-credential-discoverfromexternalsource-slot①">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-dom-credentialscontainer-get">
    <a href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get">https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-credentialscontainer-get">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
+    <li><a href="#ref-for-dom-credentialscontainer-get">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
     <li><a href="#ref-for-dom-credentialscontainer-get①">4. Permissions Policy Integration</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-dom-credentialrequestoptions-mediation">
    <a href="https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-mediation">https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-mediation</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-credentialrequestoptions-mediation">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
+    <li><a href="#ref-for-dom-credentialrequestoptions-mediation">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-same-origin-with-its-ancestors">
    <a href="https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors">https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-same-origin-with-its-ancestors">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
+    <li><a href="#ref-for-same-origin-with-its-ancestors">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-dom-credentialrequestoptions-signal">
    <a href="https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-signal">https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-signal</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-credentialrequestoptions-signal">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
+    <li><a href="#ref-for-dom-credentialrequestoptions-signal">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-typedef-color">
    <a href="https://drafts.csswg.org/css-color-4/#typedef-color">https://drafts.csswg.org/css-color-4/#typedef-color</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-typedef-color">2.2. Manifest</a>
+    <li><a href="#ref-for-typedef-color">3.2. Manifest</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-typedef-hex-color">
    <a href="https://drafts.csswg.org/css-color-4/#typedef-hex-color">https://drafts.csswg.org/css-color-4/#typedef-hex-color</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-typedef-hex-color">2.2. Manifest</a>
+    <li><a href="#ref-for-typedef-hex-color">3.2. Manifest</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-typedef-named-color">
    <a href="https://drafts.csswg.org/css-color-4/#typedef-named-color">https://drafts.csswg.org/css-color-4/#typedef-named-color</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-typedef-named-color">2.2. Manifest</a>
+    <li><a href="#ref-for-typedef-named-color">3.2. Manifest</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-funcdef-hsl">
    <a href="https://drafts.csswg.org/css-color-5/#funcdef-hsl">https://drafts.csswg.org/css-color-5/#funcdef-hsl</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-funcdef-hsl">2.2. Manifest</a>
+    <li><a href="#ref-for-funcdef-hsl">3.2. Manifest</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-funcdef-rgb">
    <a href="https://drafts.csswg.org/css-color-5/#funcdef-rgb">https://drafts.csswg.org/css-color-5/#funcdef-rgb</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-funcdef-rgb">2.2. Manifest</a>
+    <li><a href="#ref-for-funcdef-rgb">3.2. Manifest</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-document">
@@ -3220,56 +3217,56 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
   <aside class="dfn-panel" data-for="term-for-concept-document-origin">
    <a href="https://dom.spec.whatwg.org/#concept-document-origin">https://dom.spec.whatwg.org/#concept-document-origin</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-concept-document-origin">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
+    <li><a href="#ref-for-concept-document-origin">2.1. The State Machine</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-sec-ordinary-object-internal-methods-and-internal-slots">
    <a href="https://tc39.github.io/ecma262/#sec-ordinary-object-internal-methods-and-internal-slots">https://tc39.github.io/ecma262/#sec-ordinary-object-internal-methods-and-internal-slots</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-sec-ordinary-object-internal-methods-and-internal-slots">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-sec-ordinary-object-internal-methods-and-internal-slots①">(2)</a>
+    <li><a href="#ref-for-sec-ordinary-object-internal-methods-and-internal-slots">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-sec-ordinary-object-internal-methods-and-internal-slots①">(2)</a>
     <li><a href="#ref-for-sec-ordinary-object-internal-methods-and-internal-slots②">4. Permissions Policy Integration</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-utf-8-encode">
    <a href="https://encoding.spec.whatwg.org/#utf-8-encode">https://encoding.spec.whatwg.org/#utf-8-encode</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-utf-8-encode">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
+    <li><a href="#ref-for-utf-8-encode">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-concept-request-body">
    <a href="https://fetch.spec.whatwg.org/#concept-request-body">https://fetch.spec.whatwg.org/#concept-request-body</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-concept-request-body">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
+    <li><a href="#ref-for-concept-request-body">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-concept-request-client">
    <a href="https://fetch.spec.whatwg.org/#concept-request-client">https://fetch.spec.whatwg.org/#concept-request-client</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-concept-request-client">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-concept-request-client①">(2)</a> <a href="#ref-for-concept-request-client②">(3)</a> <a href="#ref-for-concept-request-client③">(4)</a> <a href="#ref-for-concept-request-client④">(5)</a> <a href="#ref-for-concept-request-client⑤">(6)</a>
+    <li><a href="#ref-for-concept-request-client">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-concept-request-client①">(2)</a> <a href="#ref-for-concept-request-client②">(3)</a> <a href="#ref-for-concept-request-client③">(4)</a> <a href="#ref-for-concept-request-client④">(5)</a> <a href="#ref-for-concept-request-client⑤">(6)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-concept-request-credentials-mode">
    <a href="https://fetch.spec.whatwg.org/#concept-request-credentials-mode">https://fetch.spec.whatwg.org/#concept-request-credentials-mode</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-concept-request-credentials-mode">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-concept-request-credentials-mode①">(2)</a> <a href="#ref-for-concept-request-credentials-mode②">(3)</a> <a href="#ref-for-concept-request-credentials-mode③">(4)</a> <a href="#ref-for-concept-request-credentials-mode④">(5)</a> <a href="#ref-for-concept-request-credentials-mode⑤">(6)</a>
+    <li><a href="#ref-for-concept-request-credentials-mode">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-concept-request-credentials-mode①">(2)</a> <a href="#ref-for-concept-request-credentials-mode②">(3)</a> <a href="#ref-for-concept-request-credentials-mode③">(4)</a> <a href="#ref-for-concept-request-credentials-mode④">(5)</a> <a href="#ref-for-concept-request-credentials-mode⑤">(6)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-concept-request-destination">
    <a href="https://fetch.spec.whatwg.org/#concept-request-destination">https://fetch.spec.whatwg.org/#concept-request-destination</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-concept-request-destination">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-concept-request-destination①">(2)</a> <a href="#ref-for-concept-request-destination②">(3)</a> <a href="#ref-for-concept-request-destination③">(4)</a> <a href="#ref-for-concept-request-destination④">(5)</a> <a href="#ref-for-concept-request-destination⑤">(6)</a>
+    <li><a href="#ref-for-concept-request-destination">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-concept-request-destination①">(2)</a> <a href="#ref-for-concept-request-destination②">(3)</a> <a href="#ref-for-concept-request-destination③">(4)</a> <a href="#ref-for-concept-request-destination④">(5)</a> <a href="#ref-for-concept-request-destination⑤">(6)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-concept-header-extract-mime-type">
    <a href="https://fetch.spec.whatwg.org/#concept-header-extract-mime-type">https://fetch.spec.whatwg.org/#concept-header-extract-mime-type</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-concept-header-extract-mime-type">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
+    <li><a href="#ref-for-concept-header-extract-mime-type">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-concept-fetch">
    <a href="https://fetch.spec.whatwg.org/#concept-fetch">https://fetch.spec.whatwg.org/#concept-fetch</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-concept-fetch">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-concept-fetch①">(2)</a>
+    <li><a href="#ref-for-concept-fetch">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-concept-fetch①">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-forbidden-request-header">
@@ -3281,129 +3278,129 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
   <aside class="dfn-panel" data-for="term-for-concept-header">
    <a href="https://fetch.spec.whatwg.org/#concept-header">https://fetch.spec.whatwg.org/#concept-header</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-concept-header">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-concept-header①">(2)</a> <a href="#ref-for-concept-header②">(3)</a> <a href="#ref-for-concept-header③">(4)</a> <a href="#ref-for-concept-header④">(5)</a>
+    <li><a href="#ref-for-concept-header">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-concept-header①">(2)</a> <a href="#ref-for-concept-header②">(3)</a> <a href="#ref-for-concept-header③">(4)</a> <a href="#ref-for-concept-header④">(5)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-concept-request-header-list">
    <a href="https://fetch.spec.whatwg.org/#concept-request-header-list">https://fetch.spec.whatwg.org/#concept-request-header-list</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-concept-request-header-list">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-concept-request-header-list①">(2)</a> <a href="#ref-for-concept-request-header-list②">(3)</a> <a href="#ref-for-concept-request-header-list③">(4)</a> <a href="#ref-for-concept-request-header-list④">(5)</a>
+    <li><a href="#ref-for-concept-request-header-list">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-concept-request-header-list①">(2)</a> <a href="#ref-for-concept-request-header-list②">(3)</a> <a href="#ref-for-concept-request-header-list③">(4)</a> <a href="#ref-for-concept-request-header-list④">(5)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-concept-response-header-list">
    <a href="https://fetch.spec.whatwg.org/#concept-response-header-list">https://fetch.spec.whatwg.org/#concept-response-header-list</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-concept-response-header-list">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
+    <li><a href="#ref-for-concept-response-header-list">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-concept-request-mode">
    <a href="https://fetch.spec.whatwg.org/#concept-request-mode">https://fetch.spec.whatwg.org/#concept-request-mode</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-concept-request-mode">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-concept-request-mode①">(2)</a>
+    <li><a href="#ref-for-concept-request-mode">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-concept-request-mode①">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-concept-header-name">
    <a href="https://fetch.spec.whatwg.org/#concept-header-name">https://fetch.spec.whatwg.org/#concept-header-name</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-concept-header-name">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-concept-header-name①">(2)</a> <a href="#ref-for-concept-header-name②">(3)</a> <a href="#ref-for-concept-header-name③">(4)</a> <a href="#ref-for-concept-header-name④">(5)</a>
+    <li><a href="#ref-for-concept-header-name">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-concept-header-name①">(2)</a> <a href="#ref-for-concept-header-name②">(3)</a> <a href="#ref-for-concept-header-name③">(4)</a> <a href="#ref-for-concept-header-name④">(5)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-concept-network-error">
    <a href="https://fetch.spec.whatwg.org/#concept-network-error">https://fetch.spec.whatwg.org/#concept-network-error</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-concept-network-error">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
+    <li><a href="#ref-for-concept-network-error">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-ok-status">
    <a href="https://fetch.spec.whatwg.org/#ok-status">https://fetch.spec.whatwg.org/#ok-status</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-ok-status">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
+    <li><a href="#ref-for-ok-status">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-http-origin">
    <a href="https://fetch.spec.whatwg.org/#http-origin">https://fetch.spec.whatwg.org/#http-origin</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-http-origin">2.1. The Well-Known File</a>
-    <li><a href="#ref-for-http-origin①">2.2. Manifest</a>
-    <li><a href="#ref-for-http-origin②">2.3. Accounts List</a>
-    <li><a href="#ref-for-http-origin③">2.4. Client Metadata</a>
-    <li><a href="#ref-for-http-origin④">2.5. Identity Assertions</a> <a href="#ref-for-http-origin⑤">(2)</a> <a href="#ref-for-http-origin⑥">(3)</a>
+    <li><a href="#ref-for-http-origin">3.1. The Well-Known File</a>
+    <li><a href="#ref-for-http-origin①">3.2. Manifest</a>
+    <li><a href="#ref-for-http-origin②">3.3. Accounts List</a>
+    <li><a href="#ref-for-http-origin③">3.4. Client Metadata</a>
+    <li><a href="#ref-for-http-origin④">3.5. Identity Assertions</a> <a href="#ref-for-http-origin⑤">(2)</a> <a href="#ref-for-http-origin⑥">(3)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-concept-request-origin">
    <a href="https://fetch.spec.whatwg.org/#concept-request-origin">https://fetch.spec.whatwg.org/#concept-request-origin</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-concept-request-origin">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-concept-request-origin①">(2)</a> <a href="#ref-for-concept-request-origin②">(3)</a> <a href="#ref-for-concept-request-origin③">(4)</a> <a href="#ref-for-concept-request-origin④">(5)</a> <a href="#ref-for-concept-request-origin⑤">(6)</a>
+    <li><a href="#ref-for-concept-request-origin">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-concept-request-origin①">(2)</a> <a href="#ref-for-concept-request-origin②">(3)</a> <a href="#ref-for-concept-request-origin③">(4)</a> <a href="#ref-for-concept-request-origin④">(5)</a> <a href="#ref-for-concept-request-origin⑤">(6)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-process-response-end-of-body">
    <a href="https://fetch.spec.whatwg.org/#process-response-end-of-body">https://fetch.spec.whatwg.org/#process-response-end-of-body</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-process-response-end-of-body">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
+    <li><a href="#ref-for-process-response-end-of-body">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-concept-request-redirect-mode">
    <a href="https://fetch.spec.whatwg.org/#concept-request-redirect-mode">https://fetch.spec.whatwg.org/#concept-request-redirect-mode</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-concept-request-redirect-mode">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-concept-request-redirect-mode①">(2)</a> <a href="#ref-for-concept-request-redirect-mode②">(3)</a> <a href="#ref-for-concept-request-redirect-mode③">(4)</a>
+    <li><a href="#ref-for-concept-request-redirect-mode">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-concept-request-redirect-mode①">(2)</a> <a href="#ref-for-concept-request-redirect-mode②">(3)</a> <a href="#ref-for-concept-request-redirect-mode③">(4)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-concept-request-referrer-policy">
    <a href="https://fetch.spec.whatwg.org/#concept-request-referrer-policy">https://fetch.spec.whatwg.org/#concept-request-referrer-policy</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-concept-request-referrer-policy">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-concept-request-referrer-policy①">(2)</a> <a href="#ref-for-concept-request-referrer-policy②">(3)</a> <a href="#ref-for-concept-request-referrer-policy③">(4)</a>
+    <li><a href="#ref-for-concept-request-referrer-policy">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-concept-request-referrer-policy①">(2)</a> <a href="#ref-for-concept-request-referrer-policy②">(3)</a> <a href="#ref-for-concept-request-referrer-policy③">(4)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-concept-request">
    <a href="https://fetch.spec.whatwg.org/#concept-request">https://fetch.spec.whatwg.org/#concept-request</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-concept-request">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-concept-request①">(2)</a> <a href="#ref-for-concept-request②">(3)</a> <a href="#ref-for-concept-request③">(4)</a> <a href="#ref-for-concept-request④">(5)</a> <a href="#ref-for-concept-request⑤">(6)</a> <a href="#ref-for-concept-request⑥">(7)</a> <a href="#ref-for-concept-request⑦">(8)</a>
+    <li><a href="#ref-for-concept-request">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-concept-request①">(2)</a> <a href="#ref-for-concept-request②">(3)</a> <a href="#ref-for-concept-request③">(4)</a> <a href="#ref-for-concept-request④">(5)</a> <a href="#ref-for-concept-request⑤">(6)</a> <a href="#ref-for-concept-request⑥">(7)</a> <a href="#ref-for-concept-request⑦">(8)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-concept-response">
    <a href="https://fetch.spec.whatwg.org/#concept-response">https://fetch.spec.whatwg.org/#concept-response</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-concept-response">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-concept-response①">(2)</a> <a href="#ref-for-concept-response②">(3)</a> <a href="#ref-for-concept-response③">(4)</a> <a href="#ref-for-concept-response④">(5)</a> <a href="#ref-for-concept-response⑤">(6)</a>
+    <li><a href="#ref-for-concept-response">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-concept-response①">(2)</a> <a href="#ref-for-concept-response②">(3)</a> <a href="#ref-for-concept-response③">(4)</a> <a href="#ref-for-concept-response④">(5)</a> <a href="#ref-for-concept-response⑤">(6)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-request-service-workers-mode">
    <a href="https://fetch.spec.whatwg.org/#request-service-workers-mode">https://fetch.spec.whatwg.org/#request-service-workers-mode</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-request-service-workers-mode">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-request-service-workers-mode①">(2)</a> <a href="#ref-for-request-service-workers-mode②">(3)</a> <a href="#ref-for-request-service-workers-mode③">(4)</a> <a href="#ref-for-request-service-workers-mode④">(5)</a> <a href="#ref-for-request-service-workers-mode⑤">(6)</a>
+    <li><a href="#ref-for-request-service-workers-mode">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-request-service-workers-mode①">(2)</a> <a href="#ref-for-request-service-workers-mode②">(3)</a> <a href="#ref-for-request-service-workers-mode③">(4)</a> <a href="#ref-for-request-service-workers-mode④">(5)</a> <a href="#ref-for-request-service-workers-mode⑤">(6)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-concept-response-status">
    <a href="https://fetch.spec.whatwg.org/#concept-response-status">https://fetch.spec.whatwg.org/#concept-response-status</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-concept-response-status">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
+    <li><a href="#ref-for-concept-response-status">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-concept-request-url">
    <a href="https://fetch.spec.whatwg.org/#concept-request-url">https://fetch.spec.whatwg.org/#concept-request-url</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-concept-request-url">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-concept-request-url①">(2)</a> <a href="#ref-for-concept-request-url②">(3)</a> <a href="#ref-for-concept-request-url③">(4)</a> <a href="#ref-for-concept-request-url④">(5)</a> <a href="#ref-for-concept-request-url⑤">(6)</a>
+    <li><a href="#ref-for-concept-request-url">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-concept-request-url①">(2)</a> <a href="#ref-for-concept-request-url②">(3)</a> <a href="#ref-for-concept-request-url③">(4)</a> <a href="#ref-for-concept-request-url④">(5)</a> <a href="#ref-for-concept-request-url⑤">(6)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-concept-header-value">
    <a href="https://fetch.spec.whatwg.org/#concept-header-value">https://fetch.spec.whatwg.org/#concept-header-value</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-concept-header-value">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-concept-header-value①">(2)</a> <a href="#ref-for-concept-header-value②">(3)</a> <a href="#ref-for-concept-header-value③">(4)</a> <a href="#ref-for-concept-header-value④">(5)</a>
+    <li><a href="#ref-for-concept-header-value">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-concept-header-value①">(2)</a> <a href="#ref-for-concept-header-value②">(3)</a> <a href="#ref-for-concept-header-value③">(4)</a> <a href="#ref-for-concept-header-value④">(5)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-concept-request-window">
    <a href="https://fetch.spec.whatwg.org/#concept-request-window">https://fetch.spec.whatwg.org/#concept-request-window</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-concept-request-window">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-concept-request-window①">(2)</a> <a href="#ref-for-concept-request-window②">(3)</a> <a href="#ref-for-concept-request-window③">(4)</a> <a href="#ref-for-concept-request-window④">(5)</a> <a href="#ref-for-concept-request-window⑤">(6)</a>
+    <li><a href="#ref-for-concept-request-window">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-concept-request-window①">(2)</a> <a href="#ref-for-concept-request-window②">(3)</a> <a href="#ref-for-concept-request-window③">(4)</a> <a href="#ref-for-concept-request-window④">(5)</a> <a href="#ref-for-concept-request-window⑤">(6)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-http-headerdef-sec-fetch-dest">
    <a href="https://w3c.github.io/webappsec-fetch-metadata/#http-headerdef-sec-fetch-dest">https://w3c.github.io/webappsec-fetch-metadata/#http-headerdef-sec-fetch-dest</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-http-headerdef-sec-fetch-dest">2.1. The Well-Known File</a>
-    <li><a href="#ref-for-http-headerdef-sec-fetch-dest①">2.2. Manifest</a>
-    <li><a href="#ref-for-http-headerdef-sec-fetch-dest②">2.3. Accounts List</a>
-    <li><a href="#ref-for-http-headerdef-sec-fetch-dest③">2.4. Client Metadata</a>
-    <li><a href="#ref-for-http-headerdef-sec-fetch-dest④">2.5. Identity Assertions</a>
+    <li><a href="#ref-for-http-headerdef-sec-fetch-dest">3.1. The Well-Known File</a>
+    <li><a href="#ref-for-http-headerdef-sec-fetch-dest①">3.2. Manifest</a>
+    <li><a href="#ref-for-http-headerdef-sec-fetch-dest②">3.3. Accounts List</a>
+    <li><a href="#ref-for-http-headerdef-sec-fetch-dest③">3.4. Client Metadata</a>
+    <li><a href="#ref-for-http-headerdef-sec-fetch-dest④">3.5. Identity Assertions</a>
     <li><a href="#ref-for-http-headerdef-sec-fetch-dest⑤">5.2. Sec-Fetch-Dest Header</a>
    </ul>
   </aside>
@@ -3416,7 +3413,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
   <aside class="dfn-panel" data-for="term-for-concept-document-window">
    <a href="https://html.spec.whatwg.org/multipage/nav-history-apis.html#concept-document-window">https://html.spec.whatwg.org/multipage/nav-history-apis.html#concept-document-window</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-concept-document-window">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
+    <li><a href="#ref-for-concept-document-window">2.1. The State Machine</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-current-settings-object">
@@ -3428,154 +3425,154 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
   <aside class="dfn-panel" data-for="term-for-dom-manipulation-task-source">
    <a href="https://html.spec.whatwg.org/multipage/webappapis.html#dom-manipulation-task-source">https://html.spec.whatwg.org/multipage/webappapis.html#dom-manipulation-task-source</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-manipulation-task-source">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-dom-manipulation-task-source①">(2)</a>
+    <li><a href="#ref-for-dom-manipulation-task-source">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-dom-manipulation-task-source①">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-environment-settings-object">
    <a href="https://html.spec.whatwg.org/multipage/webappapis.html#environment-settings-object">https://html.spec.whatwg.org/multipage/webappapis.html#environment-settings-object</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-environment-settings-object">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
+    <li><a href="#ref-for-environment-settings-object">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-in-parallel">
    <a href="https://html.spec.whatwg.org/multipage/infrastructure.html#in-parallel">https://html.spec.whatwg.org/multipage/infrastructure.html#in-parallel</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-in-parallel">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-in-parallel①">(2)</a> <a href="#ref-for-in-parallel②">(3)</a> <a href="#ref-for-in-parallel③">(4)</a> <a href="#ref-for-in-parallel④">(5)</a>
+    <li><a href="#ref-for-in-parallel">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-in-parallel①">(2)</a> <a href="#ref-for-in-parallel②">(3)</a> <a href="#ref-for-in-parallel③">(4)</a> <a href="#ref-for-in-parallel④">(5)</a>
     <li><a href="#ref-for-in-parallel⑤">4. Permissions Policy Integration</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-networking-task-source">
    <a href="https://html.spec.whatwg.org/multipage/webappapis.html#networking-task-source">https://html.spec.whatwg.org/multipage/webappapis.html#networking-task-source</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-networking-task-source">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-networking-task-source①">(2)</a>
+    <li><a href="#ref-for-networking-task-source">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-networking-task-source①">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-concept-origin-opaque">
    <a href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-opaque">https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-opaque</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-concept-origin-opaque">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-concept-origin-opaque①">(2)</a> <a href="#ref-for-concept-origin-opaque②">(3)</a> <a href="#ref-for-concept-origin-opaque③">(4)</a>
+    <li><a href="#ref-for-concept-origin-opaque">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-concept-origin-opaque①">(2)</a> <a href="#ref-for-concept-origin-opaque②">(3)</a> <a href="#ref-for-concept-origin-opaque③">(4)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-concept-origin">
    <a href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin">https://html.spec.whatwg.org/multipage/browsers.html#concept-origin</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-concept-origin">3.1. The State Machine</a> <a href="#ref-for-concept-origin①">(2)</a>
-    <li><a href="#ref-for-concept-origin②">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-concept-origin③">(2)</a> <a href="#ref-for-concept-origin④">(3)</a>
+    <li><a href="#ref-for-concept-origin">2.1. The State Machine</a> <a href="#ref-for-concept-origin①">(2)</a> <a href="#ref-for-concept-origin②">(3)</a>
+    <li><a href="#ref-for-concept-origin③">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-concept-origin④">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-concept-settings-object-origin">
    <a href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin">https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-concept-settings-object-origin">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
+    <li><a href="#ref-for-concept-settings-object-origin">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-concept-document-permissions-policy">
    <a href="https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy">https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-concept-document-permissions-policy">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
+    <li><a href="#ref-for-concept-document-permissions-policy">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
     <li><a href="#ref-for-concept-document-permissions-policy①">4. Permissions Policy Integration</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-queue-a-global-task">
    <a href="https://html.spec.whatwg.org/multipage/webappapis.html#queue-a-global-task">https://html.spec.whatwg.org/multipage/webappapis.html#queue-a-global-task</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-queue-a-global-task">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-queue-a-global-task①">(2)</a> <a href="#ref-for-queue-a-global-task②">(3)</a>
+    <li><a href="#ref-for-queue-a-global-task">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-queue-a-global-task①">(2)</a> <a href="#ref-for-queue-a-global-task②">(3)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-concept-global-object-realm">
    <a href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-global-object-realm">https://html.spec.whatwg.org/multipage/webappapis.html#concept-global-object-realm</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-concept-global-object-realm">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
+    <li><a href="#ref-for-concept-global-object-realm">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-relevant-settings-object">
    <a href="https://html.spec.whatwg.org/multipage/webappapis.html#relevant-settings-object">https://html.spec.whatwg.org/multipage/webappapis.html#relevant-settings-object</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-relevant-settings-object">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
+    <li><a href="#ref-for-relevant-settings-object">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-same-origin">
    <a href="https://html.spec.whatwg.org/multipage/browsers.html#same-origin">https://html.spec.whatwg.org/multipage/browsers.html#same-origin</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-same-origin">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
+    <li><a href="#ref-for-same-origin">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-dom-settimeout">
    <a href="https://html.spec.whatwg.org/multipage/timers-and-user-prompts.html#dom-settimeout">https://html.spec.whatwg.org/multipage/timers-and-user-prompts.html#dom-settimeout</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-settimeout">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-dom-settimeout①">(2)</a>
+    <li><a href="#ref-for-dom-settimeout">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-dom-settimeout①">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-concept-task">
    <a href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-task">https://html.spec.whatwg.org/multipage/webappapis.html#concept-task</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-concept-task">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
+    <li><a href="#ref-for-concept-task">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-map-exists">
    <a href="https://infra.spec.whatwg.org/#map-exists">https://infra.spec.whatwg.org/#map-exists</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-map-exists">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
+    <li><a href="#ref-for-map-exists">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-string-is">
    <a href="https://infra.spec.whatwg.org/#string-is">https://infra.spec.whatwg.org/#string-is</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-string-is">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
+    <li><a href="#ref-for-string-is">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-map-getting-the-keys">
    <a href="https://infra.spec.whatwg.org/#map-getting-the-keys">https://infra.spec.whatwg.org/#map-getting-the-keys</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-map-getting-the-keys">3.1. The State Machine</a>
+    <li><a href="#ref-for-map-getting-the-keys">2.1. The State Machine</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-list">
    <a href="https://infra.spec.whatwg.org/#list">https://infra.spec.whatwg.org/#list</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-list">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-list①">(2)</a> <a href="#ref-for-list②">(3)</a> <a href="#ref-for-list③">(4)</a> <a href="#ref-for-list④">(5)</a> <a href="#ref-for-list⑤">(6)</a>
+    <li><a href="#ref-for-list">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-list①">(2)</a> <a href="#ref-for-list②">(3)</a> <a href="#ref-for-list③">(4)</a> <a href="#ref-for-list④">(5)</a> <a href="#ref-for-list⑤">(6)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-ordered-map">
    <a href="https://infra.spec.whatwg.org/#ordered-map">https://infra.spec.whatwg.org/#ordered-map</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-ordered-map">3.1. The State Machine</a>
-    <li><a href="#ref-for-ordered-map①">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-ordered-map②">(2)</a>
+    <li><a href="#ref-for-ordered-map">2.1. The State Machine</a>
+    <li><a href="#ref-for-ordered-map①">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-ordered-map②">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-ordered-map">
    <a href="https://infra.spec.whatwg.org/#ordered-map">https://infra.spec.whatwg.org/#ordered-map</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-ordered-map">3.1. The State Machine</a>
-    <li><a href="#ref-for-ordered-map①">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-ordered-map②">(2)</a>
+    <li><a href="#ref-for-ordered-map">2.1. The State Machine</a>
+    <li><a href="#ref-for-ordered-map①">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-ordered-map②">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-parse-json-bytes-to-an-infra-value">
    <a href="https://infra.spec.whatwg.org/#parse-json-bytes-to-an-infra-value">https://infra.spec.whatwg.org/#parse-json-bytes-to-an-infra-value</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-parse-json-bytes-to-an-infra-value">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
+    <li><a href="#ref-for-parse-json-bytes-to-an-infra-value">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-list-size">
    <a href="https://infra.spec.whatwg.org/#list-size">https://infra.spec.whatwg.org/#list-size</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-list-size">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-list-size①">(2)</a> <a href="#ref-for-list-size②">(3)</a>
+    <li><a href="#ref-for-list-size">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-list-size①">(2)</a> <a href="#ref-for-list-size②">(3)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-string">
    <a href="https://infra.spec.whatwg.org/#string">https://infra.spec.whatwg.org/#string</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-string">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-string①">(2)</a>
+    <li><a href="#ref-for-string">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-string①">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-user-agent">
    <a href="https://infra.spec.whatwg.org/#user-agent">https://infra.spec.whatwg.org/#user-agent</a><b>Referenced in:</b>
    <ul>
     <li><a href="#ref-for-user-agent">1. Introduction</a> <a href="#ref-for-user-agent①">(2)</a>
-    <li><a href="#ref-for-user-agent②">2.2. Manifest</a> <a href="#ref-for-user-agent③">(2)</a> <a href="#ref-for-user-agent④">(3)</a> <a href="#ref-for-user-agent⑤">(4)</a> <a href="#ref-for-user-agent⑥">(5)</a>
-    <li><a href="#ref-for-user-agent⑦">2.5. Identity Assertions</a>
-    <li><a href="#ref-for-user-agent⑧">3.1. The State Machine</a>
-    <li><a href="#ref-for-user-agent⑨">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-user-agent①⓪">(2)</a> <a href="#ref-for-user-agent①①">(3)</a>
+    <li><a href="#ref-for-user-agent②">2.1. The State Machine</a>
+    <li><a href="#ref-for-user-agent③">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-user-agent④">(2)</a> <a href="#ref-for-user-agent⑤">(3)</a>
+    <li><a href="#ref-for-user-agent⑥">3.2. Manifest</a> <a href="#ref-for-user-agent⑦">(2)</a> <a href="#ref-for-user-agent⑧">(3)</a> <a href="#ref-for-user-agent⑨">(4)</a> <a href="#ref-for-user-agent①⓪">(5)</a>
+    <li><a href="#ref-for-user-agent①①">3.5. Identity Assertions</a>
     <li><a href="#ref-for-user-agent①②">6.1. Principals</a> <a href="#ref-for-user-agent①③">(2)</a> <a href="#ref-for-user-agent①④">(3)</a> <a href="#ref-for-user-agent①⑤">(4)</a> <a href="#ref-for-user-agent①⑥">(5)</a>
     <li><a href="#ref-for-user-agent①⑦">6.3.2. Timing Attacks</a> <a href="#ref-for-user-agent①⑧">(2)</a> <a href="#ref-for-user-agent①⑨">(3)</a> <a href="#ref-for-user-agent②⓪">(4)</a>
     <li><a href="#ref-for-user-agent②①">6.3.3. IDP Intrusion</a> <a href="#ref-for-user-agent②②">(2)</a> <a href="#ref-for-user-agent②③">(3)</a>
@@ -3585,13 +3582,13 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
   <aside class="dfn-panel" data-for="term-for-map-getting-the-values">
    <a href="https://infra.spec.whatwg.org/#map-getting-the-values">https://infra.spec.whatwg.org/#map-getting-the-values</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-map-getting-the-values">3.1. The State Machine</a>
+    <li><a href="#ref-for-map-getting-the-values">2.1. The State Machine</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-json-mime-type">
    <a href="https://mimesniff.spec.whatwg.org/#json-mime-type">https://mimesniff.spec.whatwg.org/#json-mime-type</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-json-mime-type">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
+    <li><a href="#ref-for-json-mime-type">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-policy-controlled-feature-default-allowlist">
@@ -3609,63 +3606,62 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
   <aside class="dfn-panel" data-for="term-for-potentially-trustworthy-url">
    <a href="https://w3c.github.io/webappsec-secure-contexts/#potentially-trustworthy-url">https://w3c.github.io/webappsec-secure-contexts/#potentially-trustworthy-url</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-potentially-trustworthy-url">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-potentially-trustworthy-url①">(2)</a> <a href="#ref-for-potentially-trustworthy-url②">(3)</a>
+    <li><a href="#ref-for-potentially-trustworthy-url">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-potentially-trustworthy-url①">(2)</a> <a href="#ref-for-potentially-trustworthy-url②">(3)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-concept-url-host">
    <a href="https://url.spec.whatwg.org/#concept-url-host">https://url.spec.whatwg.org/#concept-url-host</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-concept-url-host">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-concept-url-host①">(2)</a>
+    <li><a href="#ref-for-concept-url-host">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-concept-url-host①">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-concept-url-path">
    <a href="https://url.spec.whatwg.org/#concept-url-path">https://url.spec.whatwg.org/#concept-url-path</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-concept-url-path">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
+    <li><a href="#ref-for-concept-url-path">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-host-registrable-domain">
    <a href="https://url.spec.whatwg.org/#host-registrable-domain">https://url.spec.whatwg.org/#host-registrable-domain</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-host-registrable-domain">2. The Identity Provider API</a>
-    <li><a href="#ref-for-host-registrable-domain①">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
+    <li><a href="#ref-for-host-registrable-domain">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-concept-url-scheme">
    <a href="https://url.spec.whatwg.org/#concept-url-scheme">https://url.spec.whatwg.org/#concept-url-scheme</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-concept-url-scheme">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-concept-url-scheme①">(2)</a>
+    <li><a href="#ref-for-concept-url-scheme">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-concept-url-scheme①">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-concept-url">
    <a href="https://url.spec.whatwg.org/#concept-url">https://url.spec.whatwg.org/#concept-url</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-concept-url">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-concept-url①">(2)</a> <a href="#ref-for-concept-url②">(3)</a>
+    <li><a href="#ref-for-concept-url">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-concept-url①">(2)</a> <a href="#ref-for-concept-url②">(3)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-concept-url-parser">
    <a href="https://url.spec.whatwg.org/#concept-url-parser">https://url.spec.whatwg.org/#concept-url-parser</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-concept-url-parser">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-concept-url-parser①">(2)</a>
+    <li><a href="#ref-for-concept-url-parser">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-concept-url-parser①">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-idl-DOMException">
    <a href="https://webidl.spec.whatwg.org/#idl-DOMException">https://webidl.spec.whatwg.org/#idl-DOMException</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-idl-DOMException">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-idl-DOMException①">(2)</a> <a href="#ref-for-idl-DOMException②">(3)</a> <a href="#ref-for-idl-DOMException③">(4)</a>
+    <li><a href="#ref-for-idl-DOMException">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-idl-DOMException①">(2)</a> <a href="#ref-for-idl-DOMException②">(3)</a> <a href="#ref-for-idl-DOMException③">(4)</a>
     <li><a href="#ref-for-idl-DOMException④">4. Permissions Policy Integration</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-Exposed">
    <a href="https://webidl.spec.whatwg.org/#Exposed">https://webidl.spec.whatwg.org/#Exposed</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-Exposed">3.2. The IdentityCredential Interface</a>
+    <li><a href="#ref-for-Exposed">2.2. The IdentityCredential Interface</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-networkerror">
    <a href="https://webidl.spec.whatwg.org/#networkerror">https://webidl.spec.whatwg.org/#networkerror</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-networkerror">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-networkerror①">(2)</a> <a href="#ref-for-networkerror②">(3)</a> <a href="#ref-for-networkerror③">(4)</a> <a href="#ref-for-networkerror④">(5)</a>
+    <li><a href="#ref-for-networkerror">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-networkerror①">(2)</a> <a href="#ref-for-networkerror②">(3)</a> <a href="#ref-for-networkerror③">(4)</a> <a href="#ref-for-networkerror④">(5)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-notallowederror">
@@ -3677,20 +3673,20 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
   <aside class="dfn-panel" data-for="term-for-SecureContext">
    <a href="https://webidl.spec.whatwg.org/#SecureContext">https://webidl.spec.whatwg.org/#SecureContext</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-SecureContext">3.2. The IdentityCredential Interface</a>
+    <li><a href="#ref-for-SecureContext">2.2. The IdentityCredential Interface</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-idl-USVString">
    <a href="https://webidl.spec.whatwg.org/#idl-USVString">https://webidl.spec.whatwg.org/#idl-USVString</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-idl-USVString">2. The Identity Provider API</a>
-    <li><a href="#ref-for-idl-USVString①">2.2. Manifest</a> <a href="#ref-for-idl-USVString②">(2)</a> <a href="#ref-for-idl-USVString③">(3)</a> <a href="#ref-for-idl-USVString④">(4)</a> <a href="#ref-for-idl-USVString⑤">(5)</a> <a href="#ref-for-idl-USVString⑥">(6)</a> <a href="#ref-for-idl-USVString⑦">(7)</a> <a href="#ref-for-idl-USVString⑧">(8)</a> <a href="#ref-for-idl-USVString⑨">(9)</a> <a href="#ref-for-idl-USVString①⓪">(10)</a> <a href="#ref-for-idl-USVString①①">(11)</a> <a href="#ref-for-idl-USVString①②">(12)</a>
-    <li><a href="#ref-for-idl-USVString①③">2.3. Accounts List</a> <a href="#ref-for-idl-USVString①④">(2)</a> <a href="#ref-for-idl-USVString①⑤">(3)</a> <a href="#ref-for-idl-USVString①⑥">(4)</a> <a href="#ref-for-idl-USVString①⑦">(5)</a> <a href="#ref-for-idl-USVString①⑧">(6)</a> <a href="#ref-for-idl-USVString①⑨">(7)</a> <a href="#ref-for-idl-USVString②⓪">(8)</a> <a href="#ref-for-idl-USVString②①">(9)</a> <a href="#ref-for-idl-USVString②②">(10)</a> <a href="#ref-for-idl-USVString②③">(11)</a> <a href="#ref-for-idl-USVString②④">(12)</a>
-    <li><a href="#ref-for-idl-USVString②⑤">2.4. Client Metadata</a> <a href="#ref-for-idl-USVString②⑥">(2)</a> <a href="#ref-for-idl-USVString②⑦">(3)</a> <a href="#ref-for-idl-USVString②⑧">(4)</a>
-    <li><a href="#ref-for-idl-USVString②⑨">2.5. Identity Assertions</a> <a href="#ref-for-idl-USVString③⓪">(2)</a>
-    <li><a href="#ref-for-idl-USVString③①">3.2. The IdentityCredential Interface</a>
-    <li><a href="#ref-for-idl-USVString③②">3.3. The CredentialRequestOptions</a> <a href="#ref-for-idl-USVString③③">(2)</a> <a href="#ref-for-idl-USVString③④">(3)</a>
-    <li><a href="#ref-for-idl-USVString③⑤">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-idl-USVString③⑥">(2)</a>
+    <li><a href="#ref-for-idl-USVString">2.2. The IdentityCredential Interface</a>
+    <li><a href="#ref-for-idl-USVString①">2.2.1. The CredentialRequestOptions ## {#browser-api-credential-request-options}</a> <a href="#ref-for-idl-USVString②">(2)</a> <a href="#ref-for-idl-USVString③">(3)</a>
+    <li><a href="#ref-for-idl-USVString④">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-idl-USVString⑤">(2)</a> <a href="#ref-for-idl-USVString⑥">(3)</a> <a href="#ref-for-idl-USVString⑦">(4)</a> <a href="#ref-for-idl-USVString⑧">(5)</a> <a href="#ref-for-idl-USVString⑨">(6)</a> <a href="#ref-for-idl-USVString①⓪">(7)</a> <a href="#ref-for-idl-USVString①①">(8)</a> <a href="#ref-for-idl-USVString①②">(9)</a> <a href="#ref-for-idl-USVString①③">(10)</a> <a href="#ref-for-idl-USVString①④">(11)</a> <a href="#ref-for-idl-USVString①⑤">(12)</a> <a href="#ref-for-idl-USVString①⑥">(13)</a> <a href="#ref-for-idl-USVString①⑦">(14)</a> <a href="#ref-for-idl-USVString①⑧">(15)</a> <a href="#ref-for-idl-USVString①⑨">(16)</a> <a href="#ref-for-idl-USVString②⓪">(17)</a> <a href="#ref-for-idl-USVString②①">(18)</a>
+    <li><a href="#ref-for-idl-USVString②②">3.1. The Well-Known File</a>
+    <li><a href="#ref-for-idl-USVString②③">3.2. Manifest</a> <a href="#ref-for-idl-USVString②④">(2)</a> <a href="#ref-for-idl-USVString②⑤">(3)</a> <a href="#ref-for-idl-USVString②⑥">(4)</a> <a href="#ref-for-idl-USVString②⑦">(5)</a> <a href="#ref-for-idl-USVString②⑧">(6)</a>
+    <li><a href="#ref-for-idl-USVString②⑨">3.3. Accounts List</a> <a href="#ref-for-idl-USVString③⓪">(2)</a> <a href="#ref-for-idl-USVString③①">(3)</a> <a href="#ref-for-idl-USVString③②">(4)</a> <a href="#ref-for-idl-USVString③③">(5)</a> <a href="#ref-for-idl-USVString③④">(6)</a>
+    <li><a href="#ref-for-idl-USVString③⑤">3.4. Client Metadata</a> <a href="#ref-for-idl-USVString③⑥">(2)</a>
+    <li><a href="#ref-for-idl-USVString③⑦">3.5. Identity Assertions</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-a-promise-rejected-with">
@@ -3702,26 +3698,25 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
   <aside class="dfn-panel" data-for="term-for-dfn-convert-ecmascript-to-idl-value">
    <a href="https://webidl.spec.whatwg.org/#dfn-convert-ecmascript-to-idl-value">https://webidl.spec.whatwg.org/#dfn-convert-ecmascript-to-idl-value</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dfn-convert-ecmascript-to-idl-value">2.2. Manifest</a>
-    <li><a href="#ref-for-dfn-convert-ecmascript-to-idl-value①">2.3. Accounts List</a>
-    <li><a href="#ref-for-dfn-convert-ecmascript-to-idl-value②">2.4. Client Metadata</a>
-    <li><a href="#ref-for-dfn-convert-ecmascript-to-idl-value③">2.5. Identity Assertions</a>
-    <li><a href="#ref-for-dfn-convert-ecmascript-to-idl-value④">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-dfn-convert-ecmascript-to-idl-value⑤">(2)</a> <a href="#ref-for-dfn-convert-ecmascript-to-idl-value⑥">(3)</a> <a href="#ref-for-dfn-convert-ecmascript-to-idl-value⑦">(4)</a> <a href="#ref-for-dfn-convert-ecmascript-to-idl-value⑧">(5)</a>
+    <li><a href="#ref-for-dfn-convert-ecmascript-to-idl-value">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-dfn-convert-ecmascript-to-idl-value①">(2)</a> <a href="#ref-for-dfn-convert-ecmascript-to-idl-value②">(3)</a> <a href="#ref-for-dfn-convert-ecmascript-to-idl-value③">(4)</a> <a href="#ref-for-dfn-convert-ecmascript-to-idl-value④">(5)</a>
+    <li><a href="#ref-for-dfn-convert-ecmascript-to-idl-value⑤">3.2. Manifest</a>
+    <li><a href="#ref-for-dfn-convert-ecmascript-to-idl-value⑥">3.3. Accounts List</a>
+    <li><a href="#ref-for-dfn-convert-ecmascript-to-idl-value⑦">3.4. Client Metadata</a>
+    <li><a href="#ref-for-dfn-convert-ecmascript-to-idl-value⑧">3.5. Identity Assertions</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-idl-sequence">
    <a href="https://webidl.spec.whatwg.org/#idl-sequence">https://webidl.spec.whatwg.org/#idl-sequence</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-idl-sequence">2. The Identity Provider API</a>
-    <li><a href="#ref-for-idl-sequence①">2.2. Manifest</a>
-    <li><a href="#ref-for-idl-sequence②">2.3. Accounts List</a> <a href="#ref-for-idl-sequence③">(2)</a>
-    <li><a href="#ref-for-idl-sequence④">3.3. The CredentialRequestOptions</a>
+    <li><a href="#ref-for-idl-sequence">2.2.1. The CredentialRequestOptions ## {#browser-api-credential-request-options}</a>
+    <li><a href="#ref-for-idl-sequence①">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-idl-sequence②">(2)</a> <a href="#ref-for-idl-sequence③">(3)</a> <a href="#ref-for-idl-sequence④">(4)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-idl-unsigned-long">
    <a href="https://webidl.spec.whatwg.org/#idl-unsigned-long">https://webidl.spec.whatwg.org/#idl-unsigned-long</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-idl-unsigned-long">2.2. Manifest</a> <a href="#ref-for-idl-unsigned-long①">(2)</a>
+    <li><a href="#ref-for-idl-unsigned-long">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
+    <li><a href="#ref-for-idl-unsigned-long①">3.2. Manifest</a>
    </ul>
   </aside>
   <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span class="content">Terms defined by reference</span><a class="self-link" href="#index-defined-elsewhere"></a></h3>
@@ -3936,8 +3931,27 @@ <h3 class="no-num no-ref heading settled" id="informative"><span class="content"
    <dd><a href="https://datatracker.ietf.org/doc/html/rfc7258"><cite>Pervasive Monitoring Is an Attack</cite></a>. URL: <a href="https://datatracker.ietf.org/doc/html/rfc7258">https://datatracker.ietf.org/doc/html/rfc7258</a>
   </dl>
   <h2 class="no-num no-ref heading settled" id="idl-index"><span class="content">IDL Index</span><a class="self-link" href="#idl-index"></a></h2>
-<pre class="idl highlight def"><c- b>dictionary</c-> <a href="#dictdef-identityproviderwellknown"><code><c- g>IdentityProviderWellKnown</c-></code></a> {
-  <c- b>required</c-> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString"><c- b>USVString</c-></a>> <a data-type="sequence<USVString> " href="#dom-identityproviderwellknown-provider_urls"><code><c- g>provider_urls</c-></code></a>;
+<pre class="idl highlight def">[<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#Exposed"><c- g>Exposed</c-></a>=<c- n>Window</c->, <a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SecureContext"><c- g>SecureContext</c-></a>]
+<c- b>interface</c-> <a href="#identitycredential"><code><c- g>IdentityCredential</c-></code></a> : <a data-link-type="idl-name" href="https://w3c.github.io/webappsec-credential-management/#credential"><c- n>Credential</c-></a> {
+  <c- b>readonly</c-> <c- b>attribute</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString"><c- b>USVString</c-></a>? <a data-readonly data-type="USVString?" href="#dom-identitycredential-token"><code><c- g>token</c-></code></a>;
+};
+
+<c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="https://w3c.github.io/webappsec-credential-management/#dictdef-credentialrequestoptions"><c- g>CredentialRequestOptions</c-></a> {
+  <a data-link-type="idl-name" href="#dictdef-identitycredentialrequestoptions"><c- n>IdentityCredentialRequestOptions</c-></a> <a data-type="IdentityCredentialRequestOptions " href="#dom-credentialrequestoptions-identity"><code><c- g>identity</c-></code></a>;
+};
+
+<c- b>dictionary</c-> <a href="#dictdef-identitycredentialrequestoptions"><code><c- g>IdentityCredentialRequestOptions</c-></code></a> {
+  <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#dictdef-identityproviderconfig"><c- n>IdentityProviderConfig</c-></a>> <a data-type="sequence<IdentityProviderConfig> " href="#dom-identitycredentialrequestoptions-providers"><code><c- g>providers</c-></code></a>;
+};
+
+<c- b>dictionary</c-> <a href="#dictdef-identityproviderconfig"><code><c- g>IdentityProviderConfig</c-></code></a> {
+  <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString"><c- b>USVString</c-></a> <a data-type="USVString " href="#dom-identityproviderconfig-configurl"><code><c- g>configURL</c-></code></a>;
+  <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString"><c- b>USVString</c-></a> <a data-type="USVString " href="#dom-identityproviderconfig-clientid"><code><c- g>clientId</c-></code></a>;
+  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString"><c- b>USVString</c-></a> <a data-type="USVString " href="#dom-identityproviderconfig-nonce"><code><c- g>nonce</c-></code></a>;
+};
+
+<c- b>dictionary</c-> <a href="#dictdef-identityproviderwellknown"><code><c- g>IdentityProviderWellKnown</c-></code></a> {
+  <c- b>required</c-> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString"><c- b>USVString</c-></a>> <a class="idl-code" data-link-type="dict-member" data-type="sequence<USVString> " href="#dom-identityproviderwellknown-provider_urls"><c- g>provider_urls</c-></a>;
 };
 
 <c- b>dictionary</c-> <a href="#dictdef-identityprovidericon"><code><c- g>IdentityProviderIcon</c-></code></a> {
@@ -3964,44 +3978,24 @@ <h2 class="no-num no-ref heading settled" id="idl-index"><span class="content">I
   <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString"><c- b>USVString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="USVString " href="#dom-identityprovideraccount-email"><c- g>email</c-></a>;
   <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString"><c- b>USVString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="USVString " href="#dom-identityprovideraccount-given_name"><c- g>given_name</c-></a>;
   <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString"><c- b>USVString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="USVString " href="#dom-identityprovideraccount-picture"><c- g>picture</c-></a>;
-  <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString"><c- b>USVString</c-></a>> <a class="idl-code" data-link-type="dict-member" data-type="sequence<USVString> " href="#dom-identityprovideraccount-approved_clients"><c- g>approved_clients</c-></a>;
-};
-<c- b>dictionary</c-> <a href="#dictdef-identityprovideraccountlist"><code><c- g>IdentityProviderAccountList</c-></code></a> {
-  <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#dictdef-identityprovideraccount"><c- n>IdentityProviderAccount</c-></a>> <a data-type="sequence<IdentityProviderAccount> " href="#dom-identityprovideraccountlist-accounts"><code><c- g>accounts</c-></code></a>;
-};
-
-<c- b>dictionary</c-> <a href="#dictdef-identityproviderclientmetadata"><code><c- g>IdentityProviderClientMetadata</c-></code></a> {
-  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString"><c- b>USVString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="USVString " href="#dom-identityproviderclientmetadata-privacy_policy_url"><c- g>privacy_policy_url</c-></a>;
-  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString"><c- b>USVString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="USVString " href="#dom-identityproviderclientmetadata-terms_of_service_url"><c- g>terms_of_service_url</c-></a>;
-};
-
-<c- b>dictionary</c-> <a href="#dictdef-identityprovidertoken"><code><c- g>IdentityProviderToken</c-></code></a> {
-  <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString"><c- b>USVString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="USVString " href="#dom-identityprovidertoken-token"><c- g>token</c-></a>;
-};
-
-[<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#Exposed"><c- g>Exposed</c-></a>=<c- n>Window</c->, <a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SecureContext"><c- g>SecureContext</c-></a>]
-<c- b>interface</c-> <a href="#identitycredential"><code><c- g>IdentityCredential</c-></code></a> : <a data-link-type="idl-name" href="https://w3c.github.io/webappsec-credential-management/#credential"><c- n>Credential</c-></a> {
-  <c- b>readonly</c-> <c- b>attribute</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString"><c- b>USVString</c-></a>? <a data-readonly data-type="USVString?" href="#dom-identitycredential-token"><code><c- g>token</c-></code></a>;
-};
-
-<c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="https://w3c.github.io/webappsec-credential-management/#dictdef-credentialrequestoptions"><c- g>CredentialRequestOptions</c-></a> {
-  <a data-link-type="idl-name" href="#dictdef-identitycredentialrequestoptions"><c- n>IdentityCredentialRequestOptions</c-></a> <a data-type="IdentityCredentialRequestOptions " href="#dom-credentialrequestoptions-identity"><code><c- g>identity</c-></code></a>;
+  <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString"><c- b>USVString</c-></a>> <a class="idl-code" data-link-type="dict-member" data-type="sequence<USVString> " href="#dom-identityprovideraccount-approved_clients"><c- g>approved_clients</c-></a>;
+};
+<c- b>dictionary</c-> <a href="#dictdef-identityprovideraccountlist"><code><c- g>IdentityProviderAccountList</c-></code></a> {
+  <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#dictdef-identityprovideraccount"><c- n>IdentityProviderAccount</c-></a>> <a data-type="sequence<IdentityProviderAccount> " href="#dom-identityprovideraccountlist-accounts"><code><c- g>accounts</c-></code></a>;
 };
 
-<c- b>dictionary</c-> <a href="#dictdef-identitycredentialrequestoptions"><code><c- g>IdentityCredentialRequestOptions</c-></code></a> {
-  <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#dictdef-identityproviderconfig"><c- n>IdentityProviderConfig</c-></a>> <a data-type="sequence<IdentityProviderConfig> " href="#dom-identitycredentialrequestoptions-providers"><code><c- g>providers</c-></code></a>;
+<c- b>dictionary</c-> <a href="#dictdef-identityprovidertoken"><code><c- g>IdentityProviderToken</c-></code></a> {
+  <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString"><c- b>USVString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="USVString " href="#dom-identityprovidertoken-token"><c- g>token</c-></a>;
 };
 
-<c- b>dictionary</c-> <a href="#dictdef-identityproviderconfig"><code><c- g>IdentityProviderConfig</c-></code></a> {
-  <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString"><c- b>USVString</c-></a> <a data-type="USVString " href="#dom-identityproviderconfig-configurl"><code><c- g>configURL</c-></code></a>;
-  <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString"><c- b>USVString</c-></a> <a data-type="USVString " href="#dom-identityproviderconfig-clientid"><code><c- g>clientId</c-></code></a>;
-  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString"><c- b>USVString</c-></a> <a data-type="USVString " href="#dom-identityproviderconfig-nonce"><code><c- g>nonce</c-></code></a>;
+<c- b>dictionary</c-> <a href="#dictdef-identityproviderclientmetadata"><code><c- g>IdentityProviderClientMetadata</c-></code></a> {
+  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString"><c- b>USVString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="USVString " href="#dom-identityproviderclientmetadata-privacy_policy_url"><c- g>privacy_policy_url</c-></a>;
+  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString"><c- b>USVString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="USVString " href="#dom-identityproviderclientmetadata-terms_of_service_url"><c- g>terms_of_service_url</c-></a>;
 };
 
 </pre>
   <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content">Issues Index</span><a class="self-link" href="#issues-index"></a></h2>
   <div style="counter-reset:issue">
-   <div class="issue"> <a href="https://github.com/fedidcg/FedCM/issues/218">Clarify</a> the IDP API response when the user is not signed in. <a class="issue-return" href="#issue-ef9f6ef5" title="Jump to section">↵</a></div>
    <div class="issue"> Support choosing accounts from multiple <a data-link-type="dfn" href="#idp">IDP</a>s, as described <a href="https://github.com/fedidcg/FedCM/issues/319">here</a>. <a class="issue-return" href="#issue-ade48fb1" title="Jump to section">↵</a></div>
    <div class="issue"> Do not use <code class="idl"><a data-link-type="idl" href="https://html.spec.whatwg.org/multipage/timers-and-user-prompts.html#dom-settimeout">setTimeout()</a></code> directly, as that is not correct. See the relevant <a href="https://github.com/fedidcg/FedCM/issues/389">issue</a>. <a class="issue-return" href="#issue-adfae20a" title="Jump to section">↵</a></div>
    <div class="issue">The spec is yet to be updated so that all <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request">requests</a> are created
@@ -4012,20 +4006,21 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 user’s identities before the user grants permission. This is an active area of investigation
 that is being explored <a href="https://github.com/fedidcg/FedCM/issues/230#issuecomment-1089040953">here</a>. <a class="issue-return" href="#issue-77971f6b" title="Jump to section">↵</a></div>
    <div class="issue"> We should validate the accounts list returned here for repeated ids, as described <a href="https://github.com/fedidcg/FedCM/issues/336">here</a>. <a class="issue-return" href="#issue-db10ab61" title="Jump to section">↵</a></div>
+   <div class="issue"> <a href="https://github.com/fedidcg/FedCM/issues/218">Clarify</a> the IDP API response when the user is not signed in. <a class="issue-return" href="#issue-ef9f6ef5" title="Jump to section">↵</a></div>
   </div>
   <aside class="dfn-panel" data-for="rp">
    <b><a href="#rp">#rp</a></b><b>Referenced in:</b>
    <ul>
     <li><a href="#ref-for-rp">1. Introduction</a> <a href="#ref-for-rp①">(2)</a> <a href="#ref-for-rp②">(3)</a>
-    <li><a href="#ref-for-rp③">2.1. The Well-Known File</a>
-    <li><a href="#ref-for-rp④">2.2. Manifest</a>
-    <li><a href="#ref-for-rp⑤">2.3. Accounts List</a> <a href="#ref-for-rp⑥">(2)</a>
-    <li><a href="#ref-for-rp⑦">2.4. Client Metadata</a> <a href="#ref-for-rp⑧">(2)</a> <a href="#ref-for-rp⑨">(3)</a> <a href="#ref-for-rp①⓪">(4)</a>
-    <li><a href="#ref-for-rp①①">2.5. Identity Assertions</a> <a href="#ref-for-rp①②">(2)</a> <a href="#ref-for-rp①③">(3)</a> <a href="#ref-for-rp①④">(4)</a> <a href="#ref-for-rp①⑤">(5)</a> <a href="#ref-for-rp①⑥">(6)</a> <a href="#ref-for-rp①⑦">(7)</a>
-    <li><a href="#ref-for-rp①⑧">3. The Browser API</a> <a href="#ref-for-rp①⑨">(2)</a> <a href="#ref-for-rp②⓪">(3)</a> <a href="#ref-for-rp②①">(4)</a>
-    <li><a href="#ref-for-rp②②">3.1. The State Machine</a> <a href="#ref-for-rp②③">(2)</a> <a href="#ref-for-rp②④">(3)</a>
-    <li><a href="#ref-for-rp②⑤">3.3. The CredentialRequestOptions</a> <a href="#ref-for-rp②⑥">(2)</a> <a href="#ref-for-rp②⑦">(3)</a> <a href="#ref-for-rp②⑧">(4)</a>
-    <li><a href="#ref-for-rp②⑨">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-rp③⓪">(2)</a> <a href="#ref-for-rp③①">(3)</a> <a href="#ref-for-rp③②">(4)</a>
+    <li><a href="#ref-for-rp③">2. The Browser API</a> <a href="#ref-for-rp④">(2)</a> <a href="#ref-for-rp⑤">(3)</a> <a href="#ref-for-rp⑥">(4)</a>
+    <li><a href="#ref-for-rp⑦">2.1. The State Machine</a> <a href="#ref-for-rp⑧">(2)</a> <a href="#ref-for-rp⑨">(3)</a>
+    <li><a href="#ref-for-rp①⓪">2.2.1. The CredentialRequestOptions ## {#browser-api-credential-request-options}</a> <a href="#ref-for-rp①①">(2)</a> <a href="#ref-for-rp①②">(3)</a> <a href="#ref-for-rp①③">(4)</a>
+    <li><a href="#ref-for-rp①④">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-rp①⑤">(2)</a> <a href="#ref-for-rp①⑥">(3)</a> <a href="#ref-for-rp①⑦">(4)</a>
+    <li><a href="#ref-for-rp①⑧">3.1. The Well-Known File</a>
+    <li><a href="#ref-for-rp①⑨">3.2. Manifest</a>
+    <li><a href="#ref-for-rp②⓪">3.3. Accounts List</a> <a href="#ref-for-rp②①">(2)</a>
+    <li><a href="#ref-for-rp②②">3.4. Client Metadata</a> <a href="#ref-for-rp②③">(2)</a> <a href="#ref-for-rp②④">(3)</a> <a href="#ref-for-rp②⑤">(4)</a>
+    <li><a href="#ref-for-rp②⑥">3.5. Identity Assertions</a> <a href="#ref-for-rp②⑦">(2)</a> <a href="#ref-for-rp②⑧">(3)</a> <a href="#ref-for-rp②⑨">(4)</a> <a href="#ref-for-rp③⓪">(5)</a> <a href="#ref-for-rp③①">(6)</a> <a href="#ref-for-rp③②">(7)</a>
     <li><a href="#ref-for-rp③③">5.1. Content Security Policy</a> <a href="#ref-for-rp③④">(2)</a> <a href="#ref-for-rp③⑤">(3)</a> <a href="#ref-for-rp③⑥">(4)</a> <a href="#ref-for-rp③⑦">(5)</a> <a href="#ref-for-rp③⑧">(6)</a>
     <li><a href="#ref-for-rp③⑨">6.1. Principals</a> <a href="#ref-for-rp④⓪">(2)</a> <a href="#ref-for-rp④①">(3)</a> <a href="#ref-for-rp④②">(4)</a> <a href="#ref-for-rp④③">(5)</a> <a href="#ref-for-rp④④">(6)</a> <a href="#ref-for-rp④⑤">(7)</a> <a href="#ref-for-rp④⑥">(8)</a> <a href="#ref-for-rp④⑦">(9)</a> <a href="#ref-for-rp④⑧">(10)</a> <a href="#ref-for-rp④⑨">(11)</a> <a href="#ref-for-rp⑤⓪">(12)</a> <a href="#ref-for-rp⑤①">(13)</a> <a href="#ref-for-rp⑤②">(14)</a> <a href="#ref-for-rp⑤③">(15)</a>
     <li><a href="#ref-for-rp⑤④">6.2. Network requests</a> <a href="#ref-for-rp⑤⑤">(2)</a> <a href="#ref-for-rp⑤⑥">(3)</a> <a href="#ref-for-rp⑤⑦">(4)</a> <a href="#ref-for-rp⑤⑧">(5)</a> <a href="#ref-for-rp⑤⑨">(6)</a>
@@ -4043,16 +4038,16 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
    <b><a href="#idp">#idp</a></b><b>Referenced in:</b>
    <ul>
     <li><a href="#ref-for-idp">1. Introduction</a> <a href="#ref-for-idp①">(2)</a> <a href="#ref-for-idp②">(3)</a> <a href="#ref-for-idp③">(4)</a> <a href="#ref-for-idp④">(5)</a>
-    <li><a href="#ref-for-idp⑤">2. The Identity Provider API</a> <a href="#ref-for-idp⑥">(2)</a> <a href="#ref-for-idp⑦">(3)</a>
-    <li><a href="#ref-for-idp⑧">2.1. The Well-Known File</a> <a href="#ref-for-idp⑨">(2)</a>
-    <li><a href="#ref-for-idp①⓪">2.2. Manifest</a> <a href="#ref-for-idp①①">(2)</a> <a href="#ref-for-idp①②">(3)</a> <a href="#ref-for-idp①③">(4)</a>
-    <li><a href="#ref-for-idp①④">2.3. Accounts List</a> <a href="#ref-for-idp①⑤">(2)</a> <a href="#ref-for-idp①⑥">(3)</a>
-    <li><a href="#ref-for-idp①⑦">2.5. Identity Assertions</a> <a href="#ref-for-idp①⑧">(2)</a> <a href="#ref-for-idp①⑨">(3)</a> <a href="#ref-for-idp②⓪">(4)</a> <a href="#ref-for-idp②①">(5)</a> <a href="#ref-for-idp②②">(6)</a> <a href="#ref-for-idp②③">(7)</a> <a href="#ref-for-idp②④">(8)</a> <a href="#ref-for-idp②⑤">(9)</a> <a href="#ref-for-idp②⑥">(10)</a>
-    <li><a href="#ref-for-idp②⑦">3. The Browser API</a> <a href="#ref-for-idp②⑧">(2)</a> <a href="#ref-for-idp②⑨">(3)</a>
-    <li><a href="#ref-for-idp③⓪">3.1. The State Machine</a> <a href="#ref-for-idp③①">(2)</a>
-    <li><a href="#ref-for-idp③②">3.2. The IdentityCredential Interface</a>
-    <li><a href="#ref-for-idp③③">3.3. The CredentialRequestOptions</a> <a href="#ref-for-idp③④">(2)</a>
-    <li><a href="#ref-for-idp③⑤">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-idp③⑥">(2)</a> <a href="#ref-for-idp③⑦">(3)</a> <a href="#ref-for-idp③⑧">(4)</a> <a href="#ref-for-idp③⑨">(5)</a> <a href="#ref-for-idp④⓪">(6)</a> <a href="#ref-for-idp④①">(7)</a>
+    <li><a href="#ref-for-idp⑤">2. The Browser API</a> <a href="#ref-for-idp⑥">(2)</a> <a href="#ref-for-idp⑦">(3)</a>
+    <li><a href="#ref-for-idp⑧">2.1. The State Machine</a> <a href="#ref-for-idp⑨">(2)</a>
+    <li><a href="#ref-for-idp①⓪">2.2. The IdentityCredential Interface</a>
+    <li><a href="#ref-for-idp①①">2.2.1. The CredentialRequestOptions ## {#browser-api-credential-request-options}</a> <a href="#ref-for-idp①②">(2)</a>
+    <li><a href="#ref-for-idp①③">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-idp①④">(2)</a> <a href="#ref-for-idp①⑤">(3)</a> <a href="#ref-for-idp①⑥">(4)</a> <a href="#ref-for-idp①⑦">(5)</a> <a href="#ref-for-idp①⑧">(6)</a> <a href="#ref-for-idp①⑨">(7)</a>
+    <li><a href="#ref-for-idp②⓪">3. Identity Provider HTTP API</a> <a href="#ref-for-idp②①">(2)</a>
+    <li><a href="#ref-for-idp②②">3.1. The Well-Known File</a> <a href="#ref-for-idp②③">(2)</a>
+    <li><a href="#ref-for-idp②④">3.2. Manifest</a> <a href="#ref-for-idp②⑤">(2)</a> <a href="#ref-for-idp②⑥">(3)</a> <a href="#ref-for-idp②⑦">(4)</a>
+    <li><a href="#ref-for-idp②⑧">3.3. Accounts List</a> <a href="#ref-for-idp②⑨">(2)</a> <a href="#ref-for-idp③⓪">(3)</a>
+    <li><a href="#ref-for-idp③①">3.5. Identity Assertions</a> <a href="#ref-for-idp③②">(2)</a> <a href="#ref-for-idp③③">(3)</a> <a href="#ref-for-idp③④">(4)</a> <a href="#ref-for-idp③⑤">(5)</a> <a href="#ref-for-idp③⑥">(6)</a> <a href="#ref-for-idp③⑦">(7)</a> <a href="#ref-for-idp③⑧">(8)</a> <a href="#ref-for-idp③⑨">(9)</a> <a href="#ref-for-idp④⓪">(10)</a> <a href="#ref-for-idp④①">(11)</a>
     <li><a href="#ref-for-idp④②">5.1. Content Security Policy</a> <a href="#ref-for-idp④③">(2)</a> <a href="#ref-for-idp④④">(3)</a> <a href="#ref-for-idp④⑤">(4)</a>
     <li><a href="#ref-for-idp④⑥">5.2. Sec-Fetch-Dest Header</a> <a href="#ref-for-idp④⑦">(2)</a> <a href="#ref-for-idp④⑧">(3)</a> <a href="#ref-for-idp④⑨">(4)</a>
     <li><a href="#ref-for-idp⑤⓪">5.3. Browser Surface Impersonation</a>
@@ -4067,392 +4062,388 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-idp⑨⑧">6.3.7. Secondary Use</a> <a href="#ref-for-idp⑨⑨">(2)</a> <a href="#ref-for-idp①⓪⓪">(3)</a> <a href="#ref-for-idp①⓪①">(4)</a> <a href="#ref-for-idp①⓪②">(5)</a> <a href="#ref-for-idp①⓪③">(6)</a> <a href="#ref-for-idp①⓪④">(7)</a> <a href="#ref-for-idp①⓪⑤">(8)</a> <a href="#ref-for-idp①⓪⑥">(9)</a> <a href="#ref-for-idp①⓪⑦">(10)</a> <a href="#ref-for-idp①⓪⑧">(11)</a> <a href="#ref-for-idp①⓪⑨">(12)</a> <a href="#ref-for-idp①①⓪">(13)</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="dictdef-identityproviderwellknown">
-   <b><a href="#dictdef-identityproviderwellknown">#dictdef-identityproviderwellknown</a></b><b>Referenced in:</b>
-   <ul>
-    <li><a href="#ref-for-dictdef-identityproviderwellknown">2. The Identity Provider API</a>
-    <li><a href="#ref-for-dictdef-identityproviderwellknown①">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
-   </ul>
-  </aside>
-  <aside class="dfn-panel" data-for="dom-identityproviderwellknown-provider_urls">
-   <b><a href="#dom-identityproviderwellknown-provider_urls">#dom-identityproviderwellknown-provider_urls</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="state-machine-map">
+   <b><a href="#state-machine-map">#state-machine-map</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-identityproviderwellknown-provider_urls">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-dom-identityproviderwellknown-provider_urls①">(2)</a>
+    <li><a href="#ref-for-state-machine-map">2.1. The State Machine</a> <a href="#ref-for-state-machine-map①">(2)</a> <a href="#ref-for-state-machine-map②">(3)</a> <a href="#ref-for-state-machine-map③">(4)</a> <a href="#ref-for-state-machine-map④">(5)</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="well-known">
-   <b><a href="#well-known">#well-known</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="accountstate">
+   <b><a href="#accountstate">#accountstate</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-well-known">2.1. The Well-Known File</a>
+    <li><a href="#ref-for-accountstate">2.1. The State Machine</a> <a href="#ref-for-accountstate①">(2)</a> <a href="#ref-for-accountstate②">(3)</a>
+    <li><a href="#ref-for-accountstate③">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-accountstate④">(2)</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="dictdef-identityprovidericon">
-   <b><a href="#dictdef-identityprovidericon">#dictdef-identityprovidericon</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="dom-accountstate-registration-state">
+   <b><a href="#dom-accountstate-registration-state">#dom-accountstate-registration-state</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dictdef-identityprovidericon">2.2. Manifest</a> <a href="#ref-for-dictdef-identityprovidericon①">(2)</a> <a href="#ref-for-dictdef-identityprovidericon②">(3)</a> <a href="#ref-for-dictdef-identityprovidericon③">(4)</a>
+    <li><a href="#ref-for-dom-accountstate-registration-state">2.1. The State Machine</a>
+    <li><a href="#ref-for-dom-accountstate-registration-state①">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-dom-accountstate-registration-state②">(2)</a> <a href="#ref-for-dom-accountstate-registration-state③">(3)</a> <a href="#ref-for-dom-accountstate-registration-state④">(4)</a> <a href="#ref-for-dom-accountstate-registration-state⑤">(5)</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="dictdef-identityproviderbranding">
-   <b><a href="#dictdef-identityproviderbranding">#dictdef-identityproviderbranding</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="dom-accountstate-registered">
+   <b><a href="#dom-accountstate-registered">#dom-accountstate-registered</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dictdef-identityproviderbranding">2.2. Manifest</a> <a href="#ref-for-dictdef-identityproviderbranding①">(2)</a> <a href="#ref-for-dictdef-identityproviderbranding②">(3)</a> <a href="#ref-for-dictdef-identityproviderbranding③">(4)</a>
-    <li><a href="#ref-for-dictdef-identityproviderbranding④">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
+    <li><a href="#ref-for-dom-accountstate-registered">2.1. The State Machine</a>
+    <li><a href="#ref-for-dom-accountstate-registered①">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-dom-accountstate-registered②">(2)</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="dictdef-identityproviderapiconfig">
-   <b><a href="#dictdef-identityproviderapiconfig">#dictdef-identityproviderapiconfig</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="dom-accountstate-unregistered">
+   <b><a href="#dom-accountstate-unregistered">#dom-accountstate-unregistered</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dictdef-identityproviderapiconfig">2.2. Manifest</a> <a href="#ref-for-dictdef-identityproviderapiconfig①">(2)</a>
-    <li><a href="#ref-for-dictdef-identityproviderapiconfig②">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-dictdef-identityproviderapiconfig③">(2)</a> <a href="#ref-for-dictdef-identityproviderapiconfig④">(3)</a> <a href="#ref-for-dictdef-identityproviderapiconfig⑤">(4)</a> <a href="#ref-for-dictdef-identityproviderapiconfig⑥">(5)</a> <a href="#ref-for-dictdef-identityproviderapiconfig⑦">(6)</a>
+    <li><a href="#ref-for-dom-accountstate-unregistered">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-dom-accountstate-unregistered①">(2)</a> <a href="#ref-for-dom-accountstate-unregistered②">(3)</a> <a href="#ref-for-dom-accountstate-unregistered③">(4)</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="dom-identityproviderapiconfig-accounts_endpoint">
-   <b><a href="#dom-identityproviderapiconfig-accounts_endpoint">#dom-identityproviderapiconfig-accounts_endpoint</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="dom-accountstate-allows-logout">
+   <b><a href="#dom-accountstate-allows-logout">#dom-accountstate-allows-logout</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-identityproviderapiconfig-accounts_endpoint">2.2. Manifest</a>
-    <li><a href="#ref-for-dom-identityproviderapiconfig-accounts_endpoint①">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
+    <li><a href="#ref-for-dom-accountstate-allows-logout">2.1. The State Machine</a>
+    <li><a href="#ref-for-dom-accountstate-allows-logout①">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-dom-accountstate-allows-logout②">(2)</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="dom-identityproviderapiconfig-client_metadata_endpoint">
-   <b><a href="#dom-identityproviderapiconfig-client_metadata_endpoint">#dom-identityproviderapiconfig-client_metadata_endpoint</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="compute-account-state">
+   <b><a href="#compute-account-state">#compute-account-state</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-identityproviderapiconfig-client_metadata_endpoint">2.2. Manifest</a>
-    <li><a href="#ref-for-dom-identityproviderapiconfig-client_metadata_endpoint①">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
+    <li><a href="#ref-for-compute-account-state">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-compute-account-state①">(2)</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="dom-identityproviderapiconfig-id_assertion_endpoint">
-   <b><a href="#dom-identityproviderapiconfig-id_assertion_endpoint">#dom-identityproviderapiconfig-id_assertion_endpoint</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="sign-in">
+   <b><a href="#sign-in">#sign-in</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-identityproviderapiconfig-id_assertion_endpoint">2.2. Manifest</a>
-    <li><a href="#ref-for-dom-identityproviderapiconfig-id_assertion_endpoint①">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
+    <li><a href="#ref-for-sign-in">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-sign-in①">(2)</a> <a href="#ref-for-sign-in②">(3)</a>
+    <li><a href="#ref-for-sign-in③">3.5. Identity Assertions</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="dom-identityproviderapiconfig-branding">
-   <b><a href="#dom-identityproviderapiconfig-branding">#dom-identityproviderapiconfig-branding</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="identitycredential">
+   <b><a href="#identitycredential">#identitycredential</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-identityproviderapiconfig-branding">2.2. Manifest</a>
+    <li><a href="#ref-for-identitycredential">2. The Browser API</a>
+    <li><a href="#ref-for-identitycredential①">2.1. The State Machine</a>
+    <li><a href="#ref-for-identitycredential②">2.2. The IdentityCredential Interface</a>
+    <li><a href="#ref-for-identitycredential③">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-identitycredential④">(2)</a> <a href="#ref-for-identitycredential⑤">(3)</a> <a href="#ref-for-identitycredential⑥">(4)</a> <a href="#ref-for-identitycredential⑦">(5)</a> <a href="#ref-for-identitycredential⑧">(6)</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="dom-identityproviderbranding-background_color">
-   <b><a href="#dom-identityproviderbranding-background_color">#dom-identityproviderbranding-background_color</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="dom-identitycredential-token">
+   <b><a href="#dom-identitycredential-token">#dom-identitycredential-token</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-identityproviderbranding-background_color">2.2. Manifest</a>
+    <li><a href="#ref-for-dom-identitycredential-token">2.2. The IdentityCredential Interface</a> <a href="#ref-for-dom-identitycredential-token①">(2)</a>
+    <li><a href="#ref-for-dom-identitycredential-token②">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="dom-identityproviderbranding-color">
-   <b><a href="#dom-identityproviderbranding-color">#dom-identityproviderbranding-color</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="dom-credentialrequestoptions-identity">
+   <b><a href="#dom-credentialrequestoptions-identity">#dom-credentialrequestoptions-identity</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-identityproviderbranding-color">2.2. Manifest</a>
+    <li><a href="#ref-for-dom-credentialrequestoptions-identity">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-dom-credentialrequestoptions-identity①">(2)</a> <a href="#ref-for-dom-credentialrequestoptions-identity②">(3)</a> <a href="#ref-for-dom-credentialrequestoptions-identity③">(4)</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="dom-identityproviderbranding-icons">
-   <b><a href="#dom-identityproviderbranding-icons">#dom-identityproviderbranding-icons</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="dictdef-identitycredentialrequestoptions">
+   <b><a href="#dictdef-identitycredentialrequestoptions">#dictdef-identitycredentialrequestoptions</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-identityproviderbranding-icons">2.2. Manifest</a>
+    <li><a href="#ref-for-dictdef-identitycredentialrequestoptions">2.2.1. The CredentialRequestOptions ## {#browser-api-credential-request-options}</a> <a href="#ref-for-dictdef-identitycredentialrequestoptions①">(2)</a>
+    <li><a href="#ref-for-dictdef-identitycredentialrequestoptions②">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="dom-identityprovidericon-url">
-   <b><a href="#dom-identityprovidericon-url">#dom-identityprovidericon-url</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="dom-identitycredentialrequestoptions-providers">
+   <b><a href="#dom-identitycredentialrequestoptions-providers">#dom-identitycredentialrequestoptions-providers</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-identityprovidericon-url">2.2. Manifest</a>
+    <li><a href="#ref-for-dom-identitycredentialrequestoptions-providers">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-dom-identitycredentialrequestoptions-providers①">(2)</a> <a href="#ref-for-dom-identitycredentialrequestoptions-providers②">(3)</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="dom-identityprovidericon-size">
-   <b><a href="#dom-identityprovidericon-size">#dom-identityprovidericon-size</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="dictdef-identityproviderconfig">
+   <b><a href="#dictdef-identityproviderconfig">#dictdef-identityproviderconfig</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-identityprovidericon-size">2.2. Manifest</a>
+    <li><a href="#ref-for-dictdef-identityproviderconfig">2.1. The State Machine</a>
+    <li><a href="#ref-for-dictdef-identityproviderconfig①">2.2.1. The CredentialRequestOptions ## {#browser-api-credential-request-options}</a> <a href="#ref-for-dictdef-identityproviderconfig②">(2)</a> <a href="#ref-for-dictdef-identityproviderconfig③">(3)</a>
+    <li><a href="#ref-for-dictdef-identityproviderconfig④">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-dictdef-identityproviderconfig⑤">(2)</a> <a href="#ref-for-dictdef-identityproviderconfig⑥">(3)</a> <a href="#ref-for-dictdef-identityproviderconfig⑦">(4)</a> <a href="#ref-for-dictdef-identityproviderconfig⑧">(5)</a> <a href="#ref-for-dictdef-identityproviderconfig⑨">(6)</a> <a href="#ref-for-dictdef-identityproviderconfig①⓪">(7)</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="color">
-   <b><a href="#color">#color</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="dom-identityproviderconfig-configurl">
+   <b><a href="#dom-identityproviderconfig-configurl">#dom-identityproviderconfig-configurl</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-color">2.2. Manifest</a> <a href="#ref-for-color①">(2)</a>
+    <li><a href="#ref-for-dom-identityproviderconfig-configurl">2.1. The State Machine</a>
+    <li><a href="#ref-for-dom-identityproviderconfig-configurl①">2.2.1. The CredentialRequestOptions ## {#browser-api-credential-request-options}</a>
+    <li><a href="#ref-for-dom-identityproviderconfig-configurl②">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-dom-identityproviderconfig-configurl③">(2)</a> <a href="#ref-for-dom-identityproviderconfig-configurl④">(3)</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="dictdef-identityprovideraccount">
-   <b><a href="#dictdef-identityprovideraccount">#dictdef-identityprovideraccount</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="dom-identityproviderconfig-clientid">
+   <b><a href="#dom-identityproviderconfig-clientid">#dom-identityproviderconfig-clientid</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dictdef-identityprovideraccount">2.3. Accounts List</a> <a href="#ref-for-dictdef-identityprovideraccount①">(2)</a>
-    <li><a href="#ref-for-dictdef-identityprovideraccount②">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-dictdef-identityprovideraccount③">(2)</a> <a href="#ref-for-dictdef-identityprovideraccount④">(3)</a> <a href="#ref-for-dictdef-identityprovideraccount⑤">(4)</a> <a href="#ref-for-dictdef-identityprovideraccount⑥">(5)</a>
+    <li><a href="#ref-for-dom-identityproviderconfig-clientid">2.2.1. The CredentialRequestOptions ## {#browser-api-credential-request-options}</a>
+    <li><a href="#ref-for-dom-identityproviderconfig-clientid①">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-dom-identityproviderconfig-clientid②">(2)</a> <a href="#ref-for-dom-identityproviderconfig-clientid③">(3)</a>
+    <li><a href="#ref-for-dom-identityproviderconfig-clientid④">3.3. Accounts List</a>
+    <li><a href="#ref-for-dom-identityproviderconfig-clientid⑤">3.5. Identity Assertions</a> <a href="#ref-for-dom-identityproviderconfig-clientid⑥">(2)</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="dictdef-identityprovideraccountlist">
-   <b><a href="#dictdef-identityprovideraccountlist">#dictdef-identityprovideraccountlist</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="dom-identityproviderconfig-nonce">
+   <b><a href="#dom-identityproviderconfig-nonce">#dom-identityproviderconfig-nonce</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dictdef-identityprovideraccountlist">2.3. Accounts List</a>
-    <li><a href="#ref-for-dictdef-identityprovideraccountlist①">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-dictdef-identityprovideraccountlist②">(2)</a>
+    <li><a href="#ref-for-dom-identityproviderconfig-nonce">2.2.1. The CredentialRequestOptions ## {#browser-api-credential-request-options}</a>
+    <li><a href="#ref-for-dom-identityproviderconfig-nonce①">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="dom-identityprovideraccount-id">
-   <b><a href="#dom-identityprovideraccount-id">#dom-identityprovideraccount-id</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="create-an-identitycredential">
+   <b><a href="#create-an-identitycredential">#create-an-identitycredential</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-identityprovideraccount-id">2.3. Accounts List</a>
-    <li><a href="#ref-for-dom-identityprovideraccount-id①">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-dom-identityprovideraccount-id②">(2)</a>
+    <li><a href="#ref-for-create-an-identitycredential">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
+    <li><a href="#ref-for-create-an-identitycredential①">6.3.1. Manifest Fingerprinting</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="dom-identityprovideraccount-name">
-   <b><a href="#dom-identityprovideraccount-name">#dom-identityprovideraccount-name</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="parse-url">
+   <b><a href="#parse-url">#parse-url</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-identityprovideraccount-name">2.3. Accounts List</a>
+    <li><a href="#ref-for-parse-url">2.1. The State Machine</a>
+    <li><a href="#ref-for-parse-url①">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-parse-url②">(2)</a> <a href="#ref-for-parse-url③">(3)</a> <a href="#ref-for-parse-url④">(4)</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="dom-identityprovideraccount-email">
-   <b><a href="#dom-identityprovideraccount-email">#dom-identityprovideraccount-email</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="fetch-request">
+   <b><a href="#fetch-request">#fetch-request</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-identityprovideraccount-email">2.3. Accounts List</a>
+    <li><a href="#ref-for-fetch-request">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-fetch-request①">(2)</a> <a href="#ref-for-fetch-request②">(3)</a> <a href="#ref-for-fetch-request③">(4)</a> <a href="#ref-for-fetch-request④">(5)</a> <a href="#ref-for-fetch-request⑤">(6)</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="dom-identityprovideraccount-given_name">
-   <b><a href="#dom-identityprovideraccount-given_name">#dom-identityprovideraccount-given_name</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="fetch-the-config-file">
+   <b><a href="#fetch-the-config-file">#fetch-the-config-file</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-identityprovideraccount-given_name">2.3. Accounts List</a>
+    <li><a href="#ref-for-fetch-the-config-file">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="dom-identityprovideraccount-picture">
-   <b><a href="#dom-identityprovideraccount-picture">#dom-identityprovideraccount-picture</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="dictdef-identityproviderwellknown">
+   <b><a href="#dictdef-identityproviderwellknown">#dictdef-identityproviderwellknown</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-identityprovideraccount-picture">2.3. Accounts List</a>
-    <li><a href="#ref-for-dom-identityprovideraccount-picture①">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-dom-identityprovideraccount-picture②">(2)</a>
+    <li><a href="#ref-for-dictdef-identityproviderwellknown">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
+    <li><a href="#ref-for-dictdef-identityproviderwellknown①">3.1. The Well-Known File</a> <a href="#ref-for-dictdef-identityproviderwellknown②">(2)</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="dom-identityprovideraccount-approved_clients">
-   <b><a href="#dom-identityprovideraccount-approved_clients">#dom-identityprovideraccount-approved_clients</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="dictdef-identityprovidericon">
+   <b><a href="#dictdef-identityprovidericon">#dictdef-identityprovidericon</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-identityprovideraccount-approved_clients">2.3. Accounts List</a>
-    <li><a href="#ref-for-dom-identityprovideraccount-approved_clients①">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-dom-identityprovideraccount-approved_clients②">(2)</a>
+    <li><a href="#ref-for-dictdef-identityprovidericon">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
+    <li><a href="#ref-for-dictdef-identityprovidericon①">3.2. Manifest</a> <a href="#ref-for-dictdef-identityprovidericon②">(2)</a> <a href="#ref-for-dictdef-identityprovidericon③">(3)</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="dictdef-identityproviderclientmetadata">
-   <b><a href="#dictdef-identityproviderclientmetadata">#dictdef-identityproviderclientmetadata</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="dictdef-identityproviderbranding">
+   <b><a href="#dictdef-identityproviderbranding">#dictdef-identityproviderbranding</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dictdef-identityproviderclientmetadata">2.4. Client Metadata</a> <a href="#ref-for-dictdef-identityproviderclientmetadata①">(2)</a>
-    <li><a href="#ref-for-dictdef-identityproviderclientmetadata②">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-dictdef-identityproviderclientmetadata③">(2)</a>
+    <li><a href="#ref-for-dictdef-identityproviderbranding">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-dictdef-identityproviderbranding①">(2)</a>
+    <li><a href="#ref-for-dictdef-identityproviderbranding②">3.2. Manifest</a> <a href="#ref-for-dictdef-identityproviderbranding③">(2)</a> <a href="#ref-for-dictdef-identityproviderbranding④">(3)</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="dom-identityproviderclientmetadata-privacy_policy_url">
-   <b><a href="#dom-identityproviderclientmetadata-privacy_policy_url">#dom-identityproviderclientmetadata-privacy_policy_url</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="dictdef-identityproviderapiconfig">
+   <b><a href="#dictdef-identityproviderapiconfig">#dictdef-identityproviderapiconfig</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-identityproviderclientmetadata-privacy_policy_url">2.4. Client Metadata</a>
-    <li><a href="#ref-for-dom-identityproviderclientmetadata-privacy_policy_url①">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-dom-identityproviderclientmetadata-privacy_policy_url②">(2)</a>
+    <li><a href="#ref-for-dictdef-identityproviderapiconfig">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-dictdef-identityproviderapiconfig①">(2)</a> <a href="#ref-for-dictdef-identityproviderapiconfig②">(3)</a> <a href="#ref-for-dictdef-identityproviderapiconfig③">(4)</a> <a href="#ref-for-dictdef-identityproviderapiconfig④">(5)</a> <a href="#ref-for-dictdef-identityproviderapiconfig⑤">(6)</a>
+    <li><a href="#ref-for-dictdef-identityproviderapiconfig⑥">3.2. Manifest</a> <a href="#ref-for-dictdef-identityproviderapiconfig⑦">(2)</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="dom-identityproviderclientmetadata-terms_of_service_url">
-   <b><a href="#dom-identityproviderclientmetadata-terms_of_service_url">#dom-identityproviderclientmetadata-terms_of_service_url</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="fetch-the-accounts-list">
+   <b><a href="#fetch-the-accounts-list">#fetch-the-accounts-list</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-identityproviderclientmetadata-terms_of_service_url">2.4. Client Metadata</a>
-    <li><a href="#ref-for-dom-identityproviderclientmetadata-terms_of_service_url①">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-dom-identityproviderclientmetadata-terms_of_service_url②">(2)</a>
+    <li><a href="#ref-for-fetch-the-accounts-list">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="dom-id_assertion_endpoint_request-client_id">
-   <b><a href="#dom-id_assertion_endpoint_request-client_id">#dom-id_assertion_endpoint_request-client_id</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="dictdef-identityprovideraccount">
+   <b><a href="#dictdef-identityprovideraccount">#dictdef-identityprovideraccount</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-id_assertion_endpoint_request-client_id">3.3. The CredentialRequestOptions</a>
-    <li><a href="#ref-for-dom-id_assertion_endpoint_request-client_id①">6.2. Network requests</a> <a href="#ref-for-dom-id_assertion_endpoint_request-client_id②">(2)</a> <a href="#ref-for-dom-id_assertion_endpoint_request-client_id③">(3)</a> <a href="#ref-for-dom-id_assertion_endpoint_request-client_id④">(4)</a>
+    <li><a href="#ref-for-dictdef-identityprovideraccount">2.1. The State Machine</a>
+    <li><a href="#ref-for-dictdef-identityprovideraccount①">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-dictdef-identityprovideraccount②">(2)</a> <a href="#ref-for-dictdef-identityprovideraccount③">(3)</a> <a href="#ref-for-dictdef-identityprovideraccount④">(4)</a> <a href="#ref-for-dictdef-identityprovideraccount⑤">(5)</a>
+    <li><a href="#ref-for-dictdef-identityprovideraccount⑥">3.3. Accounts List</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="dictdef-identityprovidertoken">
-   <b><a href="#dictdef-identityprovidertoken">#dictdef-identityprovidertoken</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="dictdef-identityprovideraccountlist">
+   <b><a href="#dictdef-identityprovideraccountlist">#dictdef-identityprovideraccountlist</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dictdef-identityprovidertoken">2.5. Identity Assertions</a> <a href="#ref-for-dictdef-identityprovidertoken①">(2)</a>
-    <li><a href="#ref-for-dictdef-identityprovidertoken②">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
+    <li><a href="#ref-for-dictdef-identityprovideraccountlist">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-dictdef-identityprovideraccountlist①">(2)</a>
+    <li><a href="#ref-for-dictdef-identityprovideraccountlist②">3.3. Accounts List</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="dom-identityprovidertoken-token">
-   <b><a href="#dom-identityprovidertoken-token">#dom-identityprovidertoken-token</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="fetch-the-account-picture">
+   <b><a href="#fetch-the-account-picture">#fetch-the-account-picture</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-identityprovidertoken-token">2.5. Identity Assertions</a> <a href="#ref-for-dom-identityprovidertoken-token①">(2)</a> <a href="#ref-for-dom-identityprovidertoken-token②">(3)</a>
-    <li><a href="#ref-for-dom-identityprovidertoken-token③">3.2. The IdentityCredential Interface</a>
-    <li><a href="#ref-for-dom-identityprovidertoken-token④">3.3. The CredentialRequestOptions</a>
+    <li><a href="#ref-for-fetch-the-account-picture">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="state-machine-map">
-   <b><a href="#state-machine-map">#state-machine-map</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="fetch-an-identity-assertion">
+   <b><a href="#fetch-an-identity-assertion">#fetch-an-identity-assertion</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-state-machine-map">3.1. The State Machine</a> <a href="#ref-for-state-machine-map①">(2)</a>
-    <li><a href="#ref-for-state-machine-map②">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-state-machine-map③">(2)</a> <a href="#ref-for-state-machine-map④">(3)</a>
+    <li><a href="#ref-for-fetch-an-identity-assertion">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="accountstate">
-   <b><a href="#accountstate">#accountstate</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="dictdef-identityprovidertoken">
+   <b><a href="#dictdef-identityprovidertoken">#dictdef-identityprovidertoken</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-accountstate">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-accountstate①">(2)</a> <a href="#ref-for-accountstate②">(3)</a> <a href="#ref-for-accountstate③">(4)</a> <a href="#ref-for-accountstate④">(5)</a>
+    <li><a href="#ref-for-dictdef-identityprovidertoken">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
+    <li><a href="#ref-for-dictdef-identityprovidertoken①">3.5. Identity Assertions</a> <a href="#ref-for-dictdef-identityprovidertoken②">(2)</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="dom-accountstate-registration-state">
-   <b><a href="#dom-accountstate-registration-state">#dom-accountstate-registration-state</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="computing-the-manifest-url">
+   <b><a href="#computing-the-manifest-url">#computing-the-manifest-url</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-accountstate-registration-state">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-dom-accountstate-registration-state①">(2)</a> <a href="#ref-for-dom-accountstate-registration-state②">(3)</a> <a href="#ref-for-dom-accountstate-registration-state③">(4)</a> <a href="#ref-for-dom-accountstate-registration-state④">(5)</a> <a href="#ref-for-dom-accountstate-registration-state⑤">(6)</a>
+    <li><a href="#ref-for-computing-the-manifest-url">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-computing-the-manifest-url①">(2)</a> <a href="#ref-for-computing-the-manifest-url②">(3)</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="dom-accountstate-registered">
-   <b><a href="#dom-accountstate-registered">#dom-accountstate-registered</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="extract-the-json-fetch-response">
+   <b><a href="#extract-the-json-fetch-response">#extract-the-json-fetch-response</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-accountstate-registered">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-dom-accountstate-registered①">(2)</a> <a href="#ref-for-dom-accountstate-registered②">(3)</a>
+    <li><a href="#ref-for-extract-the-json-fetch-response">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-extract-the-json-fetch-response①">(2)</a> <a href="#ref-for-extract-the-json-fetch-response②">(3)</a> <a href="#ref-for-extract-the-json-fetch-response③">(4)</a> <a href="#ref-for-extract-the-json-fetch-response④">(5)</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="dom-accountstate-unregistered">
-   <b><a href="#dom-accountstate-unregistered">#dom-accountstate-unregistered</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="request-permission-to-sign-up">
+   <b><a href="#request-permission-to-sign-up">#request-permission-to-sign-up</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-accountstate-unregistered">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-dom-accountstate-unregistered①">(2)</a> <a href="#ref-for-dom-accountstate-unregistered②">(3)</a> <a href="#ref-for-dom-accountstate-unregistered③">(4)</a>
+    <li><a href="#ref-for-request-permission-to-sign-up">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-request-permission-to-sign-up①">(2)</a>
+    <li><a href="#ref-for-request-permission-to-sign-up②">3.3. Accounts List</a>
+    <li><a href="#ref-for-request-permission-to-sign-up③">3.5. Identity Assertions</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="dom-accountstate-allows-logout">
-   <b><a href="#dom-accountstate-allows-logout">#dom-accountstate-allows-logout</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="fetch-the-client-metadata">
+   <b><a href="#fetch-the-client-metadata">#fetch-the-client-metadata</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-accountstate-allows-logout">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-dom-accountstate-allows-logout①">(2)</a> <a href="#ref-for-dom-accountstate-allows-logout②">(3)</a>
+    <li><a href="#ref-for-fetch-the-client-metadata">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="identitycredential">
-   <b><a href="#identitycredential">#identitycredential</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="dictdef-identityproviderclientmetadata">
+   <b><a href="#dictdef-identityproviderclientmetadata">#dictdef-identityproviderclientmetadata</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-identitycredential">3. The Browser API</a> <a href="#ref-for-identitycredential①">(2)</a> <a href="#ref-for-identitycredential②">(3)</a>
-    <li><a href="#ref-for-identitycredential③">3.1. The State Machine</a>
-    <li><a href="#ref-for-identitycredential④">3.2. The IdentityCredential Interface</a>
-    <li><a href="#ref-for-identitycredential⑤">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-identitycredential⑥">(2)</a> <a href="#ref-for-identitycredential⑦">(3)</a> <a href="#ref-for-identitycredential⑧">(4)</a> <a href="#ref-for-identitycredential⑨">(5)</a> <a href="#ref-for-identitycredential①⓪">(6)</a>
+    <li><a href="#ref-for-dictdef-identityproviderclientmetadata">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-dictdef-identityproviderclientmetadata①">(2)</a>
+    <li><a href="#ref-for-dictdef-identityproviderclientmetadata②">3.4. Client Metadata</a> <a href="#ref-for-dictdef-identityproviderclientmetadata③">(2)</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="dom-identitycredential-token">
-   <b><a href="#dom-identitycredential-token">#dom-identitycredential-token</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="select-an-account">
+   <b><a href="#select-an-account">#select-an-account</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-identitycredential-token">3.2. The IdentityCredential Interface</a> <a href="#ref-for-dom-identitycredential-token①">(2)</a>
-    <li><a href="#ref-for-dom-identitycredential-token②">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
+    <li><a href="#ref-for-select-an-account">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="dom-credentialrequestoptions-identity">
-   <b><a href="#dom-credentialrequestoptions-identity">#dom-credentialrequestoptions-identity</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="dom-identityproviderwellknown-provider_urls">
+   <b><a href="#dom-identityproviderwellknown-provider_urls">#dom-identityproviderwellknown-provider_urls</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-credentialrequestoptions-identity">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-dom-credentialrequestoptions-identity①">(2)</a> <a href="#ref-for-dom-credentialrequestoptions-identity②">(3)</a> <a href="#ref-for-dom-credentialrequestoptions-identity③">(4)</a>
+    <li><a href="#ref-for-dom-identityproviderwellknown-provider_urls">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-dom-identityproviderwellknown-provider_urls①">(2)</a> <a href="#ref-for-dom-identityproviderwellknown-provider_urls②">(3)</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="dictdef-identitycredentialrequestoptions">
-   <b><a href="#dictdef-identitycredentialrequestoptions">#dictdef-identitycredentialrequestoptions</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="dom-identityproviderapiconfig-accounts_endpoint">
+   <b><a href="#dom-identityproviderapiconfig-accounts_endpoint">#dom-identityproviderapiconfig-accounts_endpoint</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dictdef-identitycredentialrequestoptions">3.3. The CredentialRequestOptions</a> <a href="#ref-for-dictdef-identitycredentialrequestoptions①">(2)</a>
-    <li><a href="#ref-for-dictdef-identitycredentialrequestoptions②">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
+    <li><a href="#ref-for-dom-identityproviderapiconfig-accounts_endpoint">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-dom-identityproviderapiconfig-accounts_endpoint①">(2)</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="dom-identitycredentialrequestoptions-providers">
-   <b><a href="#dom-identitycredentialrequestoptions-providers">#dom-identitycredentialrequestoptions-providers</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="dom-identityproviderapiconfig-client_metadata_endpoint">
+   <b><a href="#dom-identityproviderapiconfig-client_metadata_endpoint">#dom-identityproviderapiconfig-client_metadata_endpoint</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-identitycredentialrequestoptions-providers">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-dom-identitycredentialrequestoptions-providers①">(2)</a> <a href="#ref-for-dom-identitycredentialrequestoptions-providers②">(3)</a>
+    <li><a href="#ref-for-dom-identityproviderapiconfig-client_metadata_endpoint">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-dom-identityproviderapiconfig-client_metadata_endpoint①">(2)</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="dictdef-identityproviderconfig">
-   <b><a href="#dictdef-identityproviderconfig">#dictdef-identityproviderconfig</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="dom-identityproviderapiconfig-id_assertion_endpoint">
+   <b><a href="#dom-identityproviderapiconfig-id_assertion_endpoint">#dom-identityproviderapiconfig-id_assertion_endpoint</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dictdef-identityproviderconfig">3.3. The CredentialRequestOptions</a> <a href="#ref-for-dictdef-identityproviderconfig①">(2)</a> <a href="#ref-for-dictdef-identityproviderconfig②">(3)</a>
-    <li><a href="#ref-for-dictdef-identityproviderconfig③">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-dictdef-identityproviderconfig④">(2)</a> <a href="#ref-for-dictdef-identityproviderconfig⑤">(3)</a> <a href="#ref-for-dictdef-identityproviderconfig⑥">(4)</a> <a href="#ref-for-dictdef-identityproviderconfig⑦">(5)</a> <a href="#ref-for-dictdef-identityproviderconfig⑧">(6)</a> <a href="#ref-for-dictdef-identityproviderconfig⑨">(7)</a> <a href="#ref-for-dictdef-identityproviderconfig①⓪">(8)</a>
+    <li><a href="#ref-for-dom-identityproviderapiconfig-id_assertion_endpoint">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-dom-identityproviderapiconfig-id_assertion_endpoint①">(2)</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="dom-identityproviderconfig-configurl">
-   <b><a href="#dom-identityproviderconfig-configurl">#dom-identityproviderconfig-configurl</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="dom-identityproviderapiconfig-branding">
+   <b><a href="#dom-identityproviderapiconfig-branding">#dom-identityproviderapiconfig-branding</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-identityproviderconfig-configurl">3.3. The CredentialRequestOptions</a>
-    <li><a href="#ref-for-dom-identityproviderconfig-configurl①">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-dom-identityproviderconfig-configurl②">(2)</a> <a href="#ref-for-dom-identityproviderconfig-configurl③">(3)</a> <a href="#ref-for-dom-identityproviderconfig-configurl④">(4)</a>
+    <li><a href="#ref-for-dom-identityproviderapiconfig-branding">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="dom-identityproviderconfig-clientid">
-   <b><a href="#dom-identityproviderconfig-clientid">#dom-identityproviderconfig-clientid</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="dom-identityproviderbranding-background_color">
+   <b><a href="#dom-identityproviderbranding-background_color">#dom-identityproviderbranding-background_color</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-identityproviderconfig-clientid">2.3. Accounts List</a>
-    <li><a href="#ref-for-dom-identityproviderconfig-clientid①">2.5. Identity Assertions</a> <a href="#ref-for-dom-identityproviderconfig-clientid②">(2)</a>
-    <li><a href="#ref-for-dom-identityproviderconfig-clientid③">3.3. The CredentialRequestOptions</a>
-    <li><a href="#ref-for-dom-identityproviderconfig-clientid④">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-dom-identityproviderconfig-clientid⑤">(2)</a> <a href="#ref-for-dom-identityproviderconfig-clientid⑥">(3)</a>
+    <li><a href="#ref-for-dom-identityproviderbranding-background_color">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="dom-identityproviderconfig-nonce">
-   <b><a href="#dom-identityproviderconfig-nonce">#dom-identityproviderconfig-nonce</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="dom-identityproviderbranding-color">
+   <b><a href="#dom-identityproviderbranding-color">#dom-identityproviderbranding-color</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-identityproviderconfig-nonce">3.3. The CredentialRequestOptions</a>
-    <li><a href="#ref-for-dom-identityproviderconfig-nonce①">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
+    <li><a href="#ref-for-dom-identityproviderbranding-color">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="create-an-identitycredential">
-   <b><a href="#create-an-identitycredential">#create-an-identitycredential</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="dom-identityproviderbranding-icons">
+   <b><a href="#dom-identityproviderbranding-icons">#dom-identityproviderbranding-icons</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-create-an-identitycredential">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
-    <li><a href="#ref-for-create-an-identitycredential①">6.3.1. Manifest Fingerprinting</a>
+    <li><a href="#ref-for-dom-identityproviderbranding-icons">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="parse-url">
-   <b><a href="#parse-url">#parse-url</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="dom-identityprovidericon-url">
+   <b><a href="#dom-identityprovidericon-url">#dom-identityprovidericon-url</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-parse-url">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-parse-url①">(2)</a> <a href="#ref-for-parse-url②">(3)</a> <a href="#ref-for-parse-url③">(4)</a> <a href="#ref-for-parse-url④">(5)</a>
+    <li><a href="#ref-for-dom-identityprovidericon-url">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="fetch-request">
-   <b><a href="#fetch-request">#fetch-request</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="dom-identityprovidericon-size">
+   <b><a href="#dom-identityprovidericon-size">#dom-identityprovidericon-size</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-fetch-request">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-fetch-request①">(2)</a> <a href="#ref-for-fetch-request②">(3)</a> <a href="#ref-for-fetch-request③">(4)</a> <a href="#ref-for-fetch-request④">(5)</a> <a href="#ref-for-fetch-request⑤">(6)</a>
+    <li><a href="#ref-for-dom-identityprovidericon-size">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="fetch-the-config-file">
-   <b><a href="#fetch-the-config-file">#fetch-the-config-file</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="color">
+   <b><a href="#color">#color</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-fetch-the-config-file">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
+    <li><a href="#ref-for-color">3.2. Manifest</a> <a href="#ref-for-color①">(2)</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="fetch-the-accounts-list">
-   <b><a href="#fetch-the-accounts-list">#fetch-the-accounts-list</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="dom-identityprovideraccount-id">
+   <b><a href="#dom-identityprovideraccount-id">#dom-identityprovideraccount-id</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-fetch-the-accounts-list">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
+    <li><a href="#ref-for-dom-identityprovideraccount-id">2.1. The State Machine</a>
+    <li><a href="#ref-for-dom-identityprovideraccount-id①">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-dom-identityprovideraccount-id②">(2)</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="fetch-the-account-picture">
-   <b><a href="#fetch-the-account-picture">#fetch-the-account-picture</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="dom-identityprovideraccount-name">
+   <b><a href="#dom-identityprovideraccount-name">#dom-identityprovideraccount-name</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-fetch-the-account-picture">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
+    <li><a href="#ref-for-dom-identityprovideraccount-name">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="fetch-an-identity-assertion">
-   <b><a href="#fetch-an-identity-assertion">#fetch-an-identity-assertion</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="dom-identityprovideraccount-email">
+   <b><a href="#dom-identityprovideraccount-email">#dom-identityprovideraccount-email</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-fetch-an-identity-assertion">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
+    <li><a href="#ref-for-dom-identityprovideraccount-email">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="compute-account-state">
-   <b><a href="#compute-account-state">#compute-account-state</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="dom-identityprovideraccount-given_name">
+   <b><a href="#dom-identityprovideraccount-given_name">#dom-identityprovideraccount-given_name</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-compute-account-state">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-compute-account-state①">(2)</a>
+    <li><a href="#ref-for-dom-identityprovideraccount-given_name">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="computing-the-manifest-url">
-   <b><a href="#computing-the-manifest-url">#computing-the-manifest-url</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="dom-identityprovideraccount-picture">
+   <b><a href="#dom-identityprovideraccount-picture">#dom-identityprovideraccount-picture</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-computing-the-manifest-url">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-computing-the-manifest-url①">(2)</a> <a href="#ref-for-computing-the-manifest-url②">(3)</a>
+    <li><a href="#ref-for-dom-identityprovideraccount-picture">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-dom-identityprovideraccount-picture①">(2)</a> <a href="#ref-for-dom-identityprovideraccount-picture②">(3)</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="extract-the-json-fetch-response">
-   <b><a href="#extract-the-json-fetch-response">#extract-the-json-fetch-response</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="dom-identityprovideraccount-approved_clients">
+   <b><a href="#dom-identityprovideraccount-approved_clients">#dom-identityprovideraccount-approved_clients</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-extract-the-json-fetch-response">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-extract-the-json-fetch-response①">(2)</a> <a href="#ref-for-extract-the-json-fetch-response②">(3)</a> <a href="#ref-for-extract-the-json-fetch-response③">(4)</a> <a href="#ref-for-extract-the-json-fetch-response④">(5)</a>
+    <li><a href="#ref-for-dom-identityprovideraccount-approved_clients">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-dom-identityprovideraccount-approved_clients①">(2)</a> <a href="#ref-for-dom-identityprovideraccount-approved_clients②">(3)</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="request-permission-to-sign-up">
-   <b><a href="#request-permission-to-sign-up">#request-permission-to-sign-up</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="dom-identityproviderclientmetadata-privacy_policy_url">
+   <b><a href="#dom-identityproviderclientmetadata-privacy_policy_url">#dom-identityproviderclientmetadata-privacy_policy_url</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-request-permission-to-sign-up">2.3. Accounts List</a>
-    <li><a href="#ref-for-request-permission-to-sign-up①">2.5. Identity Assertions</a>
-    <li><a href="#ref-for-request-permission-to-sign-up②">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-request-permission-to-sign-up③">(2)</a>
+    <li><a href="#ref-for-dom-identityproviderclientmetadata-privacy_policy_url">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-dom-identityproviderclientmetadata-privacy_policy_url①">(2)</a> <a href="#ref-for-dom-identityproviderclientmetadata-privacy_policy_url②">(3)</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="fetch-the-client-metadata">
-   <b><a href="#fetch-the-client-metadata">#fetch-the-client-metadata</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="dom-identityproviderclientmetadata-terms_of_service_url">
+   <b><a href="#dom-identityproviderclientmetadata-terms_of_service_url">#dom-identityproviderclientmetadata-terms_of_service_url</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-fetch-the-client-metadata">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
+    <li><a href="#ref-for-dom-identityproviderclientmetadata-terms_of_service_url">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a> <a href="#ref-for-dom-identityproviderclientmetadata-terms_of_service_url①">(2)</a> <a href="#ref-for-dom-identityproviderclientmetadata-terms_of_service_url②">(3)</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="select-an-account">
-   <b><a href="#select-an-account">#select-an-account</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="dom-id_assertion_endpoint_request-client_id">
+   <b><a href="#dom-id_assertion_endpoint_request-client_id">#dom-id_assertion_endpoint_request-client_id</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-select-an-account">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a>
+    <li><a href="#ref-for-dom-id_assertion_endpoint_request-client_id">2.2.1. The CredentialRequestOptions ## {#browser-api-credential-request-options}</a>
+    <li><a href="#ref-for-dom-id_assertion_endpoint_request-client_id①">6.2. Network requests</a> <a href="#ref-for-dom-id_assertion_endpoint_request-client_id②">(2)</a> <a href="#ref-for-dom-id_assertion_endpoint_request-client_id③">(3)</a> <a href="#ref-for-dom-id_assertion_endpoint_request-client_id④">(4)</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="sign-in">
-   <b><a href="#sign-in">#sign-in</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="dom-identityprovidertoken-token">
+   <b><a href="#dom-identityprovidertoken-token">#dom-identityprovidertoken-token</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-sign-in">2.5. Identity Assertions</a>
-    <li><a href="#ref-for-sign-in①">3.4. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method</a> <a href="#ref-for-sign-in②">(2)</a> <a href="#ref-for-sign-in③">(3)</a>
+    <li><a href="#ref-for-dom-identityprovidertoken-token">2.2. The IdentityCredential Interface</a>
+    <li><a href="#ref-for-dom-identityprovidertoken-token①">2.2.1. The CredentialRequestOptions ## {#browser-api-credential-request-options}</a>
+    <li><a href="#ref-for-dom-identityprovidertoken-token②">2.2.2. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method ## {#browser-api-rp-sign-in}</a>
+    <li><a href="#ref-for-dom-identityprovidertoken-token③">3.5. Identity Assertions</a> <a href="#ref-for-dom-identityprovidertoken-token④">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="identity-credentials-get">