From 0e208b933635f400dadf17da8c206033d70bca3a Mon Sep 17 00:00:00 2001
From: Simon Hangl <simonha@google.com>
Date: Tue, 4 Jun 2024 13:07:08 +0000
Subject: [PATCH] Updated explainer

---
 HOWTO.md | 40 +++++++++++++++++++++++++++++++++-------
 1 file changed, 33 insertions(+), 7 deletions(-)

diff --git a/HOWTO.md b/HOWTO.md
index 5c67031..69dd052 100644
--- a/HOWTO.md
+++ b/HOWTO.md
@@ -11,18 +11,44 @@ A prototype of the API is present in ChromeOS 116. **This is intended for experi
 
 We will do our best to keep these instructions up to date as protocol and API changes occur.
 
-## Enabling getAllScreensMedia on ChromeOS
+## Enabling getAllScreensMedia
+You need to enable the API through one of the two following ways:
+
+### Enabling getAllScreensMedia on ChromeOS via feature flag
 1. Download a version of Chrome with `getAllScreensMedia` implemented. ([Link for Canary channel](https://www.google.com/chrome/))
 2. Launch Chrome and open the [chrome://flags](chrome://flags) page.
 3. Search for `GetAllScreensMedia API` and set the flag to enabled.
 4. Restart the browser.
-5. Navigate to the [Chrome Admin panel](https://admin.google.com) and login with your admin account.
-6. Navigate to `Devices` > `Chrome` > `Settings` > `Users & browsers` and add the origin of the web page using `getAllScreensMedia` to the *Auto-select for multi screen captures* allow-list.
-7. Wait for the policy value to propagate to your device. ([Link to the policy page](chrome://policy))
-8. Restart your system. *Note: this is by design and changes only come into effect after a restart to improve privacy.*
-9. Navigate to the allow-listed page and use `getAllScreensMedia`.
 
-## Example
+### Enabling getAllScreensMedia on ChromeOS via origin trial
+1. Download a version of Chrome with `getAllScreensMedia` implemented. ([Link for Canary channel](https://www.google.com/chrome/))
+2. Register your page for [origin trial](https://developer.chrome.com/origintrials/#/view_trial/3079336245214576641)
+3. Embed the origin trial token on your page (see [instructions](https://googlechrome.github.io/OriginTrials/developer-guide.html))
+
+## Set up the managed allow-list for your page
+1. Contact your partner engineer to set the admin-managed allowlist for `getAllScreensMedia`
+2. Wait for the policy value to propagate to your device. ([Link to the policy page on Chrome](chrome://policy))
+3. Restart your system (*Note: this is by design and changes only come into effect after a restart to improve privacy.*)
+4. Navigate to the allow-listed page and use `getAllScreensMedia`
+
+## Page requirements
+To improve security, we ask users of this API to configure a strict CSP and trusted types on their page. getAllScreensMedia will not be visible if this requirement is not met.
+
+## Examples
+
+### Embedding your origin trial token
+```html
+<meta http-equiv="origin-trial" content="YOUR_ORIGIN_TRIAL_TOKEN">
+```
+
+### Strict CSP and trusted types
+```html
+<meta http-equiv="Content-Security-Policy"
+            content="object-src 'none'; base-uri 'none'; script-src 'strict-dynamic' 'YOUR_IMPORTED_SCRIPT_HASH';
+            require-trusted-types-for 'script';trusted-types forceInner;" />
+```
+
+### getAllScreensMedia usage example
 ```javascript
 async function captureAndShowAllScreens() {
   try {