diff --git a/index.html b/index.html
index 499f5ded..8743aec4 100644
--- a/index.html
+++ b/index.html
@@ -6,7 +6,7 @@
   <meta content="ED" name="w3c-status">
   <meta content="Bikeshed version 742f3d674, updated Mon Nov 4 14:56:54 2024 -0800" name="generator">
   <link href="http://www.w3.org/TR/fedcm/" rel="canonical">
-  <meta content="042beec519387789884be08a34ea3f9a85df7d35" name="revision">
+  <meta content="e6ce2888548e692d67ffc57186316f27b53d7fee" name="revision">
   <meta content="dark light" name="color-scheme">
 <style>
 dl.domintro dt {
@@ -767,7 +767,7 @@
   <div class="head">
    <p data-fill-with="logo"><a class="logo" href="https://www.w3.org/"> <img alt="W3C" height="48" src="https://www.w3.org/StyleSheets/TR/2021/logos/W3C" width="72"> </a> </p>
    <h1 class="p-name no-ref" id="title">Federated Credential Management API</h1>
-   <p id="w3c-state"><a href="https://www.w3.org/standards/types/#ED">Editor’s Draft</a>, <time class="dt-updated" datetime="2024-11-07">7 November 2024</time></p>
+   <p id="w3c-state"><a href="https://www.w3.org/standards/types/#ED">Editor’s Draft</a>, <time class="dt-updated" datetime="2024-11-18">18 November 2024</time></p>
    <details open>
     <summary>More details about this document</summary>
     <div data-fill-with="spec-metadata">
@@ -1441,7 +1441,9 @@ <h4 class="heading settled" data-level="2.2.2" id="browser-api-credential-reques
 </pre>
    <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-identitycredentialrequestoptions" id="ref-for-dictdef-identitycredentialrequestoptions①">IdentityCredentialRequestOptions</a></code> contains a list of <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderconfig" id="ref-for-dictdef-identityproviderconfig⑤">IdentityProviderConfig</a></code>s that the <a data-link-type="dfn" href="#rp" id="ref-for-rp①①">RP</a> supports and has
 pre-registered with (i.e. the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑨">IDP</a> has given the <a data-link-type="dfn" href="#rp" id="ref-for-rp①②">RP</a> a <code>clientId</code>).
-The <code class="idl"><a data-link-type="idl" href="#dictdef-identitycredentialrequestoptions" id="ref-for-dictdef-identitycredentialrequestoptions②">IdentityCredentialRequestOptions</a></code> also contains a <code class="idl"><a data-link-type="idl" href="#enumdef-identitycredentialrequestoptionscontext" id="ref-for-enumdef-identitycredentialrequestoptionscontext">IdentityCredentialRequestOptionsContext</a></code> which the user agent can use to provide a more meaningful dialog to users.</p>
+The <code class="idl"><a data-link-type="idl" href="#dictdef-identitycredentialrequestoptions" id="ref-for-dictdef-identitycredentialrequestoptions②">IdentityCredentialRequestOptions</a></code> also contains an <code class="idl"><a data-link-type="idl" href="#enumdef-identitycredentialrequestoptionscontext" id="ref-for-enumdef-identitycredentialrequestoptionscontext">IdentityCredentialRequestOptionsContext</a></code>, which the user agent can use to
+provide a more meaningful dialog to users, and an <code class="idl"><a data-link-type="idl" href="#enumdef-identitycredentialrequestoptionsmode" id="ref-for-enumdef-identitycredentialrequestoptionsmode">IdentityCredentialRequestOptionsMode</a></code>, which the user agent can use to
+specify different behaviors or dialog types.</p>
 <pre class="idl highlight def"><c- b>enum</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="enum" data-export id="enumdef-identitycredentialrequestoptionscontext"><code><c- g>IdentityCredentialRequestOptionsContext</c-></code></dfn> {
   <dfn class="dfn-paneled idl-code" data-dfn-for="IdentityCredentialRequestOptionsContext" data-dfn-type="enum-value" data-export id="dom-identitycredentialrequestoptionscontext-signin"><code><c- s>"signin"</c-></code></dfn>,
   <dfn class="dfn-paneled idl-code" data-dfn-for="IdentityCredentialRequestOptionsContext" data-dfn-type="enum-value" data-export id="dom-identitycredentialrequestoptionscontext-signup"><code><c- s>"signup"</c-></code></dfn>,
@@ -1449,9 +1451,15 @@ <h4 class="heading settled" data-level="2.2.2" id="browser-api-credential-reques
   <dfn class="dfn-paneled idl-code" data-dfn-for="IdentityCredentialRequestOptionsContext" data-dfn-type="enum-value" data-export id="dom-identitycredentialrequestoptionscontext-continue"><code><c- s>"continue"</c-></code></dfn>
 };
 
+<c- b>enum</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="enum" data-export id="enumdef-identitycredentialrequestoptionsmode"><code><c- g>IdentityCredentialRequestOptionsMode</c-></code></dfn> {
+  <dfn class="dfn-paneled idl-code" data-dfn-for="IdentityCredentialRequestOptionsMode" data-dfn-type="enum-value" data-export id="dom-identitycredentialrequestoptionsmode-active"><code><c- s>"active"</c-></code></dfn>,
+  <dfn class="dfn-paneled idl-code" data-dfn-for="IdentityCredentialRequestOptionsMode" data-dfn-type="enum-value" data-export id="dom-identitycredentialrequestoptionsmode-passive"><code><c- s>"passive"</c-></code></dfn>
+};
+
 <c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-identitycredentialrequestoptions"><code><c- g>IdentityCredentialRequestOptions</c-></code></dfn> {
   <c- b>required</c-> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#dictdef-identityproviderrequestoptions" id="ref-for-dictdef-identityproviderrequestoptions"><c- n>IdentityProviderRequestOptions</c-></a>> <dfn class="dfn-paneled idl-code" data-dfn-for="IdentityCredentialRequestOptions" data-dfn-type="dict-member" data-export data-type="sequence<IdentityProviderRequestOptions>" id="dom-identitycredentialrequestoptions-providers"><code><c- g>providers</c-></code></dfn>;
   <a data-link-type="idl-name" href="#enumdef-identitycredentialrequestoptionscontext" id="ref-for-enumdef-identitycredentialrequestoptionscontext①"><c- n>IdentityCredentialRequestOptionsContext</c-></a> <dfn class="dfn-paneled idl-code" data-default="&quot;signin&quot;" data-dfn-for="IdentityCredentialRequestOptions" data-dfn-type="dict-member" data-export data-type="IdentityCredentialRequestOptionsContext" id="dom-identitycredentialrequestoptions-context"><code><c- g>context</c-></code></dfn> = "signin";
+  <a data-link-type="idl-name" href="#enumdef-identitycredentialrequestoptionsmode" id="ref-for-enumdef-identitycredentialrequestoptionsmode①"><c- n>IdentityCredentialRequestOptionsMode</c-></a> <dfn class="dfn-paneled idl-code" data-default="&quot;passive&quot;" data-dfn-for="IdentityCredentialRequestOptions" data-dfn-type="dict-member" data-export data-type="IdentityCredentialRequestOptionsMode" id="dom-identitycredentialrequestoptions-mode"><code><c- g>mode</c-></code></dfn> = "passive";
 };
 </pre>
    <p>Each <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderconfig" id="ref-for-dictdef-identityproviderconfig⑥">IdentityProviderConfig</a></code> represents an <a data-link-type="dfn" href="#idp" id="ref-for-idp①⓪">IDP</a> that
@@ -1572,40 +1580,58 @@ <h4 class="heading settled" data-level="2.2.4" id="create-identity-credential"><
     <ol>
      <li data-md>
       <p class="assertion">Assert: These steps are running <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/infrastructure.html#in-parallel" id="ref-for-in-parallel③">in parallel</a>.</p>
+     <li data-md>
+      <p>Let <var>mode</var> be <var>options</var>’s <code class="idl"><a data-link-type="idl" href="#dom-identitycredentialrequestoptions-mode" id="ref-for-dom-identitycredentialrequestoptions-mode">mode</a></code>.</p>
+     <li data-md>
+      <p>If <var>mode</var> is <a data-link-type="dfn" href="https://w3c.github.io/ServiceWorker/#extendableevent-active" id="ref-for-extendableevent-active">active</a>:</p>
+      <ol>
+       <li data-md>
+        <p>Let <var>W</var> be <var>globalObject</var>’s <a data-link-type="dfn">associated Window</a>.</p>
+       <li data-md>
+        <p>If <var>W</var> does not have <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/interaction.html#transient-activation" id="ref-for-transient-activation">transient activation</a>, return (failure, true).</p>
+       <li data-md>
+        <p>Otherwise, if there is a pending request where <var>mode</var> is <a data-link-type="dfn">passive</a> on <var>W</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/nav-history-apis.html#window-navigable" id="ref-for-window-navigable">navigable</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/document-sequences.html#nav-top" id="ref-for-nav-top">top-level traversable</a> or on any of its descendants, reject the pending request with a
+"<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#networkerror" id="ref-for-networkerror①⓪">NetworkError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①②">DOMException</a></code>.</p>
+      </ol>
      <li data-md>
       <p>Let <var>loginStatus</var> be the result of <a data-link-type="dfn" href="https://w3c-fedid.github.io/login-status#get-the-login-status" id="ref-for-get-the-login-status">get the login status</a> with
 the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin" id="ref-for-concept-origin③">origin</a> of <var>provider</var>’s <code class="idl"><a data-link-type="idl" href="#dom-identityproviderconfig-configurl" id="ref-for-dom-identityproviderconfig-configurl④">configURL</a></code>.</p>
      <li data-md>
       <p>If <var>loginStatus</var> is <a data-link-type="dfn" href="https://w3c-fedid.github.io/login-status#unknown" id="ref-for-unknown">unknown</a>, a user agent MAY set it to <a data-link-type="dfn" href="https://w3c-fedid.github.io/login-status#logged-out" id="ref-for-logged-out">logged-out</a>.</p>
      <li data-md>
-      <p>If <var>loginStatus</var> is <a data-link-type="dfn" href="https://w3c-fedid.github.io/login-status#logged-out" id="ref-for-logged-out①">logged-out</a>, the user agent MUST do one of the following:</p>
-      <ul>
+      <p>If <var>loginStatus</var> is <a data-link-type="dfn" href="https://w3c-fedid.github.io/login-status#logged-out" id="ref-for-logged-out①">logged-out</a>:</p>
+      <ol>
        <li data-md>
-        <p>Return (failure, false).</p>
+        <p>If <var>mode</var> is <a data-link-type="dfn" href="https://w3c.github.io/ServiceWorker/#extendableevent-active" id="ref-for-extendableevent-active①">active</a>:</p>
+        <ol>
+         <li data-md>
+          <p>Let <var>result</var> be the result of running <a data-link-type="dfn" href="#fetch-the-config-file-and-show-an-idp-login-dialog" id="ref-for-fetch-the-config-file-and-show-an-idp-login-dialog">fetch the config file and show an IDP login dialog</a> with <var>provider</var> and <var>globalObject</var>.</p>
+         <li data-md>
+          <p>If <var>result</var> is failure, return (failure, true).</p>
+        </ol>
        <li data-md>
-        <p>Prompt the user whether to continue. If the user continues, the user
-agent SHOULD set <var>loginStatus</var> to <a data-link-type="dfn" href="https://w3c-fedid.github.io/login-status#unknown" id="ref-for-unknown①">unknown</a>. This MAY include an
-affordance to <a data-link-type="dfn" href="#show-an-idp-login-dialog" id="ref-for-show-an-idp-login-dialog">show an IDP login dialog</a>.</p>
+        <p>Otherwise, the user agent MUST do one of the following:</p>
         <ul>
          <li data-md>
-          <p>If the user cancels this dialog, return (failure, true).</p>
+          <p>Return (failure, false).</p>
          <li data-md>
-          <p>If the user triggers this affordance:</p>
-          <ol>
-           <li data-md>
-            <p>Let <var>config</var> be the result of running <a data-link-type="dfn" href="#fetch-the-config-file" id="ref-for-fetch-the-config-file①">fetch the config file</a> with <var>provider</var> and <var>globalObject</var>.</p>
-           <li data-md>
-            <p>If <var>config</var> is failure, return (failure, true).</p>
+          <p>Prompt the user whether to continue. If the user continues, the user
+agent SHOULD set <var>loginStatus</var> to <a data-link-type="dfn" href="https://w3c-fedid.github.io/login-status#unknown" id="ref-for-unknown①">unknown</a>. This MAY include an
+affordance to <a data-link-type="dfn" href="#show-an-idp-login-dialog" id="ref-for-show-an-idp-login-dialog">show an IDP login dialog</a>.</p>
+          <ul>
            <li data-md>
-            <p><a data-link-type="dfn" href="#show-an-idp-login-dialog" id="ref-for-show-an-idp-login-dialog①">Show an IDP login dialog</a> with <var>config</var> and <var>provider</var>.</p>
+            <p>If the user cancels this dialog, return (failure, true).</p>
            <li data-md>
-            <p>If that algorithm returns failure, return (failure, true).</p>
-          </ol>
+            <p>If the user triggers this affordance:</p>
+            <ol>
+             <li data-md>
+              <p>Let <var>result</var> be the result of running <a data-link-type="dfn" href="#fetch-the-config-file-and-show-an-idp-login-dialog" id="ref-for-fetch-the-config-file-and-show-an-idp-login-dialog①">fetch the config file and show an IDP login dialog</a> with <var>provider</var> and <var>globalObject</var>.</p>
+             <li data-md>
+              <p>If <var>result</var> is failure, return (failure, true).</p>
+            </ol>
+          </ul>
         </ul>
-      </ul>
-      <p class="issue" id="issue-c651807c"><a class="self-link" href="#issue-c651807c"></a> We should perhaps provide a way to let the <a data-link-type="dfn" href="#rp" id="ref-for-rp①⑨">RP</a> request that
-    the second option is provided, possibly gated on a user gesture.
-    See <a href="https://github.com/fedidcg/FedCM/issues/442">this issue</a> for discussion.</p>
+      </ol>
      <li data-md>
       <p>Let <var>requiresUserMediation</var> be <var>provider</var>’s <code class="idl"><a data-link-type="idl" href="#dom-identityproviderconfig-configurl" id="ref-for-dom-identityproviderconfig-configurl⑤">configURL</a></code>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin" id="ref-for-concept-origin④">origin</a>'s <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#origin-requires-user-mediation" id="ref-for-origin-requires-user-mediation">requires user mediation</a>.</p>
      <li data-md>
@@ -1614,7 +1640,7 @@ <h4 class="heading settled" data-level="2.2.4" id="create-identity-credential"><
       <p>If <var>requiresUserMediation</var> is true and <var>mediation</var> is
 "<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-silent" id="ref-for-dom-credentialmediationrequirement-silent">silent</a></code>", return (failure, true).</p>
      <li data-md>
-      <p>Let <var>config</var> be the result of running <a data-link-type="dfn" href="#fetch-the-config-file" id="ref-for-fetch-the-config-file②">fetch the config file</a> with <var>provider</var> and <var>globalObject</var>.</p>
+      <p>Let <var>config</var> be the result of running <a data-link-type="dfn" href="#fetch-the-config-file" id="ref-for-fetch-the-config-file①">fetch the config file</a> with <var>provider</var> and <var>globalObject</var>.</p>
      <li data-md>
       <p>If <var>config</var> is failure, return (failure, false).</p>
      <li data-md>
@@ -1635,7 +1661,7 @@ <h4 class="heading settled" data-level="2.2.4" id="create-identity-credential"><
         <p><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="mismatch-dialog-step">Mismatch dialog step</dfn>: If <var>loginStatus</var> is <a data-link-type="dfn" href="https://w3c-fedid.github.io/login-status#logged-in" id="ref-for-logged-in">logged-in</a>, show a
 dialog to the user. The contents of this dialog are defined by the user
 agent. This dialog SHOULD provide an affordance for the user to trigger
-the <a data-link-type="dfn" href="#show-an-idp-login-dialog" id="ref-for-show-an-idp-login-dialog②">show an IDP login dialog</a> algorithm with <var>config</var> and <var>provider</var>;
+the <a data-link-type="dfn" href="#show-an-idp-login-dialog" id="ref-for-show-an-idp-login-dialog①">show an IDP login dialog</a> algorithm with <var>config</var> and <var>provider</var>;
 this dialog is the <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="confirm-idp-login-dialog">confirm IDP login dialog</dfn>.</p>
         <p class="note" role="note"><span class="marker">Note:</span> This situation happens when the browser expects the user
     to be signed in, but the accounts fetch indicated that the user
@@ -1650,7 +1676,7 @@ <h4 class="heading settled" data-level="2.2.4" id="create-identity-credential"><
            <li data-md>
             <p>If the user closes the dialog, return (failure, true).</p>
            <li data-md>
-            <p>If the <a data-link-type="dfn" href="#show-an-idp-login-dialog" id="ref-for-show-an-idp-login-dialog③">show an IDP login dialog</a> algorithm was triggered:</p>
+            <p>If the <a data-link-type="dfn" href="#show-an-idp-login-dialog" id="ref-for-show-an-idp-login-dialog②">show an IDP login dialog</a> algorithm was triggered:</p>
             <ol>
              <li data-md>
               <p>Let <var>result</var> be the result of that algorithm.</p>
@@ -1734,7 +1760,7 @@ <h4 class="heading settled" data-level="2.2.4" id="create-identity-credential"><
         <p>Set <var>account</var> to <var>accountsList</var>[0].</p>
        <li data-md>
         <p>If <a data-link-type="dfn" href="#compute-the-connection-status" id="ref-for-compute-the-connection-status">compute the connection status</a> of <var>account</var>, <var>provider</var> and <var>globalObject</var> returns <a data-link-type="dfn" href="#compute-the-connection-status-connected" id="ref-for-compute-the-connection-status-connected②">connected</a>, show a dialog to request user permission to sign
-in via <var>account</var>, and set the result in <var>permission</var>. The user agent MAY use <var>options</var>’s <code class="idl"><a data-link-type="idl" href="#dom-identitycredentialrequestoptions-context" id="ref-for-dom-identitycredentialrequestoptions-context">context</a></code> to customize the dialog.</p>
+in via <var>account</var>, and set the result in <var>permission</var>. The user agent MAY use <var>options</var>’s <code class="idl"><a data-link-type="idl" href="#dom-identitycredentialrequestoptions-context" id="ref-for-dom-identitycredentialrequestoptions-context">context</a></code> and <var>options</var>’s <code class="idl"><a data-link-type="idl" href="#dom-identitycredentialrequestoptions-mode" id="ref-for-dom-identitycredentialrequestoptions-mode①">mode</a></code> to customize the dialog.</p>
        <li data-md>
         <p>Otherwise, let <var>permission</var> be the result of running <a data-link-type="dfn" href="#request-permission-to-sign-up" id="ref-for-request-permission-to-sign-up">request permission to sign-up</a> algorithm with <var>account</var>, <var>config</var>, <var>provider</var>, and <var>globalObject</var>. Also set <var>disclosureTextShown</var> to true.</p>
       </ol>
@@ -1770,7 +1796,7 @@ <h4 class="heading settled" data-level="2.2.4" id="create-identity-credential"><
     </ol>
    </div>
    <h4 class="heading settled" data-level="2.2.5" id="fetch-config-file"><span class="secno">2.2.5. </span><span class="content">Fetch the config file</span><a class="self-link" href="#fetch-config-file"></a></h4>
-   <p>The <a data-link-type="dfn" href="#fetch-the-config-file" id="ref-for-fetch-the-config-file③">fetch the config file</a> algorithm fetches both the <a data-link-type="dfn" href="#well-known-file" id="ref-for-well-known-file">well-known file</a> and the config file from
+   <p>The <a data-link-type="dfn" href="#fetch-the-config-file" id="ref-for-fetch-the-config-file②">fetch the config file</a> algorithm fetches both the <a data-link-type="dfn" href="#well-known-file" id="ref-for-well-known-file">well-known file</a> and the config file from
 the <a data-link-type="dfn" href="#idp" id="ref-for-idp①④">IDP</a>, checks that the config file is mentioned in the <a data-link-type="dfn" href="#well-known-file" id="ref-for-well-known-file①">well-known file</a>, and returns the config.</p>
    <div class="algorithm" data-algorithm="fetch the config file">
      To <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="fetch-the-config-file">fetch the config file</dfn> given an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderrequestoptions" id="ref-for-dictdef-identityproviderrequestoptions②">IdentityProviderRequestOptions</a></code> <var>provider</var> and <var>globalObject</var>, run the following steps. This returns an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderapiconfig" id="ref-for-dictdef-identityproviderapiconfig">IdentityProviderAPIConfig</a></code> or failure. 
@@ -1918,7 +1944,7 @@ <h4 class="heading settled" data-level="2.2.5" id="fetch-config-file"><span clas
       <p>If <var>configInWellKnown</var> is true, return <var>config</var>. Otherwise, return failure.</p>
     </ol>
    </div>
-   <p class="note" role="note"><span class="marker">NOTE:</span> a two-tier file system is used in order to prevent the <a data-link-type="dfn" href="#idp" id="ref-for-idp①⑤">IDP</a> from easily determining the <a data-link-type="dfn" href="#rp" id="ref-for-rp②⓪">RP</a> that a user is visiting by encoding the information in the config file path. This issue is solved by
+   <p class="note" role="note"><span class="marker">NOTE:</span> a two-tier file system is used in order to prevent the <a data-link-type="dfn" href="#idp" id="ref-for-idp①⑤">IDP</a> from easily determining the <a data-link-type="dfn" href="#rp" id="ref-for-rp①⑨">RP</a> that a user is visiting by encoding the information in the config file path. This issue is solved by
 requiring a <a data-link-type="dfn" href="#well-known-file" id="ref-for-well-known-file②">well-known file</a> to be on the root of the <a data-link-type="dfn" href="#idp" id="ref-for-idp①⑥">IDP</a>. The config file itself can be anywhere, but
 it will not be used if the user agent does not find it in the <a data-link-type="dfn" href="#well-known-file" id="ref-for-well-known-file③">well-known file</a>. This allows the <a data-link-type="dfn" href="#idp" id="ref-for-idp①⑦">IDP</a> to keep their actual config files on an arbitary path while allowing the user agent to prevent config file
 path manipulation to fingerprint (for instance, by including the RP in the path). See <a href="#manifest-fingerprinting">§ 7.3.1 Manifest Fingerprinting</a>.</p>
@@ -2090,7 +2116,7 @@ <h4 class="heading settled" data-level="2.2.6" id="fetch-accounts"><span class="
    <h4 class="heading settled" data-level="2.2.7" id="fetch-identity-assertion"><span class="secno">2.2.7. </span><span class="content">Fetch an identity assertion</span><a class="self-link" href="#fetch-identity-assertion"></a></h4>
    <p>The <a data-link-type="dfn" href="#fetch-an-identity-assertion" id="ref-for-fetch-an-identity-assertion①">fetch an identity assertion</a> algorithm is invoked after the user has granted permission to
 use FedCM with a specific <a data-link-type="dfn" href="#idp" id="ref-for-idp①⑨">IDP</a> account. It fetches the <a data-link-type="dfn" href="#identity-assertion-endpoint" id="ref-for-identity-assertion-endpoint">identity assertion endpoint</a> to obtain
-the token that will be provided to the <a data-link-type="dfn" href="#rp" id="ref-for-rp②①">RP</a>.</p>
+the token that will be provided to the <a data-link-type="dfn" href="#rp" id="ref-for-rp②⓪">RP</a>.</p>
    <div class="algorithm" data-algorithm="fetch an identity assertion">
      To <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="fetch-an-identity-assertion">fetch an identity assertion</dfn> given a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString②③">USVString</a></code> <var>accountId</var>, a boolean <var>disclosureTextShown</var>, a boolean <var>isAutoSelected</var>, an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderrequestoptions" id="ref-for-dictdef-identityproviderrequestoptions④">IdentityProviderRequestOptions</a></code> <var>provider</var>, an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderapiconfig" id="ref-for-dictdef-identityproviderapiconfig③">IdentityProviderAPIConfig</a></code> <var>config</var>,
     and <var>globalObject</var>, run the following steps. This returns an <code class="idl"><a data-link-type="idl" href="#identitycredential" id="ref-for-identitycredential①⓪">IdentityCredential</a></code> or failure. 
@@ -2209,7 +2235,7 @@ <h4 class="heading settled" data-level="2.2.8" id="request-permission-signup"><s
       <p>Return <var>account</var>.</p>
     </ol>
    </div>
-   <p>The <a data-link-type="dfn" href="#request-permission-to-sign-up" id="ref-for-request-permission-to-sign-up②">request permission to sign-up</a> algorithm fetches the <a data-link-type="dfn" href="#client-metadata-endpoint" id="ref-for-client-metadata-endpoint">client metadata endpoint</a> of the <a data-link-type="dfn" href="#rp" id="ref-for-rp②②">RP</a>,
+   <p>The <a data-link-type="dfn" href="#request-permission-to-sign-up" id="ref-for-request-permission-to-sign-up②">request permission to sign-up</a> algorithm fetches the <a data-link-type="dfn" href="#client-metadata-endpoint" id="ref-for-client-metadata-endpoint">client metadata endpoint</a> of the <a data-link-type="dfn" href="#rp" id="ref-for-rp②①">RP</a>,
 waits for the user to grant permission to use the given account, and returns whether the user
 granted permission or not.</p>
    <div class="algorithm" data-algorithm="request permission to sign-up">
@@ -2232,8 +2258,7 @@ <h4 class="heading settled" data-level="2.2.8" id="request-permission-signup"><s
 is defined, and the <var>provider</var>’s <code class="idl"><a data-link-type="idl" href="#dom-identityproviderconfig-clientid" id="ref-for-dom-identityproviderconfig-clientid⑥">clientId</a></code> is not in the list of <var>account</var>["<code class="idl"><a data-link-type="idl" href="#dom-identityprovideraccount-approved_clients" id="ref-for-dom-identityprovideraccount-approved_clients⑥">approved_clients</a></code>"], then the user agent MUST display
 the <var>metadata</var>["<code class="idl"><a data-link-type="idl" href="#dom-identityproviderclientmetadata-terms_of_service_url" id="ref-for-dom-identityproviderclientmetadata-terms_of_service_url①">terms_of_service_url</a></code>"] link.</p>
        <li data-md>
-        <p>The user agent MAY use the <code class="idl"><a data-link-type="idl" href="#dom-identitycredentialrequestoptions-context" id="ref-for-dom-identitycredentialrequestoptions-context①">context</a></code> to customize the
-dialog shown.</p>
+        <p>The user agent MAY use the <code class="idl"><a data-link-type="idl" href="#dom-identitycredentialrequestoptions-context" id="ref-for-dom-identitycredentialrequestoptions-context①">context</a></code> and <var>options</var>’s <code class="idl"><a data-link-type="idl" href="#dom-identitycredentialrequestoptions-mode" id="ref-for-dom-identitycredentialrequestoptions-mode②">mode</a></code> to customize the dialog shown.</p>
       </ol>
      <li data-md>
       <p>If the user does not grant permission, return false.</p>
@@ -2368,15 +2393,15 @@ <h4 class="heading settled" data-level="2.2.9" id="helper-algorithms"><span clas
       <p class="assertion">Assert: These steps are running on the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#networking-task-source" id="ref-for-networking-task-source①">networking task source</a>.</p>
      <li data-md>
       <p>If <var>response</var> is a <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-network-error" id="ref-for-concept-network-error">network error</a> or its <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-response-status" id="ref-for-concept-response-status">status</a> is not an <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#ok-status" id="ref-for-ok-status">ok status</a>,
-throw a new "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#networkerror" id="ref-for-networkerror①⓪">NetworkError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①②">DOMException</a></code>.</p>
+throw a new "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#networkerror" id="ref-for-networkerror①①">NetworkError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①③">DOMException</a></code>.</p>
      <li data-md>
       <p>Let <var>mimeType</var> be the result of <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-header-extract-mime-type" id="ref-for-concept-header-extract-mime-type">extracting a MIME TYPE</a> from <var>response</var>’s <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-response-header-list" id="ref-for-concept-response-header-list">header list</a>.</p>
      <li data-md>
-      <p>If <var>mimeType</var> is failure or is not a <a data-link-type="dfn" href="https://mimesniff.spec.whatwg.org/#json-mime-type" id="ref-for-json-mime-type">JSON MIME Type</a>, throw a new "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#networkerror" id="ref-for-networkerror①①">NetworkError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①③">DOMException</a></code>.</p>
+      <p>If <var>mimeType</var> is failure or is not a <a data-link-type="dfn" href="https://mimesniff.spec.whatwg.org/#json-mime-type" id="ref-for-json-mime-type">JSON MIME Type</a>, throw a new "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#networkerror" id="ref-for-networkerror①②">NetworkError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①④">DOMException</a></code>.</p>
      <li data-md>
       <p>Let <var>json</var> be the result of <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#parse-json-bytes-to-a-javascript-value" id="ref-for-parse-json-bytes-to-a-javascript-value">parse JSON bytes to a JavaScript value</a> passing <var>responseBody</var>.</p>
      <li data-md>
-      <p>If <var>json</var> is a parsing exception, throw a new "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#networkerror" id="ref-for-networkerror①②">NetworkError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①④">DOMException</a></code>.</p>
+      <p>If <var>json</var> is a parsing exception, throw a new "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#networkerror" id="ref-for-networkerror①③">NetworkError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑤">DOMException</a></code>.</p>
      <li data-md>
       <p>Return <var>json</var>.</p>
     </ol>
@@ -2443,6 +2468,24 @@ <h4 class="heading settled" data-level="2.2.9" id="helper-algorithms"><span clas
       </ul>
     </ol>
    </div>
+   <div class="algorithm" data-algorithm="fetch the config file and show an IDP login dialog">
+     To <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="fetch-the-config-file-and-show-an-idp-login-dialog">fetch the config file and show an IDP login dialog</dfn> given an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderconfig" id="ref-for-dictdef-identityproviderconfig⑨">IdentityProviderConfig</a></code> <var>provider</var>, and a <var>globalObject</var>, run the following
+steps. This returns success or failure. 
+    <ol>
+     <li data-md>
+      <p class="assertion">Assert: these steps are running <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/infrastructure.html#in-parallel" id="ref-for-in-parallel⑧">in parallel</a>.</p>
+     <li data-md>
+      <p>Let <var>config</var> be the result of running <a data-link-type="dfn" href="#fetch-the-config-file" id="ref-for-fetch-the-config-file③">fetch the config file</a> with <var>provider</var> and <var>globalObject</var>.</p>
+     <li data-md>
+      <p>If <var>config</var> is failure, return failure.</p>
+     <li data-md>
+      <p><a data-link-type="dfn" href="#show-an-idp-login-dialog" id="ref-for-show-an-idp-login-dialog③">Show an IDP login dialog</a> with <var>config</var> and <var>provider</var>.</p>
+     <li data-md>
+      <p>If that algorithm succeeds, return success.</p>
+     <li data-md>
+      <p>Otherwise, return failure.</p>
+    </ol>
+   </div>
    <h3 class="heading settled" data-level="2.3" id="browser-api-identity-provider-interface"><span class="secno">2.3. </span><span class="content">The IdentityProvider Interface</span><a class="self-link" href="#browser-api-identity-provider-interface"></a></h3>
    <p>This specification introduces the <code class="idl"><a data-link-type="idl" href="#dictdef-identityuserinfo" id="ref-for-dictdef-identityuserinfo">IdentityUserInfo</a></code> dictionary as well as the <code class="idl"><a data-link-type="idl" href="#identityprovider" id="ref-for-identityprovider①">IdentityProvider</a></code> interface:</p>
 <pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-identityuserinfo"><code><c- g>IdentityUserInfo</c-></code></dfn> {
@@ -2454,7 +2497,7 @@ <h3 class="heading settled" data-level="2.3" id="browser-api-identity-provider-i
 
 [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#Exposed" id="ref-for-Exposed①"><c- g>Exposed</c-></a>=<c- n>Window</c->, <a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SecureContext" id="ref-for-SecureContext①"><c- g>SecureContext</c-></a>] <c- b>interface</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="interface" data-export id="identityprovider"><code><c- g>IdentityProvider</c-></code></dfn> {
     <c- b>static</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-undefined" id="ref-for-idl-undefined①"><c- b>undefined</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProvider" data-dfn-type="method" data-export data-lt="close()" id="dom-identityprovider-close"><code><c- g>close</c-></code></dfn>();
-    <c- b>static</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-promise" id="ref-for-idl-promise④"><c- b>Promise</c-></a>&lt;<a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence⑦"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#dictdef-identityuserinfo" id="ref-for-dictdef-identityuserinfo①"><c- n>IdentityUserInfo</c-></a>>> <dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProvider" data-dfn-type="method" data-export data-lt="getUserInfo(config)" id="dom-identityprovider-getuserinfo"><code><c- g>getUserInfo</c-></code></dfn>(<a data-link-type="idl-name" href="#dictdef-identityproviderconfig" id="ref-for-dictdef-identityproviderconfig⑨"><c- n>IdentityProviderConfig</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProvider/getUserInfo(config)" data-dfn-type="argument" data-export id="dom-identityprovider-getuserinfo-config-config"><code><c- g>config</c-></code></dfn>);
+    <c- b>static</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-promise" id="ref-for-idl-promise④"><c- b>Promise</c-></a>&lt;<a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence⑦"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#dictdef-identityuserinfo" id="ref-for-dictdef-identityuserinfo①"><c- n>IdentityUserInfo</c-></a>>> <dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProvider" data-dfn-type="method" data-export data-lt="getUserInfo(config)" id="dom-identityprovider-getuserinfo"><code><c- g>getUserInfo</c-></code></dfn>(<a data-link-type="idl-name" href="#dictdef-identityproviderconfig" id="ref-for-dictdef-identityproviderconfig①⓪"><c- n>IdentityProviderConfig</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProvider/getUserInfo(config)" data-dfn-type="argument" data-export id="dom-identityprovider-getuserinfo-config-config"><code><c- g>config</c-></code></dfn>);
 };
 </pre>
    <p class="issue" id="issue-7ded5c77"><a class="self-link" href="#issue-7ded5c77"></a> <a href="https://github.com/fedidcg/FedCM/issues/476">Decide</a> whether <code class="idl"><a data-link-type="idl" href="#identityprovider" id="ref-for-identityprovider②">IdentityProvider</a></code> is the
@@ -2466,8 +2509,8 @@ <h3 class="heading settled" data-level="2.3" id="browser-api-identity-provider-i
 their phone number. To allow for such flows, the <a data-link-type="dfn" href="#idp" id="ref-for-idp②①">IDP</a> must call <code class="idl"><a data-link-type="idl" href="#dom-identityprovider-close" id="ref-for-dom-identityprovider-close②">close</a></code> when the flow is fully done.</p>
    <p>See the <a data-link-type="dfn" href="#show-an-idp-login-dialog" id="ref-for-show-an-idp-login-dialog④">show an IDP login dialog</a> algorithm for more details.</p>
    <p>An <code class="idl"><a data-link-type="idl" href="#dictdef-identityuserinfo" id="ref-for-dictdef-identityuserinfo②">IdentityUserInfo</a></code> represents user account information from a user. This information is exposed
-to the <a data-link-type="dfn" href="#idp" id="ref-for-idp②②">IDP</a> once the user has already used the FedCM API to login in the <a data-link-type="dfn" href="#rp" id="ref-for-rp②③">RP</a>. That is, it is
-exposed when there exists an account <var>account</var> such that the <a data-link-type="dfn" href="#connected-accounts-set" id="ref-for-connected-accounts-set①①">connected accounts set</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-contain" id="ref-for-list-contain⑧">contains</a> the triple (<a data-link-type="dfn" href="#rp" id="ref-for-rp②④">RP</a>, <a data-link-type="dfn" href="#idp" id="ref-for-idp②③">IDP</a>, <var>account</var>). The information matches what is received from the <a data-link-type="dfn" href="#accounts-endpoint" id="ref-for-accounts-endpoint①">accounts endpoint</a>. The <a data-link-type="dfn" href="#idp" id="ref-for-idp②④">IDP</a> can obtain this information by invoking the <code class="idl"><a data-link-type="idl" href="#dom-identityprovider-getuserinfo" id="ref-for-dom-identityprovider-getuserinfo①">getUserInfo()</a></code> static method from an iframe matching the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin" id="ref-for-concept-origin⑧">origin</a> of its <code class="idl"><a data-link-type="idl" href="#dom-identityproviderconfig-configurl" id="ref-for-dom-identityproviderconfig-configurl①①">configURL</a></code>.</p>
+to the <a data-link-type="dfn" href="#idp" id="ref-for-idp②②">IDP</a> once the user has already used the FedCM API to login in the <a data-link-type="dfn" href="#rp" id="ref-for-rp②②">RP</a>. That is, it is
+exposed when there exists an account <var>account</var> such that the <a data-link-type="dfn" href="#connected-accounts-set" id="ref-for-connected-accounts-set①①">connected accounts set</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-contain" id="ref-for-list-contain⑧">contains</a> the triple (<a data-link-type="dfn" href="#rp" id="ref-for-rp②③">RP</a>, <a data-link-type="dfn" href="#idp" id="ref-for-idp②③">IDP</a>, <var>account</var>). The information matches what is received from the <a data-link-type="dfn" href="#accounts-endpoint" id="ref-for-accounts-endpoint①">accounts endpoint</a>. The <a data-link-type="dfn" href="#idp" id="ref-for-idp②④">IDP</a> can obtain this information by invoking the <code class="idl"><a data-link-type="idl" href="#dom-identityprovider-getuserinfo" id="ref-for-dom-identityprovider-getuserinfo①">getUserInfo()</a></code> static method from an iframe matching the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin" id="ref-for-concept-origin⑧">origin</a> of its <code class="idl"><a data-link-type="idl" href="#dom-identityproviderconfig-configurl" id="ref-for-dom-identityproviderconfig-configurl①①">configURL</a></code>.</p>
    <div class="example" id="example-f6af7467">
     <a class="self-link" href="#example-f6af7467"></a> 
 <pre class="language-js highlight"><c- a>const</c-> userInfo <c- o>=</c-> <c- k>await</c-> IdentityProvider<c- p>.</c->getUserInfo<c- p>({</c->
@@ -2486,40 +2529,40 @@ <h3 class="heading settled" data-level="2.3" id="browser-api-identity-provider-i
 </pre>
    </div>
    <div class="algorithm" data-algorithm="getUserInfo">
-     When invoking the <code class="idl"><a data-link-type="idl" href="#dom-identityprovider-getuserinfo" id="ref-for-dom-identityprovider-getuserinfo②">getUserInfo()</a></code> method given an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderconfig" id="ref-for-dictdef-identityproviderconfig①⓪">IdentityProviderConfig</a></code> <var>provider</var>, perform the following steps: 
+     When invoking the <code class="idl"><a data-link-type="idl" href="#dom-identityprovider-getuserinfo" id="ref-for-dom-identityprovider-getuserinfo②">getUserInfo()</a></code> method given an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderconfig" id="ref-for-dictdef-identityproviderconfig①①">IdentityProviderConfig</a></code> <var>provider</var>, perform the following steps: 
     <ol>
      <li data-md>
       <p>Let <var>globalObject</var> be the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#current-global-object" id="ref-for-current-global-object①">current global object</a>.</p>
      <li data-md>
       <p>Let <var>document</var> be <var>globalObject</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/nav-history-apis.html#concept-document-window" id="ref-for-concept-document-window⑧">associated Document</a>.</p>
      <li data-md>
-      <p>If <var>document</var> is not <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use" id="ref-for-allowed-to-use①">allowed to use</a> the <a data-link-type="dfn" href="#identity-credentials-get" id="ref-for-identity-credentials-get①">identity-credentials-get</a> <a data-link-type="dfn" href="https://w3c.github.io/webappsec-permissions-policy/#policy-controlled-feature" id="ref-for-policy-controlled-feature①">policy-controlled feature</a>, throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑤">DOMException</a></code>.</p>
+      <p>If <var>document</var> is not <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use" id="ref-for-allowed-to-use①">allowed to use</a> the <a data-link-type="dfn" href="#identity-credentials-get" id="ref-for-identity-credentials-get①">identity-credentials-get</a> <a data-link-type="dfn" href="https://w3c.github.io/webappsec-permissions-policy/#policy-controlled-feature" id="ref-for-policy-controlled-feature①">policy-controlled feature</a>, throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑥">DOMException</a></code>.</p>
      <li data-md>
-      <p>If there does not exist an account <var>account</var> such that <a data-link-type="dfn" href="#connected-accounts-set" id="ref-for-connected-accounts-set①②">connected accounts set</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-contain" id="ref-for-list-contain⑨">contains</a> the result of <a data-link-type="dfn" href="#compute-the-connected-account-key" id="ref-for-compute-the-connected-account-key③">compute the connected account key</a> given <var>account</var>, <var>provider</var>, and <var>globalObject</var>, then <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#reject" id="ref-for-reject⑨">reject</a> <var>promise</var> with a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#networkerror" id="ref-for-networkerror①③">NetworkError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑥">DOMException</a></code>. This check can be performed by iterating over the <a data-link-type="dfn" href="#connected-accounts-set" id="ref-for-connected-accounts-set①③">connected accounts set</a> or by keeping a separate data structure to make this lookup fast.</p>
+      <p>If there does not exist an account <var>account</var> such that <a data-link-type="dfn" href="#connected-accounts-set" id="ref-for-connected-accounts-set①②">connected accounts set</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-contain" id="ref-for-list-contain⑨">contains</a> the result of <a data-link-type="dfn" href="#compute-the-connected-account-key" id="ref-for-compute-the-connected-account-key③">compute the connected account key</a> given <var>account</var>, <var>provider</var>, and <var>globalObject</var>, then <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#reject" id="ref-for-reject⑨">reject</a> <var>promise</var> with a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#networkerror" id="ref-for-networkerror①④">NetworkError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑦">DOMException</a></code>. This check can be performed by iterating over the <a data-link-type="dfn" href="#connected-accounts-set" id="ref-for-connected-accounts-set①③">connected accounts set</a> or by keeping a separate data structure to make this lookup fast.</p>
      <li data-md>
       <p>Let <var>configUrl</var> be the result of running <a data-link-type="dfn" href="#parse-url" id="ref-for-parse-url⑦">parse url</a> with <var>provider</var>’s <code class="idl"><a data-link-type="idl" href="#dom-identityproviderconfig-configurl" id="ref-for-dom-identityproviderconfig-configurl①②">configURL</a></code> and <var>globalObject</var>.</p>
      <li data-md>
-      <p>If <var>configUrl</var> is failure, throw an "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#invalidstateerror" id="ref-for-invalidstateerror①">InvalidStateError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑦">DOMException</a></code>.</p>
+      <p>If <var>configUrl</var> is failure, throw an "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#invalidstateerror" id="ref-for-invalidstateerror①">InvalidStateError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑧">DOMException</a></code>.</p>
      <li data-md>
       <p>If <var>document</var>’s <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#concept-document-origin" id="ref-for-concept-document-origin⑦">origin</a> is not <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#same-origin" id="ref-for-same-origin①">same origin</a> as <var>configUrl</var>’s <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-origin" id="ref-for-concept-url-origin③">origin</a>,
-throw an "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#invalidstateerror" id="ref-for-invalidstateerror②">InvalidStateError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑧">DOMException</a></code>.</p>
+throw an "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#invalidstateerror" id="ref-for-invalidstateerror②">InvalidStateError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑨">DOMException</a></code>.</p>
      <li data-md>
       <p>Run a <a data-link-type="biblio" href="https://w3c.github.io/webappsec-csp/"><cite>Content Security Policy Level 3</cite></a> check with a <a href="https://w3c.github.io/webappsec-csp/#directive-connect-src">connect-src</a> directive on the URL
-passed as <var>configUrl</var>. If it fails, throw a new "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#networkerror" id="ref-for-networkerror①④">NetworkError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑨">DOMException</a></code>.</p>
+passed as <var>configUrl</var>. If it fails, throw a new "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#networkerror" id="ref-for-networkerror①⑤">NetworkError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⓪">DOMException</a></code>.</p>
      <li data-md>
-      <p>If <var>globalObject</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/nav-history-apis.html#window-navigable" id="ref-for-window-navigable">navigable</a> is a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/document-sequences.html#top-level-traversable" id="ref-for-top-level-traversable">top-level traversable</a>, throw a new
-"<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#networkerror" id="ref-for-networkerror①⑤">NetworkError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⓪">DOMException</a></code>.</p>
+      <p>If <var>globalObject</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/nav-history-apis.html#window-navigable" id="ref-for-window-navigable①">navigable</a> is a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/document-sequences.html#top-level-traversable" id="ref-for-top-level-traversable">top-level traversable</a>, throw a new
+"<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#networkerror" id="ref-for-networkerror①⑥">NetworkError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②①">DOMException</a></code>.</p>
      <li data-md>
-      <p>If the user has disabled the FedCM API on the <var>globalObject</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/nav-history-apis.html#window-navigable" id="ref-for-window-navigable①">navigable</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/document-sequences.html#nav-top" id="ref-for-nav-top">top-level traversable</a>, throw a new "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#networkerror" id="ref-for-networkerror①⑥">NetworkError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②①">DOMException</a></code>.</p>
+      <p>If the user has disabled the FedCM API on the <var>globalObject</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/nav-history-apis.html#window-navigable" id="ref-for-window-navigable②">navigable</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/document-sequences.html#nav-top" id="ref-for-nav-top①">top-level traversable</a>, throw a new "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#networkerror" id="ref-for-networkerror①⑦">NetworkError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②②">DOMException</a></code>.</p>
      <li data-md>
       <p>Let <var>promise</var> be a new <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-promise" id="ref-for-idl-promise⑤">Promise</a></code>.</p>
      <li data-md>
-      <p>Perform the following steps <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/infrastructure.html#in-parallel" id="ref-for-in-parallel⑧">in parallel</a>:</p>
+      <p>Perform the following steps <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/infrastructure.html#in-parallel" id="ref-for-in-parallel⑨">in parallel</a>:</p>
       <ol>
        <li data-md>
         <p>Let <var>config</var> be the result of running <a data-link-type="dfn" href="#fetch-the-config-file" id="ref-for-fetch-the-config-file④">fetch the config file</a> with <var>provider</var> and <var>globalObject</var>.</p>
        <li data-md>
-        <p>If <var>config</var> is failure, <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#reject" id="ref-for-reject①⓪">reject</a> <var>promise</var> with a new "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#networkerror" id="ref-for-networkerror①⑦">NetworkError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②②">DOMException</a></code>.</p>
+        <p>If <var>config</var> is failure, <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#reject" id="ref-for-reject①⓪">reject</a> <var>promise</var> with a new "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#networkerror" id="ref-for-networkerror①⑧">NetworkError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②③">DOMException</a></code>.</p>
        <li data-md>
         <p>Let <var>accountsList</var> be the result of <a data-link-type="dfn" href="#fetch-the-accounts" id="ref-for-fetch-the-accounts②">fetch the accounts</a> with <var>config</var>, <var>provider</var>,
 and <var>globalObject</var>.</p>
@@ -2538,7 +2581,7 @@ <h3 class="heading settled" data-level="2.3" id="browser-api-identity-provider-i
         </ol>
        <li data-md>
         <p>If <var>hasAccountEligibleForAutoReauthentication</var> is false, <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#reject" id="ref-for-reject①①">reject</a> <var>promise</var> with a new
-"<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#networkerror" id="ref-for-networkerror①⑧">NetworkError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②③">DOMException</a></code>.</p>
+"<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#networkerror" id="ref-for-networkerror①⑨">NetworkError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②④">DOMException</a></code>.</p>
        <li data-md>
         <p>Let <var>userInfoList</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list" id="ref-for-list⑧">list</a>.</p>
        <li data-md>
@@ -2627,7 +2670,7 @@ <h3 class="heading settled" data-level="3.1" id="idp-api-well-known"><span class
    <p>The <a data-link-type="dfn" href="#well-known-file" id="ref-for-well-known-file⑤">well-known file</a> is fetched in the <a data-link-type="dfn" href="#fetch-the-config-file" id="ref-for-fetch-the-config-file⑤">fetch the config file</a> algorithm:</p>
    <p>(a) <strong>without</strong> cookies,
 (b) <strong>with</strong> the <a data-link-type="http-header" href="https://w3c.github.io/webappsec-fetch-metadata/#http-headerdef-sec-fetch-dest" id="ref-for-http-headerdef-sec-fetch-dest">Sec-Fetch-Dest</a> header set to <code>webidentity</code>, and
-(c) <strong>without</strong> revealing the <a data-link-type="dfn" href="#rp" id="ref-for-rp②⑤">RP</a> in the <a data-link-type="http-header" href="https://fetch.spec.whatwg.org/#http-origin" id="ref-for-http-origin">Origin</a> or <a href="https://httpwg.org/specs/rfc9110.html#field.referer">Referer</a> headers.</p>
+(c) <strong>without</strong> revealing the <a data-link-type="dfn" href="#rp" id="ref-for-rp②④">RP</a> in the <a data-link-type="http-header" href="https://fetch.spec.whatwg.org/#http-origin" id="ref-for-http-origin">Origin</a> or <a href="https://httpwg.org/specs/rfc9110.html#field.referer">Referer</a> headers.</p>
    <p>For example:</p>
    <div class="example" id="example-c06ffb02">
     <a class="self-link" href="#example-c06ffb02"></a> 
@@ -2649,7 +2692,7 @@ <h3 class="heading settled" data-level="3.2" id="idp-api-config-file"><span clas
    <p>The <a data-link-type="dfn" href="#config-file" id="ref-for-config-file">config file</a> is fetched in the <a data-link-type="dfn" href="#fetch-the-config-file" id="ref-for-fetch-the-config-file⑥">fetch the config file</a> algorithm:</p>
    <p>(a) <strong>without</strong> cookies,
 (b) <strong>with</strong> the <a data-link-type="http-header" href="https://w3c.github.io/webappsec-fetch-metadata/#http-headerdef-sec-fetch-dest" id="ref-for-http-headerdef-sec-fetch-dest①">Sec-Fetch-Dest</a> header set to <code>webidentity</code>,
-(c) <strong>without</strong> revealing the <a data-link-type="dfn" href="#rp" id="ref-for-rp②⑥">RP</a> in the <a data-link-type="http-header" href="https://fetch.spec.whatwg.org/#http-origin" id="ref-for-http-origin①">Origin</a> or <a href="https://httpwg.org/specs/rfc9110.html#field.referer">Referer</a> headers, and
+(c) <strong>without</strong> revealing the <a data-link-type="dfn" href="#rp" id="ref-for-rp②⑤">RP</a> in the <a data-link-type="http-header" href="https://fetch.spec.whatwg.org/#http-origin" id="ref-for-http-origin①">Origin</a> or <a href="https://httpwg.org/specs/rfc9110.html#field.referer">Referer</a> headers, and
 (d) <strong>without</strong> following <a href="https://httpwg.org/specs/rfc9110.html#field.location">HTTP redirects</a>.</p>
    <p>For example:</p>
    <div class="example" id="example-568d2573">
@@ -2745,7 +2788,7 @@ <h3 class="heading settled" data-level="3.3" id="idp-api-accounts-endpoint"><spa
    <p>The <a data-link-type="dfn" href="#accounts-endpoint" id="ref-for-accounts-endpoint②">accounts endpoint</a> is fetched in the <a data-link-type="dfn" href="#fetch-the-accounts" id="ref-for-fetch-the-accounts③">fetch the accounts</a> algorithm:</p>
    <p>(a) <strong>with</strong> <a data-link-type="dfn" href="#idp" id="ref-for-idp③⑥">IDP</a> cookies,
 (b) <strong>with</strong> the <a data-link-type="http-header" href="https://w3c.github.io/webappsec-fetch-metadata/#http-headerdef-sec-fetch-dest" id="ref-for-http-headerdef-sec-fetch-dest②">Sec-Fetch-Dest</a> header set to <code>webidentity</code>,
-(c) <strong>without</strong> revealing the <a data-link-type="dfn" href="#rp" id="ref-for-rp②⑦">RP</a> in the <a data-link-type="http-header" href="https://fetch.spec.whatwg.org/#http-origin" id="ref-for-http-origin②">Origin</a> or <a href="https://httpwg.org/specs/rfc9110.html#field.referer">Referer</a> headers, and
+(c) <strong>without</strong> revealing the <a data-link-type="dfn" href="#rp" id="ref-for-rp②⑥">RP</a> in the <a data-link-type="http-header" href="https://fetch.spec.whatwg.org/#http-origin" id="ref-for-http-origin②">Origin</a> or <a href="https://httpwg.org/specs/rfc9110.html#field.referer">Referer</a> headers, and
 (d) <strong>without</strong> following <a href="https://httpwg.org/specs/rfc9110.html#field.location">HTTP redirects</a>.</p>
    <p>For example:</p>
    <div class="example" id="example-6b4f66fb">
@@ -2777,18 +2820,18 @@ <h3 class="heading settled" data-level="3.3" id="idp-api-accounts-endpoint"><spa
      <p>URL for the account’s picture.</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderAccount" data-dfn-type="dict-member" data-export id="dom-identityprovideraccount-approved_clients"><code>approved_clients</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString④⑥">USVString</a>></span>
     <dd data-md>
-     <p>A list of <a data-link-type="dfn" href="#rp" id="ref-for-rp②⑧">RP</a>s (that gets matched against the requesting <code class="idl"><a data-link-type="idl" href="#dom-identityproviderconfig-clientid" id="ref-for-dom-identityproviderconfig-clientid⑧">clientId</a></code>) this account is already registered with.
+     <p>A list of <a data-link-type="dfn" href="#rp" id="ref-for-rp②⑦">RP</a>s (that gets matched against the requesting <code class="idl"><a data-link-type="idl" href="#dom-identityproviderconfig-clientid" id="ref-for-dom-identityproviderconfig-clientid⑧">clientId</a></code>) this account is already registered with.
 Used in the <a data-link-type="dfn" href="#request-permission-to-sign-up" id="ref-for-request-permission-to-sign-up③">request permission to sign-up</a> to allow the <a data-link-type="dfn" href="#idp" id="ref-for-idp③⑦">IDP</a> to control whether to show
 the Privacy Policy and the Terms of Service.</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderAccount" data-dfn-type="dict-member" data-export id="dom-identityprovideraccount-login_hints"><code>login_hints</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④">DOMString</a>></span>
     <dd data-md>
      <p>A list of strings which correspond to all of the login hints which match with this account.
-An <a data-link-type="dfn" href="#rp" id="ref-for-rp②⑨">RP</a> can use the <code class="idl"><a data-link-type="idl" href="#dom-identityproviderrequestoptions-loginhint" id="ref-for-dom-identityproviderrequestoptions-loginhint⑤">loginHint</a></code> to request that only an account
+An <a data-link-type="dfn" href="#rp" id="ref-for-rp②⑧">RP</a> can use the <code class="idl"><a data-link-type="idl" href="#dom-identityproviderrequestoptions-loginhint" id="ref-for-dom-identityproviderrequestoptions-loginhint⑤">loginHint</a></code> to request that only an account
 matching a given value is shown to the user.</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderAccount" data-dfn-type="dict-member" data-export id="dom-identityprovideraccount-domain_hints"><code>domain_hints</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤">DOMString</a>></span>
     <dd data-md>
      <p>A list of strings which correspond to all of the domain hints which match with this account.
-An <a data-link-type="dfn" href="#rp" id="ref-for-rp③⓪">RP</a> can use the <code class="idl"><a data-link-type="idl" href="#dom-identityproviderrequestoptions-domainhint" id="ref-for-dom-identityproviderrequestoptions-domainhint⑥">domainHint</a></code> to request that only an account
+An <a data-link-type="dfn" href="#rp" id="ref-for-rp②⑨">RP</a> can use the <code class="idl"><a data-link-type="idl" href="#dom-identityproviderrequestoptions-domainhint" id="ref-for-dom-identityproviderrequestoptions-domainhint⑥">domainHint</a></code> to request that only an account
 matching a given value or containing some domain hint is shown to the user.</p>
    </dl>
    <p>For example:</p>
@@ -2819,11 +2862,11 @@ <h3 class="heading settled" data-level="3.3" id="idp-api-accounts-endpoint"><spa
    </div>
    <p class="issue" id="issue-ef9f6ef5"><a class="self-link" href="#issue-ef9f6ef5"></a> <a href="https://github.com/fedidcg/FedCM/issues/218">Clarify</a> the IDP API response when the user is not signed in.</p>
    <h3 class="heading settled" data-level="3.4" id="idp-api-client-id-metadata-endpoint"><span class="secno">3.4. </span><span class="content">Client Metadata</span><a class="self-link" href="#idp-api-client-id-metadata-endpoint"></a></h3>
-   <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="client-metadata-endpoint">client metadata endpoint</dfn> provides metadata about <a data-link-type="dfn" href="#rp" id="ref-for-rp③①">RP</a>s.</p>
+   <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="client-metadata-endpoint">client metadata endpoint</dfn> provides metadata about <a data-link-type="dfn" href="#rp" id="ref-for-rp③⓪">RP</a>s.</p>
    <p>The <a data-link-type="dfn" href="#client-metadata-endpoint" id="ref-for-client-metadata-endpoint①">client metadata endpoint</a> is fetched in the <a data-link-type="dfn" href="#fetch-the-client-metadata" id="ref-for-fetch-the-client-metadata①">fetch the client metadata</a> algorithm:</p>
    <p>(a) <strong>without</strong> cookies,
 (b) <strong>with</strong> the <a data-link-type="http-header" href="https://w3c.github.io/webappsec-fetch-metadata/#http-headerdef-sec-fetch-dest" id="ref-for-http-headerdef-sec-fetch-dest③">Sec-Fetch-Dest</a> header set to <code>webidentity</code>,
-(c) <strong>with</strong> the <a data-link-type="dfn" href="#rp" id="ref-for-rp③②">RP</a>'s origin in the <a data-link-type="http-header" href="https://fetch.spec.whatwg.org/#http-origin" id="ref-for-http-origin③">Origin</a> header, and
+(c) <strong>with</strong> the <a data-link-type="dfn" href="#rp" id="ref-for-rp③①">RP</a>'s origin in the <a data-link-type="http-header" href="https://fetch.spec.whatwg.org/#http-origin" id="ref-for-http-origin③">Origin</a> header, and
 (d) <strong>without</strong> following <a href="https://httpwg.org/specs/rfc9110.html#field.location">HTTP redirects</a>.</p>
    <p>The user agent also passes the <strong>client_id</strong>.</p>
    <p>For example:</p>
@@ -2841,10 +2884,10 @@ <h3 class="heading settled" data-level="3.4" id="idp-api-client-id-metadata-endp
    <dl>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderClientMetadata" data-dfn-type="dict-member" data-export id="dom-identityproviderclientmetadata-privacy_policy_url"><code>privacy_policy_url</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString④⑦">USVString</a></span>
     <dd data-md>
-     <p>A link to the <a data-link-type="dfn" href="#rp" id="ref-for-rp③③">RP</a>'s Privacy Policy.</p>
+     <p>A link to the <a data-link-type="dfn" href="#rp" id="ref-for-rp③②">RP</a>'s Privacy Policy.</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="IdentityProviderClientMetadata" data-dfn-type="dict-member" data-export id="dom-identityproviderclientmetadata-terms_of_service_url"><code>terms_of_service_url</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString④⑧">USVString</a></span>
     <dd data-md>
-     <p>A link to the <a data-link-type="dfn" href="#rp" id="ref-for-rp③④">RP</a>'s Terms of Service.</p>
+     <p>A link to the <a data-link-type="dfn" href="#rp" id="ref-for-rp③③">RP</a>'s Terms of Service.</p>
    </dl>
    <p>For example:</p>
    <div class="example" id="example-001e0b0d">
@@ -2860,14 +2903,14 @@ <h3 class="heading settled" data-level="3.5" id="idp-api-id-assertion-endpoint">
    <p>The <a data-link-type="dfn" href="#identity-assertion-endpoint" id="ref-for-identity-assertion-endpoint①">identity assertion endpoint</a> is fetched in the <a data-link-type="dfn" href="#fetch-an-identity-assertion" id="ref-for-fetch-an-identity-assertion②">fetch an identity assertion</a> algorithm:</p>
    <p>(a) as a <strong>POST</strong> request,
 (b) <strong>with</strong> <a data-link-type="dfn" href="#idp" id="ref-for-idp③⑧">IDP</a> cookies,
-(c) <strong>with</strong> the <a data-link-type="dfn" href="#rp" id="ref-for-rp③⑤">RP</a>'s origin in the <a data-link-type="http-header" href="https://fetch.spec.whatwg.org/#http-origin" id="ref-for-http-origin④">Origin</a> header, and
+(c) <strong>with</strong> the <a data-link-type="dfn" href="#rp" id="ref-for-rp③④">RP</a>'s origin in the <a data-link-type="http-header" href="https://fetch.spec.whatwg.org/#http-origin" id="ref-for-http-origin④">Origin</a> header, and
 (d) <strong>with</strong> the <a data-link-type="http-header" href="https://w3c.github.io/webappsec-fetch-metadata/#http-headerdef-sec-fetch-dest" id="ref-for-http-headerdef-sec-fetch-dest④">Sec-Fetch-Dest</a> header set to <code>webidentity</code>,
 (e) <strong>without</strong> following <a href="https://httpwg.org/specs/rfc9110.html#field.location">HTTP redirects</a>.</p>
    <p>It will also contain the following parameters in the request body <code>application/x-www-form-urlencoded</code>:</p>
    <dl>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="id_assertion_endpoint_request" data-dfn-type="argument" data-export id="dom-id_assertion_endpoint_request-client_id"><code>client_id</code></dfn>
     <dd data-md>
-     <p>The <a data-link-type="dfn" href="#rp" id="ref-for-rp③⑥">RP</a>'s unique identifier from the <a data-link-type="dfn" href="#idp" id="ref-for-idp③⑨">IDP</a></p>
+     <p>The <a data-link-type="dfn" href="#rp" id="ref-for-rp③⑤">RP</a>'s unique identifier from the <a data-link-type="dfn" href="#idp" id="ref-for-idp③⑨">IDP</a></p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="id_assertion_endpoint_request" data-dfn-type="argument" data-export id="dom-id_assertion_endpoint_request-nonce"><code>nonce</code></dfn>
     <dd data-md>
      <p>The request nonce</p>
@@ -2876,7 +2919,7 @@ <h3 class="heading settled" data-level="3.5" id="idp-api-id-assertion-endpoint">
      <p>The account identifier that was selected.</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="id_assertion_endpoint_request" data-dfn-type="argument" data-export id="dom-id_assertion_endpoint_request-disclosure_text_shown"><code>disclosure_text_shown</code></dfn>
     <dd data-md>
-     <p>Whether the user agent has explicitly shown to the user what specific information the <a data-link-type="dfn" href="#idp" id="ref-for-idp④⓪">IDP</a> intends to share with the <a data-link-type="dfn" href="#rp" id="ref-for-rp③⑦">RP</a> (e.g. "idp.example will share your name, email...
+     <p>Whether the user agent has explicitly shown to the user what specific information the <a data-link-type="dfn" href="#idp" id="ref-for-idp④⓪">IDP</a> intends to share with the <a data-link-type="dfn" href="#rp" id="ref-for-rp③⑥">RP</a> (e.g. "idp.example will share your name, email...
 with rp.example"), used by the <a data-link-type="dfn" href="#request-permission-to-sign-up" id="ref-for-request-permission-to-sign-up④">request permission to sign-up</a> algorithm for new users. It
 is used as an assurance by the user agent to the <a data-link-type="dfn" href="#idp" id="ref-for-idp④①">IDP</a> that it has indeed shown the terms
 of service and privacy policy to the user in the cases where it is required to do so.</p>
@@ -2893,8 +2936,8 @@ <h3 class="heading settled" data-level="3.5" id="idp-api-id-assertion-endpoint">
 account_id=123&amp;client_id=client1234&amp;nonce=Ct60bD&amp;disclosure_text_shown=true
 </pre>
    </div>
-   <div class="idp-normative-text"> An <a data-link-type="dfn" href="#idp" id="ref-for-idp④②">IDP</a> MUST check the <a data-link-type="http-header" href="https://fetch.spec.whatwg.org/#http-origin" id="ref-for-http-origin⑤">Origin</a> header to ensure that a malicious <a data-link-type="dfn" href="#rp" id="ref-for-rp③⑧">RP</a> does
-not receive an ID token corresponding to another <a data-link-type="dfn" href="#rp" id="ref-for-rp③⑨">RP</a>. In other words, the <a data-link-type="dfn" href="#idp" id="ref-for-idp④③">IDP</a> MUST check that
+   <div class="idp-normative-text"> An <a data-link-type="dfn" href="#idp" id="ref-for-idp④②">IDP</a> MUST check the <a data-link-type="http-header" href="https://fetch.spec.whatwg.org/#http-origin" id="ref-for-http-origin⑤">Origin</a> header to ensure that a malicious <a data-link-type="dfn" href="#rp" id="ref-for-rp③⑦">RP</a> does
+not receive an ID token corresponding to another <a data-link-type="dfn" href="#rp" id="ref-for-rp③⑧">RP</a>. In other words, the <a data-link-type="dfn" href="#idp" id="ref-for-idp④③">IDP</a> MUST check that
 the <a data-link-type="http-header" href="https://fetch.spec.whatwg.org/#http-origin" id="ref-for-http-origin⑥">Origin</a> header value is represented by the <code class="idl"><a data-link-type="idl" href="#dom-identityproviderconfig-clientid" id="ref-for-dom-identityproviderconfig-clientid⑨">clientId</a></code>. As the <code class="idl"><a data-link-type="idl" href="#dom-identityproviderconfig-clientid" id="ref-for-dom-identityproviderconfig-clientid①⓪">clientId</a></code> are <a data-link-type="dfn" href="#idp" id="ref-for-idp④④">IDP</a>-specific, the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#user-agent" id="ref-for-user-agent①②">user agent</a> cannot perform this check. </div>
    <p>The response body must be a JSON object that can be <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-convert-ecmascript-to-idl-value" id="ref-for-dfn-convert-ecmascript-to-idl-value⑨">converted</a> to an <code class="idl"><a data-link-type="idl" href="#dictdef-identityprovidertoken" id="ref-for-dictdef-identityprovidertoken①">IdentityProviderToken</a></code> without an exception.</p>
    <p>Every <code class="idl"><a data-link-type="idl" href="#dictdef-identityprovidertoken" id="ref-for-dictdef-identityprovidertoken②">IdentityProviderToken</a></code> is expected to have members with the following semantics:</p>
@@ -2904,7 +2947,7 @@ <h3 class="heading settled" data-level="3.5" id="idp-api-id-assertion-endpoint">
      <p>The resulting token.</p>
    </dl>
    <p>The content of the <code class="idl"><a data-link-type="idl" href="#dom-identityprovidertoken-token" id="ref-for-dom-identityprovidertoken-token③">token</a></code> is opaque to the user agent and can contain
-anything that the <a data-link-type="dfn" href="#idp" id="ref-for-idp④⑤">IDP</a> would like to pass to the <a data-link-type="dfn" href="#rp" id="ref-for-rp④⓪">RP</a> to facilitate the login. For this reason the <a data-link-type="dfn" href="#rp" id="ref-for-rp④①">RP</a> is expected to be the party responsible for validating the <code class="idl"><a data-link-type="idl" href="#dom-identityprovidertoken-token" id="ref-for-dom-identityprovidertoken-token④">token</a></code> passed
+anything that the <a data-link-type="dfn" href="#idp" id="ref-for-idp④⑤">IDP</a> would like to pass to the <a data-link-type="dfn" href="#rp" id="ref-for-rp③⑨">RP</a> to facilitate the login. For this reason the <a data-link-type="dfn" href="#rp" id="ref-for-rp④⓪">RP</a> is expected to be the party responsible for validating the <code class="idl"><a data-link-type="idl" href="#dom-identityprovidertoken-token" id="ref-for-dom-identityprovidertoken-token④">token</a></code> passed
 along from the <a data-link-type="dfn" href="#idp" id="ref-for-idp④⑥">IDP</a> using the appropriate token validation
 algorithms defined. One example of how this might be done is defined
 in <a href="https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation">OIDC Connect Core § IDTokenValidation</a>.</p>
@@ -2922,11 +2965,11 @@ <h3 class="heading settled" data-level="3.5" id="idp-api-id-assertion-endpoint">
    </div>
    <h3 class="heading settled" data-level="3.6" id="idp-api-disconnect-endpoint"><span class="secno">3.6. </span><span class="content">Disconnect endpoint</span><a class="self-link" href="#idp-api-disconnect-endpoint"></a></h3>
    <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="disconnect-endpoint">disconnect endpoint</dfn> is responsible for disconnecting a previously made federated
-login connection between an <a data-link-type="dfn" href="#rp" id="ref-for-rp④②">RP</a> and an <a data-link-type="dfn" href="#idp" id="ref-for-idp④⑨">IDP</a> account, and returning the account’s <code class="idl"><a data-link-type="idl" href="#dom-identityprovideraccount-id" id="ref-for-dom-identityprovideraccount-id④">id</a></code> so that the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#user-agent" id="ref-for-user-agent①③">user agent</a> can remove it from the <a data-link-type="dfn" href="#connected-accounts-set" id="ref-for-connected-accounts-set①④">connected accounts set</a>.</p>
+login connection between an <a data-link-type="dfn" href="#rp" id="ref-for-rp④①">RP</a> and an <a data-link-type="dfn" href="#idp" id="ref-for-idp④⑨">IDP</a> account, and returning the account’s <code class="idl"><a data-link-type="idl" href="#dom-identityprovideraccount-id" id="ref-for-dom-identityprovideraccount-id④">id</a></code> so that the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#user-agent" id="ref-for-user-agent①③">user agent</a> can remove it from the <a data-link-type="dfn" href="#connected-accounts-set" id="ref-for-connected-accounts-set①④">connected accounts set</a>.</p>
    <p>The <a data-link-type="dfn" href="#disconnect-endpoint" id="ref-for-disconnect-endpoint">disconnect endpoint</a> is fetched when invoking the <code class="idl"><a data-link-type="idl" href="#dom-identitycredential-disconnect" id="ref-for-dom-identitycredential-disconnect③">disconnect</a></code> method:</p>
    <p>(a) as a <strong>POST</strong> request,
 (b) <strong>with</strong> <a data-link-type="dfn" href="#idp" id="ref-for-idp⑤⓪">IDP</a> cookies,
-(c) <strong>with</strong> the <a data-link-type="dfn" href="#rp" id="ref-for-rp④③">RP</a>'s origin in the <a data-link-type="http-header" href="https://fetch.spec.whatwg.org/#http-origin" id="ref-for-http-origin⑦">Origin</a> header,
+(c) <strong>with</strong> the <a data-link-type="dfn" href="#rp" id="ref-for-rp④②">RP</a>'s origin in the <a data-link-type="http-header" href="https://fetch.spec.whatwg.org/#http-origin" id="ref-for-http-origin⑦">Origin</a> header,
 (d) <strong>with</strong> the <a data-link-type="http-header" href="https://w3c.github.io/webappsec-fetch-metadata/#http-headerdef-sec-fetch-dest" id="ref-for-http-headerdef-sec-fetch-dest⑤">Sec-Fetch-Dest</a> header set to <code>webidentity</code>,
 (e) <strong>without</strong> following <a href="https://httpwg.org/specs/rfc9110.html#field.location">HTTP redirects</a>, and
 (f) in "cors" <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-mode" id="ref-for-concept-request-mode①②">mode</a>.</p>
@@ -2934,10 +2977,10 @@ <h3 class="heading settled" data-level="3.6" id="idp-api-disconnect-endpoint"><s
    <dl>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="disconnect_endpoint_request" data-dfn-type="argument" data-export id="dom-disconnect_endpoint_request-client_id"><code>client_id</code></dfn>
     <dd data-md>
-     <p>The <a data-link-type="dfn" href="#rp" id="ref-for-rp④④">RP</a>'s unique identifier from the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑤①">IDP</a></p>
+     <p>The <a data-link-type="dfn" href="#rp" id="ref-for-rp④③">RP</a>'s unique identifier from the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑤①">IDP</a></p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="disconnect_endpoint_request" data-dfn-type="argument" data-export id="dom-disconnect_endpoint_request-account_hint"><code>account_hint</code></dfn>
     <dd data-md>
-     <p>An account hint for the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑤②">IDP</a> account being disconnected from the <a data-link-type="dfn" href="#rp" id="ref-for-rp④⑤">RP</a>.</p>
+     <p>An account hint for the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑤②">IDP</a> account being disconnected from the <a data-link-type="dfn" href="#rp" id="ref-for-rp④④">RP</a>.</p>
    </dl>
    <p>For example:</p>
    <div class="example" id="example-d810f151">
@@ -2960,19 +3003,19 @@ <h3 class="heading settled" data-level="3.6" id="idp-api-disconnect-endpoint"><s
    </dl>
    <p>The <a data-link-type="dfn" href="#idp" id="ref-for-idp⑤④">IDP</a> must return the <code class="idl"><a data-link-type="idl" href="#dom-disconnectedaccount-account_id" id="ref-for-dom-disconnectedaccount-account_id②">account_id</a></code> since it may be different from the <code class="idl"><a data-link-type="idl" href="#dom-disconnect_endpoint_request-account_hint" id="ref-for-dom-disconnect_endpoint_request-account_hint">account_hint</a></code>, and the ID is the one which allows the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#user-agent" id="ref-for-user-agent①④">user agent</a> to disconnect the account from the <a data-link-type="dfn" href="#connected-accounts-set" id="ref-for-connected-accounts-set①⑤">connected accounts set</a>. If the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑤⑤">IDP</a> returns an error or
 the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#user-agent" id="ref-for-user-agent①⑤">user agent</a> does not find the account with the ID provided by the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑤⑥">IDP</a>, then all accounts
-associated with the relevant (<a data-link-type="dfn" href="#rp" id="ref-for-rp④⑥">RP</a>, <a data-link-type="dfn" href="#idp" id="ref-for-idp⑤⑦">IDP</a>) are removed from the <a data-link-type="dfn" href="#connected-accounts-set" id="ref-for-connected-accounts-set①⑥">connected accounts set</a>.</p>
+associated with the relevant (<a data-link-type="dfn" href="#rp" id="ref-for-rp④⑤">RP</a>, <a data-link-type="dfn" href="#idp" id="ref-for-idp⑤⑦">IDP</a>) are removed from the <a data-link-type="dfn" href="#connected-accounts-set" id="ref-for-connected-accounts-set①⑥">connected accounts set</a>.</p>
    <h2 class="heading settled" data-level="4" id="permissions-policy-integration"><span class="secno">4. </span><span class="content">Permissions Policy Integration</span><a class="self-link" href="#permissions-policy-integration"></a></h2>
    <p>FedCM defines a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-permissions-policy/#policy-controlled-feature" id="ref-for-policy-controlled-feature②">policy-controlled feature</a> identified by the string <code>"<dfn class="dfn-paneled" data-dfn-type="dfn" data-export id="identity-credentials-get">identity-credentials-get</dfn>"</code>.
 Its <a data-link-type="dfn" href="https://w3c.github.io/webappsec-permissions-policy/#policy-controlled-feature-default-allowlist" id="ref-for-policy-controlled-feature-default-allowlist">default allowlist</a> is <code>"self"</code>.</p>
    <p>A <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document" id="ref-for-document">Document</a></code>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy" id="ref-for-concept-document-permissions-policy①">permissions policy</a> determines whether any content
 in that document is allowed to obtain a credential object using the <a href="#browser-api">Browser API</a>.
 Attempting to invoke <code><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①">navigator.credentials.get({identity:..., ...})</a></code> in documents that are not <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use" id="ref-for-allowed-to-use②">allowed to use</a> the <a data-link-type="dfn" href="#identity-credentials-get" id="ref-for-identity-credentials-get②">identity-credentials-get</a> feature will result
-in <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#a-promise-rejected-with" id="ref-for-a-promise-rejected-with">a promise rejected with</a> a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror②">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②④">DOMException</a></code>.</p>
+in <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#a-promise-rejected-with" id="ref-for-a-promise-rejected-with">a promise rejected with</a> a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror②">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⑤">DOMException</a></code>.</p>
    <p>This restriction can be controlled using the mechanisms described in <a data-link-type="biblio" href="https://w3c.github.io/webappsec-permissions-policy"><cite>Permissions Policy</cite></a>.</p>
    <p class="note" role="note"><span class="marker">Note:</span> Algorithms specified in <a data-link-type="biblio" href="https://w3c.github.io/webappsec-credential-management/"><cite>Credential Management Level 1</cite></a> perform the actual
 permissions policy evaluation. This is because such policy evaluation needs to
 occur when there is access to the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#current-settings-object" id="ref-for-current-settings-object">current settings object</a>. The <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-ordinary-object-internal-methods-and-internal-slots" id="ref-for-sec-ordinary-object-internal-methods-and-internal-slots②">internal method</a>s
-modified by this specification do not have such access since they are invoked <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/infrastructure.html#in-parallel" id="ref-for-in-parallel⑨">in parallel</a> by <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#credentialscontainer" id="ref-for-credentialscontainer①">CredentialsContainer</a></code>'s <a data-link-type="abstract-op" href="https://w3c.github.io/webappsec-credential-management/#abstract-opdef-request-a-credential" id="ref-for-abstract-opdef-request-a-credential①">Request a <code>Credential</code></a> abstract operation.</p>
+modified by this specification do not have such access since they are invoked <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/infrastructure.html#in-parallel" id="ref-for-in-parallel①⓪">in parallel</a> by <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#credentialscontainer" id="ref-for-credentialscontainer①">CredentialsContainer</a></code>'s <a data-link-type="abstract-op" href="https://w3c.github.io/webappsec-credential-management/#abstract-opdef-request-a-credential" id="ref-for-abstract-opdef-request-a-credential①">Request a <code>Credential</code></a> abstract operation.</p>
    <h2 class="heading settled" data-level="5" id="automation"><span class="secno">5. </span><span class="content">User Agent Automation</span><a class="self-link" href="#automation"></a></h2>
    <p>For the purposes of user agent automation and website testing, this document
 defines the below <a data-link-type="biblio" href="https://w3c.github.io/webdriver/"><cite>WebDriver</cite></a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands">extension commands</a> to interact with any
@@ -3258,16 +3301,16 @@ <h2 class="heading settled" data-level="6" id="security"><span class="secno">6.
    <p>This section provides a few of the security considerations for the FedCM API. Note that there is a
 separate section for <a href="#privacy">§ 7 Privacy</a> considerations.</p>
    <h3 class="heading settled" data-level="6.1" id="content-security-policy"><span class="secno">6.1. </span><span class="content">Content Security Policy</span><a class="self-link" href="#content-security-policy"></a></h3>
-   <p>The first fetches triggered by the FedCM API are the manifest list, which is public, and the <a data-link-type="dfn" href="#config-file" id="ref-for-config-file①">config file</a>. Imagine a malicious script included by (and running as) the <a data-link-type="dfn" href="#rp" id="ref-for-rp④⑦">RP</a> attempting to
-execute the FedCM API calls to a malicious <a data-link-type="dfn" href="#idp" id="ref-for-idp⑤⑧">IDP</a>, one which is not trusted by the <a data-link-type="dfn" href="#rp" id="ref-for-rp④⑧">RP</a>. If the
-call is successful, this would introduce browser UI on the <a data-link-type="dfn" href="#rp" id="ref-for-rp④⑨">RP</a> with sign in options into a
+   <p>The first fetches triggered by the FedCM API are the manifest list, which is public, and the <a data-link-type="dfn" href="#config-file" id="ref-for-config-file①">config file</a>. Imagine a malicious script included by (and running as) the <a data-link-type="dfn" href="#rp" id="ref-for-rp④⑥">RP</a> attempting to
+execute the FedCM API calls to a malicious <a data-link-type="dfn" href="#idp" id="ref-for-idp⑤⑧">IDP</a>, one which is not trusted by the <a data-link-type="dfn" href="#rp" id="ref-for-rp④⑦">RP</a>. If the
+call is successful, this would introduce browser UI on the <a data-link-type="dfn" href="#rp" id="ref-for-rp④⑧">RP</a> with sign in options into a
 malicious <a data-link-type="dfn" href="#idp" id="ref-for-idp⑤⑨">IDP</a>. This malicious<a data-link-type="dfn" href="#idp" id="ref-for-idp⑥⓪">IDP</a> could then attempt to trick the user. The protection
 against this attack is the <a data-link-type="biblio" href="https://w3c.github.io/webappsec-csp/"><cite>Content Security Policy Level 3</cite></a> check, which would fail because the origin of the manifest of
 the malicious <a data-link-type="dfn" href="#idp" id="ref-for-idp⑥①">IDP</a> would not be an origin included in the allowlist specified by the <a data-link-type="biblio" href="https://w3c.github.io/webappsec-csp/"><cite>Content Security Policy Level 3</cite></a> of
-the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑤⓪">RP</a>, hence preventing the undesired FedCM UI from being shown. Since any subsequent fetches
+the <a data-link-type="dfn" href="#rp" id="ref-for-rp④⑨">RP</a>, hence preventing the undesired FedCM UI from being shown. Since any subsequent fetches
 are same origin with respect to the <a data-link-type="dfn" href="#config-file" id="ref-for-config-file②">config file</a> or at least dependent on the contents of the <a data-link-type="dfn" href="#config-file" id="ref-for-config-file③">config file</a>, they do not require additional checks.</p>
    <p>The non-same-origin fetches include, for example, the brand icon. The user agent does not perform a <a data-link-type="biblio" href="https://w3c.github.io/webappsec-csp/"><cite>Content Security Policy Level 3</cite></a> check on these because they are directly specified from the manifest. In addition, the
-rendering of this image is performed by the user agent, and as such this image cannot affect the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑤①">RP</a> site nor can they be inspected by the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑤②">RP</a> in any way.</p>
+rendering of this image is performed by the user agent, and as such this image cannot affect the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑤⓪">RP</a> site nor can they be inspected by the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑤①">RP</a> in any way.</p>
    <h3 class="heading settled" data-level="6.2" id="sec-fetch-dest-header"><span class="secno">6.2. </span><span class="content">Sec-Fetch-Dest Header</span><a class="self-link" href="#sec-fetch-dest-header"></a></h3>
    <p>The FedCM API introduces several non-static endpoints on the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑥②">IDP</a>, so these need to be protected
 from XSS attacks. In order to do so, the FedCM API introduces a new value for the <a data-link-type="http-header" href="https://w3c.github.io/webappsec-fetch-metadata/#http-headerdef-sec-fetch-dest" id="ref-for-http-headerdef-sec-fetch-dest⑥">Sec-Fetch-Dest</a> header, a <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#forbidden-request-header" id="ref-for-forbidden-request-header">forbidden request-header</a>. The requests initiated by the FedCM API
@@ -3277,7 +3320,7 @@ <h3 class="heading settled" data-level="6.2" id="sec-fetch-dest-header"><span cl
 based on the FedCM API. A malicious actor cannot spam FedCM API calls, so this is sufficient
 protection for the new <a data-link-type="dfn" href="#idp" id="ref-for-idp⑥⑤">IDP</a> endpoints.</p>
    <h3 class="heading settled" data-level="6.3" id="sec-cors-header"><span class="secno">6.3. </span><span class="content">CORS Header</span><a class="self-link" href="#sec-cors-header"></a></h3>
-   <p>The FedCM API allows the response from the <a data-link-type="dfn" href="#identity-assertion-endpoint" id="ref-for-identity-assertion-endpoint②">identity assertion endpoint</a> to be shared to the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑤③">RP</a>. Because of this, we impose the requirement that the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑥⑥">IDP</a> explicitly consents to this
+   <p>The FedCM API allows the response from the <a data-link-type="dfn" href="#identity-assertion-endpoint" id="ref-for-identity-assertion-endpoint②">identity assertion endpoint</a> to be shared to the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑤②">RP</a>. Because of this, we impose the requirement that the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑥⑥">IDP</a> explicitly consents to this
 sharing taking place by using the "cors" <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-mode" id="ref-for-concept-request-mode①③">mode</a> when fetching this endpoint. This also
 helps with servers that may accidentally ignore the <a data-link-type="http-header" href="https://w3c.github.io/webappsec-fetch-metadata/#http-headerdef-sec-fetch-dest" id="ref-for-http-headerdef-sec-fetch-dest⑦">Sec-Fetch-Dest</a>: they cannot
 ignore CORS, as without it the fetch will fail.</p>
@@ -3308,22 +3351,22 @@ <h3 class="heading settled" data-level="7.1" id="privacy-principals"><span class
 expectations around their behavior.</p>
    <ol>
     <li data-md>
-     <p>The <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#user-agent" id="ref-for-user-agent①⑥">user agent</a> implements <a href="#browser-api">§ 2 The Browser API</a> and controls the execution contexts for the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑤④">RP</a> and <a data-link-type="dfn" href="#idp" id="ref-for-idp⑥⑧">IDP</a> content. The <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#user-agent" id="ref-for-user-agent①⑦">user agent</a> is assumed to be trusted by the user, and transitively
-trusted by the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑤⑤">RP</a> and <a data-link-type="dfn" href="#idp" id="ref-for-idp⑥⑨">IDP</a>.</p>
+     <p>The <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#user-agent" id="ref-for-user-agent①⑥">user agent</a> implements <a href="#browser-api">§ 2 The Browser API</a> and controls the execution contexts for the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑤③">RP</a> and <a data-link-type="dfn" href="#idp" id="ref-for-idp⑥⑧">IDP</a> content. The <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#user-agent" id="ref-for-user-agent①⑦">user agent</a> is assumed to be trusted by the user, and transitively
+trusted by the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑤④">RP</a> and <a data-link-type="dfn" href="#idp" id="ref-for-idp⑥⑨">IDP</a>.</p>
     <li data-md>
-     <p><a data-link-type="dfn" href="#rp" id="ref-for-rp⑤⑥">RP</a>s are websites that invoke the FedCM API for the purpose of
+     <p><a data-link-type="dfn" href="#rp" id="ref-for-rp⑤⑤">RP</a>s are websites that invoke the FedCM API for the purpose of
 authenticating a user to their account or for requesting information about that user. Since any
-site can invoke the API, <a data-link-type="dfn" href="#rp" id="ref-for-rp⑤⑦">RP</a>s cannot necessarily be trusted to limit the user information it
+site can invoke the API, <a data-link-type="dfn" href="#rp" id="ref-for-rp⑤⑥">RP</a>s cannot necessarily be trusted to limit the user information it
 collects or use that information in an acceptable way.</p>
     <li data-md>
      <p><a data-link-type="dfn" href="#idp" id="ref-for-idp⑦⓪">IDP</a>s are third-party websites that are the target of a FedCM call to
-attempt to fetch a token. Usually,the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑦①">IDP</a> has a higher level of trust than the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑤⑧">RP</a> since it already has the user’s personal information, but it is possible that the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑦②">IDP</a> might use the user’s information in non-approved ways. In addition, it is possible that the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑦③">IDP</a> specified in the API call may not be an <a data-link-type="dfn" href="#idp" id="ref-for-idp⑦④">IDP</a> the user knows about. In this case, it
+attempt to fetch a token. Usually,the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑦①">IDP</a> has a higher level of trust than the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑤⑦">RP</a> since it already has the user’s personal information, but it is possible that the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑦②">IDP</a> might use the user’s information in non-approved ways. In addition, it is possible that the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑦③">IDP</a> specified in the API call may not be an <a data-link-type="dfn" href="#idp" id="ref-for-idp⑦④">IDP</a> the user knows about. In this case, it
 likely does not have personal user information in advance.</p>
     <li data-md>
      <p>A <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="tracker">tracker</dfn> is a third-party website that is not an <a data-link-type="dfn" href="#idp" id="ref-for-idp⑦⑤">IDP</a> but could abuse the FedCM API
 exclusively for the purpose of tracking a user as they visit various websites. A <a data-link-type="dfn" href="#tracker" id="ref-for-tracker">tracker</a> may
-be injected by the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑤⑨">RP</a> with or without their knowledge (e.g. injected into one of the various
-script tags that the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑥⓪">RP</a> embeds that is loaded dynamically), but they usually do not modify
+be injected by the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑤⑧">RP</a> with or without their knowledge (e.g. injected into one of the various
+script tags that the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑤⑨">RP</a> embeds that is loaded dynamically), but they usually do not modify
 the UI of the website, so that it is harder to detect the tracking. A <a data-link-type="dfn" href="#tracker" id="ref-for-tracker①">tracker</a> that
 successfully adds tracking scripts for users in various websites may then use this information
 for various purposes, such as selling the information about the user. It should not be possible
@@ -3332,21 +3375,21 @@ <h3 class="heading settled" data-level="7.1" id="privacy-principals"><span class
    <p>Based on the above, the privacy discussion makes the following assumptions:</p>
    <ol>
     <li data-md>
-     <p>It is not acceptable for an <a data-link-type="dfn" href="#rp" id="ref-for-rp⑥①">RP</a>, <a data-link-type="dfn" href="#idp" id="ref-for-idp⑦⑥">IDP</a>, or <a data-link-type="dfn" href="#tracker" id="ref-for-tracker③">tracker</a> to learn that a specific user visited a
+     <p>It is not acceptable for an <a data-link-type="dfn" href="#rp" id="ref-for-rp⑥⓪">RP</a>, <a data-link-type="dfn" href="#idp" id="ref-for-idp⑦⑥">IDP</a>, or <a data-link-type="dfn" href="#tracker" id="ref-for-tracker③">tracker</a> to learn that a specific user visited a
 specific site, without any permission granted by the user. That is, the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#user-agent" id="ref-for-user-agent①⑧">user agent</a> needs to hide the
-knowledge that a specific user identity visited a specific site from the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑥②">RP</a>, <a data-link-type="dfn" href="#idp" id="ref-for-idp⑦⑦">IDP</a>, and <a data-link-type="dfn" href="#tracker" id="ref-for-tracker④">trackers</a>. It may share this knowledge with the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑥③">RP</a> and <a data-link-type="dfn" href="#idp" id="ref-for-idp⑦⑧">IDP</a> once the user grants permission. In
-particular, the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑥④">RP</a> should not know the user identity and the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑦⑨">IDP</a> should not know the
+knowledge that a specific user identity visited a specific site from the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑥①">RP</a>, <a data-link-type="dfn" href="#idp" id="ref-for-idp⑦⑦">IDP</a>, and <a data-link-type="dfn" href="#tracker" id="ref-for-tracker④">trackers</a>. It may share this knowledge with the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑥②">RP</a> and <a data-link-type="dfn" href="#idp" id="ref-for-idp⑦⑧">IDP</a> once the user grants permission. In
+particular, the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑥③">RP</a> should not know the user identity and the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑦⑨">IDP</a> should not know the
 site that the user has visited before the FedCM flow gathers the user’s permission to do so.</p>
     <li data-md>
-     <p>It is the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#user-agent" id="ref-for-user-agent①⑨">user agent</a>'s responsibility to determine when the user has granted permission for the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑧⓪">IDP</a> to communicate with the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑥⑤">RP</a> in order to provide identification for the user.</p>
+     <p>It is the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#user-agent" id="ref-for-user-agent①⑨">user agent</a>'s responsibility to determine when the user has granted permission for the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑧⓪">IDP</a> to communicate with the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑥④">RP</a> in order to provide identification for the user.</p>
     <li data-md>
      <p>Once the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#user-agent" id="ref-for-user-agent②⓪">user agent</a> has determined that the user has granted permission to provide their
-account information to the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑥⑥">RP</a>, it is ok for the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑧①">IDP</a> and for the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑥⑦">RP</a> to learn
-information about that specific user’s account, as required to provide identification. The <a data-link-type="dfn" href="#rp" id="ref-for-rp⑥⑧">RP</a> should not learn about about any other user accounts.</p>
+account information to the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑥⑤">RP</a>, it is ok for the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑧①">IDP</a> and for the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑥⑥">RP</a> to learn
+information about that specific user’s account, as required to provide identification. The <a data-link-type="dfn" href="#rp" id="ref-for-rp⑥⑦">RP</a> should not learn about about any other user accounts.</p>
    </ol>
    <h3 class="heading settled" data-level="7.2" id="network-requests"><span class="secno">7.2. </span><span class="content">Network requests</span><a class="self-link" href="#network-requests"></a></h3>
    <p>This specification ensures that the FedCM fetches are all same-origin with respect to the provider specified
-by the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑥⑨">RP</a>. The reason for this is because fetches with cookies would use the cookies from the
+by the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑥⑧">RP</a>. The reason for this is because fetches with cookies would use the cookies from the
 origin specified, so allowing arbitrary origins would introduce confusion and potential privacy
 issues with regards to which cookies are shared and with whom within the FedCM flow. The easiest way
 to ensure that all of these fetches remain same-origin is by disabling redirects and checking the
@@ -3358,7 +3401,7 @@ <h3 class="heading settled" data-level="7.2" id="network-requests"><span class="
 is considered public.</p>
     <li data-md>
      <p>The <a data-link-type="dfn" href="#accounts-endpoint" id="ref-for-accounts-endpoint③">accounts endpoint</a> fetch can’t be used to track users because it is performed with cookies from the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑧②">IDP</a> but, importantly, without the <code class="idl"><a data-link-type="idl" href="#dom-id_assertion_endpoint_request-client_id" id="ref-for-dom-id_assertion_endpoint_request-client_id②">client_id</a></code> or referrer. This in theory is a new power
-that the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑦⓪">RP</a> gains that it would not have otherwise. Preventing too many of these fetches may
+that the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑥⑨">RP</a> gains that it would not have otherwise. Preventing too many of these fetches may
 be important, but <a data-link-type="dfn" href="#idp" id="ref-for-idp⑧③">IDP</a>s are already expected to protect against DoS attacks. In addition, the
 user agent should only allow one FedCM flow per page at any given moment, immediately rejecting
 any attempts to start another one. Since a FedCM flow can only be terminated when the user
@@ -3367,22 +3410,22 @@ <h3 class="heading settled" data-level="7.2" id="network-requests"><span class="
      <p>The <a data-link-type="dfn" href="#client-metadata-endpoint" id="ref-for-client-metadata-endpoint②">client metadata endpoint</a> fetch can’t be used to track users too because it is performed without cookies
 from the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑧⑤">IDP</a>, albeit with a <code class="idl"><a data-link-type="idl" href="#dom-id_assertion_endpoint_request-client_id" id="ref-for-dom-id_assertion_endpoint_request-client_id③">client_id</a></code> and a referrer. This allows the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑧⑥">IDP</a> to
 communicate the relevant Privacy Policy and Terms of Service to the user agent, in case
-they need to be displayed. Again, besides possible timing attacks described here, the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑦①">RP</a> gains nothing from this fetch, and the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑦②">RP</a> could already perform this fetch if it wanted to
+they need to be displayed. Again, besides possible timing attacks described here, the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑦⓪">RP</a> gains nothing from this fetch, and the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑦①">RP</a> could already perform this fetch if it wanted to
 since it involves no cookies from the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑧⑦">IDP</a>.</p>
     <li data-md>
      <p>By design, the token fetch exposes the user at the website to the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑧⑧">IDP</a>: it is
 peformed with cookies, <code class="idl"><a data-link-type="idl" href="#dom-id_assertion_endpoint_request-client_id" id="ref-for-dom-id_assertion_endpoint_request-client_id④">client_id</a></code>, and referrer. Because of that, it is gated on the user
-interacting with the user agent UI, and enables the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑧⑨">IDP</a> to communicate to the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑦③">RP</a> the
-information required to perform a federated signin/signup. It is not possible for the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑦④">RP</a> or
+interacting with the user agent UI, and enables the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑧⑨">IDP</a> to communicate to the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑦②">RP</a> the
+information required to perform a federated signin/signup. It is not possible for the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑦③">RP</a> or
 the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑨⓪">IDP</a> to force the token fetch to happen without user permission, as the user agent cannot be
 spoofed or otherwise tricked.</p>
     <li data-md>
      <p>The <a data-link-type="dfn" href="#disconnect-endpoint" id="ref-for-disconnect-endpoint①">disconnect endpoint</a> may only be fetched after the user has successfully gone through the
-FedCM flow at least once in the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑦⑤">RP</a>. It sends a credentialed request to the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑨①">IDP</a>, so it
+FedCM flow at least once in the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑦④">RP</a>. It sends a credentialed request to the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑨①">IDP</a>, so it
 is important that the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#user-agent" id="ref-for-user-agent②①">user agent</a> does not allow unlimited requests of such type, even after
 the user has used FedCM once. For this reason, any time that disconnection sends a credentialed
 request, at least one account is removed from the <a data-link-type="dfn" href="#connected-accounts-set" id="ref-for-connected-accounts-set①⑦">connected accounts set</a>, thus ensuring that
-this endpoint does not introduce a way for the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑦⑥">RP</a> to send requests to the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑨②">IDP</a> containing
+this endpoint does not introduce a way for the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑦⑤">RP</a> to send requests to the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑨②">IDP</a> containing
 the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑨③">IDP</a> cookies forever.</p>
    </ul>
    <h3 class="heading settled" data-level="7.3" id="attack-scenarios"><span class="secno">7.3. </span><span class="content">Attack Scenarios</span><a class="self-link" href="#attack-scenarios"></a></h3>
@@ -3390,16 +3433,16 @@ <h3 class="heading settled" data-level="7.3" id="attack-scenarios"><span class="
 It considers the possibilities when:</p>
    <ul>
     <li data-md>
-     <p>The <a data-link-type="dfn" href="#rp" id="ref-for-rp⑦⑦">RP</a> is collecting information,</p>
+     <p>The <a data-link-type="dfn" href="#rp" id="ref-for-rp⑦⑥">RP</a> is collecting information,</p>
     <li data-md>
      <p>The <a data-link-type="dfn" href="#idp" id="ref-for-idp⑨④">IDP</a> is collecting information, or</p>
     <li data-md>
-     <p>Both the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑦⑧">RP</a> and the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑨⑤">IDP</a> are colluding.</p>
+     <p>Both the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑦⑦">RP</a> and the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑨⑤">IDP</a> are colluding.</p>
    </ul>
    <p>For the purposes of this section, a principal is considered to be participating in the collection of
 information if it directly or indirectly performs actions with the aim of realizing one of the above
 threats.</p>
-   <p class="note" role="note"><span class="marker">Note:</span> An example of indirect collusion would be an <a data-link-type="dfn" href="#rp" id="ref-for-rp⑦⑨">RP</a> importing a script supplied by an <a data-link-type="dfn" href="#idp" id="ref-for-idp⑨⑥">IDP</a> where the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑨⑦">IDP</a> intends to track users.</p>
+   <p class="note" role="note"><span class="marker">Note:</span> An example of indirect collusion would be an <a data-link-type="dfn" href="#rp" id="ref-for-rp⑦⑧">RP</a> importing a script supplied by an <a data-link-type="dfn" href="#idp" id="ref-for-idp⑨⑥">IDP</a> where the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑨⑦">IDP</a> intends to track users.</p>
    <p>For the purpose of discussion, this document assumes that third-party cookies are <strong>disabled</strong> by
 default and are no longer effective for use in tracking mechanisms, and also some form of
 mitigations are implemented against ‘bounce tracking’ using link decoration or postMessage. Most of
@@ -3420,12 +3463,12 @@ <h4 class="heading settled" data-level="7.3.1" id="manifest-fingerprinting"><spa
 </pre>
    </div>
    <p class="note" role="note"><span class="marker">NOTE:</span> You can read more about the attack described <a href="https://github.com/fedidcg/FedCM/issues/230#issuecomment-1067029200">here</a>.</p>
-   <p>Here, the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑧⓪">RP</a> includes identifies itself when fetching the manifest from the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑨⑧">IDP</a>. This
+   <p>Here, the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑦⑨">RP</a> includes identifies itself when fetching the manifest from the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑨⑧">IDP</a>. This
 coupled with the credentialed fetches that the FedCM API performs would enable the <a data-link-type="dfn" href="#idp" id="ref-for-idp⑨⑨">IDP</a> to easily
 track the website that the user is visiting, without requiring any permission from the user. Our
 mitigation to this problem is to use the <a href="#idp-api-well-known">§ 3.1 The Well-Known File</a> file. The existence of a file at
 the root of the <a data-link-type="dfn" href="#idp" id="ref-for-idp①⓪⓪">IDP</a>'s domain is enforced to ensure that the file name does not introduce
-fingerprints about the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑧①">RP</a> being visited.</p>
+fingerprints about the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑧⓪">RP</a> being visited.</p>
    <p>The whole manifest could be in this location, but instead it only points to the real
 manifest from there. This allows the flexibility in the future to allow a small constant
 number of manifests, should an <a data-link-type="dfn" href="#idp" id="ref-for-idp①⓪①">IDP</a> require this in the future, instead of just a single one. It
@@ -3433,7 +3476,7 @@ <h4 class="heading settled" data-level="7.3.1" id="manifest-fingerprinting"><spa
 be performed on a file located anywhere, as opposed to the root of the domain, which may have more
 constraints in terms of ease of update.</p>
    <h4 class="heading settled" data-level="7.3.2" id="timing-attacks"><span class="secno">7.3.2. </span><span class="content">Timing Attacks</span><a class="self-link" href="#timing-attacks"></a></h4>
-   <p>In the timing attack, the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑧②">RP</a> and <a data-link-type="dfn" href="#idp" id="ref-for-idp①⓪③">IDP</a> collude to allow the <a data-link-type="dfn" href="#idp" id="ref-for-idp①⓪④">IDP</a> to compute the (<a data-link-type="dfn" href="#rp" id="ref-for-rp⑧③">RP</a>'s
+   <p>In the timing attack, the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑧①">RP</a> and <a data-link-type="dfn" href="#idp" id="ref-for-idp①⓪③">IDP</a> collude to allow the <a data-link-type="dfn" href="#idp" id="ref-for-idp①⓪④">IDP</a> to compute the (<a data-link-type="dfn" href="#rp" id="ref-for-rp⑧②">RP</a>'s
 origin, <a data-link-type="dfn" href="#idp" id="ref-for-idp①⓪⑤">IDP</a>'s user identity) pair without the user’s permission. This attack is not deterministic:
 there is room for statistical error because it requires stitching together two separate pieces of
 information to track the user. However, it is important to mitigate this attack and ensure that
@@ -3446,11 +3489,11 @@ <h4 class="heading settled" data-level="7.3.2" id="timing-attacks"><span class="
    <p>The attack is as follows:</p>
    <ol>
     <li data-md>
-     <p>The <a data-link-type="dfn" href="#rp" id="ref-for-rp⑧④">RP</a> logs the time at which it invokes the API, time A and sends it to the <a data-link-type="dfn" href="#idp" id="ref-for-idp①⓪⑥">IDP</a> to
-learn itself by marking the time in which it receives the fetch for the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑧⑤">RP</a>'s client
+     <p>The <a data-link-type="dfn" href="#rp" id="ref-for-rp⑧③">RP</a> logs the time at which it invokes the API, time A and sends it to the <a data-link-type="dfn" href="#idp" id="ref-for-idp①⓪⑥">IDP</a> to
+learn itself by marking the time in which it receives the fetch for the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑧④">RP</a>'s client
 metadata. Time A is tied to the site.</p>
     <li data-md>
-     <p>A credentialed request is sent to the <a data-link-type="dfn" href="#idp" id="ref-for-idp①⓪⑦">IDP</a> that does not explicitly identify the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑧⑥">RP</a>, but
+     <p>A credentialed request is sent to the <a data-link-type="dfn" href="#idp" id="ref-for-idp①⓪⑦">IDP</a> that does not explicitly identify the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑧⑤">RP</a>, but
 it is sent around a time that is close enough to the request above. The <a data-link-type="dfn" href="#idp" id="ref-for-idp①⓪⑧">IDP</a> notes the time
 in which this request has arrived, time B. Time B is tied to the user identity.</p>
     <li data-md>
@@ -3474,9 +3517,9 @@ <h4 class="heading settled" data-level="7.3.3" id="idp-intrusion"><span class="s
 Intrusion can thwart individuals' desires to be left alone, sap their time or attention, or
 interrupt their activities.</p>
    </blockquote>
-   <p>In the context of federation, intrusion happens when an <a data-link-type="dfn" href="#rp" id="ref-for-rp⑧⑦">RP</a> and an <a data-link-type="dfn" href="#idp" id="ref-for-idp①①①">IDP</a> are colluding to
+   <p>In the context of federation, intrusion happens when an <a data-link-type="dfn" href="#rp" id="ref-for-rp⑧⑥">RP</a> and an <a data-link-type="dfn" href="#idp" id="ref-for-idp①①①">IDP</a> are colluding to
 invasively and aggressively recommend the user to login disproportionally to the their intent. Much
-like unsolicited notifications, an <a data-link-type="dfn" href="#rp" id="ref-for-rp⑧⑧">RP</a> can collude with an <a data-link-type="dfn" href="#idp" id="ref-for-idp①①②">IDP</a> to aggressively log users in.</p>
+like unsolicited notifications, an <a data-link-type="dfn" href="#rp" id="ref-for-rp⑧⑦">RP</a> can collude with an <a data-link-type="dfn" href="#idp" id="ref-for-idp①①②">IDP</a> to aggressively log users in.</p>
    <p>The <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#user-agent" id="ref-for-user-agent②⑥">user agent</a> can mitigate this by mediating the user controls and offering them proportionally
 to the intent of the user or the privacy risks involved. For example, a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#user-agent" id="ref-for-user-agent②⑦">user agent</a> can choose to
 show a loud / disruptive modal mediated dialog when it has enough confidence of the user’s intent or
@@ -3610,7 +3653,7 @@ <h4 class="heading settled" data-level="7.3.3" id="idp-intrusion"><span class="s
     </svg>
    </div>
    <h4 class="heading settled" data-level="7.3.4" id="attack-scenarios-by-rp-cross-site-correlation"><span class="secno">7.3.4. </span><span class="content">Cross-Site Correlation</span><a class="self-link" href="#attack-scenarios-by-rp-cross-site-correlation"></a></h4>
-   <p>This attack happens when multiple <a data-link-type="dfn" href="#rp" id="ref-for-rp⑧⑨">RP</a>s collude to use their user’s data to correlate them and
+   <p>This attack happens when multiple <a data-link-type="dfn" href="#rp" id="ref-for-rp⑧⑧">RP</a>s collude to use their user’s data to correlate them and
 build a richer profile. When a user willingly provides their full name, email address, phone number,
 etc, to multiple relying parties, those relying parties can collaborate to build a profile of that
 user and their activity across collaborating sites. Sometimes this is referred to as joining
@@ -3770,12 +3813,12 @@ <h4 class="heading settled" data-level="7.3.4" id="attack-scenarios-by-rp-cross-
       <p>User is surprised that RP2 knows that they are shopping for wedding rings.</p>
     </ol>
    </div>
-   <p>The problem of <a data-link-type="dfn" href="#rp" id="ref-for-rp⑨⓪">RP</a>s joining user data via back-channels is inherent to the proliferation of
+   <p>The problem of <a data-link-type="dfn" href="#rp" id="ref-for-rp⑧⑨">RP</a>s joining user data via back-channels is inherent to the proliferation of
 identifying user data. This can be solved by issuing directed identifiers that provide an
 effective handle to a user’s identity with a given <a data-link-type="dfn" href="#idp" id="ref-for-idp①①④">IDP</a> that is unique and therefore cannot be
-correlated with other <a data-link-type="dfn" href="#rp" id="ref-for-rp⑨①">RP</a>s. In the past, there have been schemes to accomplish this using one-way
-hashes of, for example, the user’s name, the <a data-link-type="dfn" href="#idp" id="ref-for-idp①①⑤">IDP</a>, and the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑨②">RP</a>. These identifiers would be
-unique, and hence it would not be possible to correlate these with other <a data-link-type="dfn" href="#rp" id="ref-for-rp⑨③">RP</a>s.</p>
+correlated with other <a data-link-type="dfn" href="#rp" id="ref-for-rp⑨⓪">RP</a>s. In the past, there have been schemes to accomplish this using one-way
+hashes of, for example, the user’s name, the <a data-link-type="dfn" href="#idp" id="ref-for-idp①①⑤">IDP</a>, and the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑨①">RP</a>. These identifiers would be
+unique, and hence it would not be possible to correlate these with other <a data-link-type="dfn" href="#rp" id="ref-for-rp⑨②">RP</a>s.</p>
    <div class="image">
     <svg height="100%" style="fill-rule:evenodd;clip-rule:evenodd;stroke-linejoin:round;stroke-miterlimit:10;" version="1.1" viewBox="0 0 10667 8000" width="100%" xmlns="http://www.w3.org/2000/svg">
      <g transform="matrix(8.33333,0,0,8.33333,0,0)">
@@ -3986,16 +4029,16 @@ <h4 class="heading settled" data-level="7.3.4" id="attack-scenarios-by-rp-cross-
     </svg>
    </div>
    <h4 class="heading settled" data-level="7.3.5" id="unauthorized-data-usage"><span class="secno">7.3.5. </span><span class="content">Unauthorized Data Usage</span><a class="self-link" href="#unauthorized-data-usage"></a></h4>
-   <p>Another attack is when the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑨④">RP</a> or <a data-link-type="dfn" href="#idp" id="ref-for-idp①①⑥">IDP</a> uses user information for purposes not authorized by
-the user. When the user agrees to allow the <a data-link-type="dfn" href="#idp" id="ref-for-idp①①⑦">IDP</a> to provide information to the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑨⑤">RP</a>, the
-permission is specific to certain purposes, such as sign-in and personalization. For instance, the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑨⑥">RP</a> might use that data for other purposes that the user would not expect and did not authorize,
+   <p>Another attack is when the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑨③">RP</a> or <a data-link-type="dfn" href="#idp" id="ref-for-idp①①⑥">IDP</a> uses user information for purposes not authorized by
+the user. When the user agrees to allow the <a data-link-type="dfn" href="#idp" id="ref-for-idp①①⑦">IDP</a> to provide information to the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑨④">RP</a>, the
+permission is specific to certain purposes, such as sign-in and personalization. For instance, the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑨⑤">RP</a> might use that data for other purposes that the user would not expect and did not authorize,
 such as selling email addresses to a spam list. Spamming risk can exist even when using
 directed identifiers.</p>
    <h4 class="heading settled" data-level="7.3.6" id="rp-fingerprinting"><span class="secno">7.3.6. </span><span class="content">RP Fingerprinting</span><a class="self-link" href="#rp-fingerprinting"></a></h4>
-   <p>This attack happens when the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑨⑦">RP</a> employs client state-based tracking to identify user. Any
+   <p>This attack happens when the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑨⑥">RP</a> employs client state-based tracking to identify user. Any
 API that exposes any kind of client state to the web risk becoming a vector for fingerprinting. The
-purpose of this API is for the user to provide identification to the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑨⑧">RP</a>. And the user should be
-able to rescind the access to that identification, for instance by logging out. However, a tracking <a data-link-type="dfn" href="#rp" id="ref-for-rp⑨⑨">RP</a> could keep state to detect the user that was previously logged in:</p>
+purpose of this API is for the user to provide identification to the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑨⑦">RP</a>. And the user should be
+able to rescind the access to that identification, for instance by logging out. However, a tracking <a data-link-type="dfn" href="#rp" id="ref-for-rp⑨⑧">RP</a> could keep state to detect the user that was previously logged in:</p>
    <div class="image">
     <svg height="100%" style="fill-rule:evenodd;clip-rule:evenodd;stroke-linejoin:round;stroke-miterlimit:10;" version="1.1" viewBox="0 0 3334 2500" width="100%" xmlns="http://www.w3.org/2000/svg">
      <g transform="matrix(4.16667,0,0,4.16667,0,0)">
@@ -4055,7 +4098,7 @@ <h4 class="heading settled" data-level="7.3.7" id="secondary-use"><span class="s
 could be used, for example, to serve targeted advertisements to those users browsing on sites that
 the IDP controls.</p>
    <p>This risk can exist even in the case where the <a data-link-type="dfn" href="#idp" id="ref-for-idp①②⓪">IDP</a> does not having pre-existing user account
-information (for instance, if it is not a _bona fide_ IDP), because FedCM requests sent to the <a data-link-type="dfn" href="#idp" id="ref-for-idp①②①">IDP</a> are credentialed. This is more likely to occur if the <a data-link-type="dfn" href="#rp" id="ref-for-rp①⓪⓪">RP</a> is colluding with the <a data-link-type="dfn" href="#idp" id="ref-for-idp①②②">IDP</a> to enable tracking via <a href="#timing-attacks">§ 7.3.2 Timing Attacks</a>.</p>
+information (for instance, if it is not a _bona fide_ IDP), because FedCM requests sent to the <a data-link-type="dfn" href="#idp" id="ref-for-idp①②①">IDP</a> are credentialed. This is more likely to occur if the <a data-link-type="dfn" href="#rp" id="ref-for-rp⑨⑨">RP</a> is colluding with the <a data-link-type="dfn" href="#idp" id="ref-for-idp①②②">IDP</a> to enable tracking via <a href="#timing-attacks">§ 7.3.2 Timing Attacks</a>.</p>
    <div class="image">
     <svg height="100%" style="fill-rule:evenodd;clip-rule:evenodd;stroke-linejoin:round;stroke-miterlimit:10;" version="1.1" viewBox="0 0 10667 8000" width="100%" xmlns="http://www.w3.org/2000/svg">
      <g transform="matrix(8.33333,0,0,8.33333,0,0)">
@@ -4180,9 +4223,9 @@ <h4 class="heading settled" data-level="7.3.7" id="secondary-use"><span class="s
 married.</p>
     </ol>
    </div>
-   <p>Preventing tracking of users by the <a data-link-type="dfn" href="#idp" id="ref-for-idp①②⑨">IDP</a> is difficult: the <a data-link-type="dfn" href="#rp" id="ref-for-rp①⓪①">RP</a> has to be coded into the
+   <p>Preventing tracking of users by the <a data-link-type="dfn" href="#idp" id="ref-for-idp①②⑨">IDP</a> is difficult: the <a data-link-type="dfn" href="#rp" id="ref-for-rp①⓪⓪">RP</a> has to be coded into the
 identity token for security reasons, such as token reuse and fraud and abuse prevention. There have
-been cryptographic schemes developed to blind the <a data-link-type="dfn" href="#idp" id="ref-for-idp①③⓪">IDP</a> to the <a data-link-type="dfn" href="#rp" id="ref-for-rp①⓪②">RP</a> while still
+been cryptographic schemes developed to blind the <a data-link-type="dfn" href="#idp" id="ref-for-idp①③⓪">IDP</a> to the <a data-link-type="dfn" href="#rp" id="ref-for-rp①⓪①">RP</a> while still
 preventing token reuse(see Mozilla’s <a href="https://wiki.mozilla.org/Identity/Persona_AAR">personas</a>).
 These schemes have not been adopted by this specification.</p>
    <div class="image">
@@ -4377,6 +4420,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li><a href="#dom-identityprovideraccountlist-accounts">accounts</a><span>, in § 2.2.6</span>
    <li><a href="#accounts-endpoint">accounts endpoint</a><span>, in § 3.3</span>
    <li><a href="#dom-identityproviderapiconfig-accounts_endpoint">accounts_endpoint</a><span>, in § 3.2</span>
+   <li><a href="#dom-identitycredentialrequestoptionsmode-active">"active"</a><span>, in § 2.2.2</span>
    <li><a href="#dom-identityprovideraccount-approved_clients">approved_clients</a><span>, in § 3.3</span>
    <li><a href="#attempt-to-disconnect">attempt to disconnect</a><span>, in § 2.2.1</span>
    <li><a href="#auto-reauthenticated">auto-reauthenticated</a><span>, in § 2.2.4</span>
@@ -4428,6 +4472,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li><a href="#fetch-the-accounts">fetch the accounts</a><span>, in § 2.2.6</span>
    <li><a href="#fetch-the-client-metadata">fetch the client metadata</a><span>, in § 2.2.8</span>
    <li><a href="#fetch-the-config-file">fetch the config file</a><span>, in § 2.2.5</span>
+   <li><a href="#fetch-the-config-file-and-show-an-idp-login-dialog">fetch the config file and show an IDP login dialog</a><span>, in § 2.2.9</span>
    <li><a href="#dom-identityprovider-getuserinfo">getUserInfo(config)</a><span>, in § 2.3</span>
    <li><a href="#dom-identityprovideraccount-given_name">given_name</a><span>, in § 3.3</span>
    <li><a href="#dom-identityuserinfo-givenname">givenName</a><span>, in § 2.3</span>
@@ -4440,6 +4485,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li><a href="#dictdef-identitycredentialdisconnectoptions">IdentityCredentialDisconnectOptions</a><span>, in § 2.2</span>
    <li><a href="#dictdef-identitycredentialrequestoptions">IdentityCredentialRequestOptions</a><span>, in § 2.2.2</span>
    <li><a href="#enumdef-identitycredentialrequestoptionscontext">IdentityCredentialRequestOptionsContext</a><span>, in § 2.2.2</span>
+   <li><a href="#enumdef-identitycredentialrequestoptionsmode">IdentityCredentialRequestOptionsMode</a><span>, in § 2.2.2</span>
    <li><a href="#identity-credentials-get">identity-credentials-get</a><span>, in § 4</span>
    <li><a href="#identityprovider">IdentityProvider</a><span>, in § 2.3</span>
    <li><a href="#dictdef-identityprovideraccount">IdentityProviderAccount</a><span>, in § 2.2.6</span>
@@ -4459,6 +4505,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li><a href="#dom-identityprovideraccount-login_hints">login_hints</a><span>, in § 3.3</span>
    <li><a href="#dom-identityproviderapiconfig-login_url">login_url</a><span>, in § 2.2.5</span>
    <li><a href="#mismatch-dialog-step">Mismatch dialog step</a><span>, in § 2.2.4</span>
+   <li><a href="#dom-identitycredentialrequestoptions-mode">mode</a><span>, in § 2.2.2</span>
    <li>
     name
     <ul>
@@ -4469,6 +4516,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li><a href="#dom-identityproviderrequestoptions-nonce">nonce</a><span>, in § 2.2.2</span>
    <li><a href="#dom-identityproviderrequestoptions-params">params</a><span>, in § 2.2.2</span>
    <li><a href="#parse-url">parse url</a><span>, in § 2.2.9</span>
+   <li><a href="#dom-identitycredentialrequestoptionsmode-passive">"passive"</a><span>, in § 2.2.2</span>
    <li>
     picture
     <ul>
@@ -4618,6 +4666,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
      <li><span class="dfn-paneled" id="a23d12a9">scheme</span>
      <li><span class="dfn-paneled" id="bd736ec6">top-level traversable</span>
      <li><span class="dfn-paneled" id="30717154">top-level traversable <small>(for navigable)</small></span>
+     <li><span class="dfn-paneled" id="47fe679e">transient activation</span>
     </ul>
    <li>
     <a data-link-type="biblio">[INFRA]</a> defines the following terms:
@@ -4636,7 +4685,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
      <li><span class="dfn-paneled" id="692595fe">ordered set</span>
      <li><span class="dfn-paneled" id="83c1dbea">parse JSON bytes to a JavaScript value</span>
      <li><span class="dfn-paneled" id="99c988d6">remove</span>
-     <li><span class="dfn-paneled" id="da05c516">serializing a JavaScript value to a JSON string</span>
+     <li><span class="dfn-paneled" id="3685aee5">serialize a JavaScript value to a JSON string</span>
      <li><span class="dfn-paneled" id="0204d188">size</span>
      <li><span class="dfn-paneled" id="0698d556">string</span>
      <li><span class="dfn-paneled" id="6d19ac93">user agent</span>
@@ -4667,6 +4716,11 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
      <li><span class="dfn-paneled" id="96dabee7">potentially trustworthy origin</span>
      <li><span class="dfn-paneled" id="9c5d9c4d">potentially trustworthy URL</span>
     </ul>
+   <li>
+    <a data-link-type="biblio">[SERVICE-WORKERS]</a> defines the following terms:
+    <ul>
+     <li><span class="dfn-paneled" id="e2a51d55">active</span>
+    </ul>
    <li>
     <a data-link-type="biblio">[URL]</a> defines the following terms:
     <ul>
@@ -4767,6 +4821,8 @@ <h3 class="no-num no-ref heading settled" id="normative"><span class="content">N
    <dd>R. Fielding, Ed.; M. Nottingham, Ed.; J. Reschke, Ed.. <a href="https://httpwg.org/specs/rfc9110.html"><cite>HTTP Semantics</cite></a>. June 2022. Internet Standard. URL: <a href="https://httpwg.org/specs/rfc9110.html">https://httpwg.org/specs/rfc9110.html</a>
    <dt id="biblio-secure-contexts">[SECURE-CONTEXTS]
    <dd>Mike West. <a href="https://w3c.github.io/webappsec-secure-contexts/"><cite>Secure Contexts</cite></a>. URL: <a href="https://w3c.github.io/webappsec-secure-contexts/">https://w3c.github.io/webappsec-secure-contexts/</a>
+   <dt id="biblio-service-workers">[SERVICE-WORKERS]
+   <dd>Jake Archibald; Marijn Kruisselbrink. <a href="https://w3c.github.io/ServiceWorker/"><cite>Service Workers</cite></a>. URL: <a href="https://w3c.github.io/ServiceWorker/">https://w3c.github.io/ServiceWorker/</a>
    <dt id="biblio-url">[URL]
    <dd>Anne van Kesteren. <a href="https://url.spec.whatwg.org/"><cite>URL Standard</cite></a>. Living Standard. URL: <a href="https://url.spec.whatwg.org/">https://url.spec.whatwg.org/</a>
    <dt id="biblio-webdriver1">[WEBDRIVER1]
@@ -4814,9 +4870,15 @@ <h2 class="no-num no-ref heading settled" id="idl-index"><span class="content">I
   <a href="#dom-identitycredentialrequestoptionscontext-continue"><code><c- s>"continue"</c-></code></a>
 };
 
+<c- b>enum</c-> <a href="#enumdef-identitycredentialrequestoptionsmode"><code><c- g>IdentityCredentialRequestOptionsMode</c-></code></a> {
+  <a href="#dom-identitycredentialrequestoptionsmode-active"><code><c- s>"active"</c-></code></a>,
+  <a href="#dom-identitycredentialrequestoptionsmode-passive"><code><c- s>"passive"</c-></code></a>
+};
+
 <c- b>dictionary</c-> <a href="#dictdef-identitycredentialrequestoptions"><code><c- g>IdentityCredentialRequestOptions</c-></code></a> {
   <c- b>required</c-> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#dictdef-identityproviderrequestoptions"><c- n>IdentityProviderRequestOptions</c-></a>> <a data-type="sequence<IdentityProviderRequestOptions>" href="#dom-identitycredentialrequestoptions-providers"><code><c- g>providers</c-></code></a>;
   <a data-link-type="idl-name" href="#enumdef-identitycredentialrequestoptionscontext"><c- n>IdentityCredentialRequestOptionsContext</c-></a> <a data-default="&quot;signin&quot;" data-type="IdentityCredentialRequestOptionsContext" href="#dom-identitycredentialrequestoptions-context"><code><c- g>context</c-></code></a> = "signin";
+  <a data-link-type="idl-name" href="#enumdef-identitycredentialrequestoptionsmode"><c- n>IdentityCredentialRequestOptionsMode</c-></a> <a data-default="&quot;passive&quot;" data-type="IdentityCredentialRequestOptionsMode" href="#dom-identitycredentialrequestoptions-mode"><code><c- g>mode</c-></code></a> = "passive";
 };
 
 <c- b>dictionary</c-> <a href="#dictdef-identityproviderconfig"><code><c- g>IdentityProviderConfig</c-></code></a> {
@@ -4899,9 +4961,6 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 top-level’s state could be used and modified by the embedder, which introduces leaks and unwanted
 cross-origin communication. <a class="issue-return" href="#issue-d2fd6198" title="Jump to section">↵</a></div>
    <div class="issue"> Support choosing accounts from multiple <a data-link-type="dfn" href="#idp">IDP</a>s, as described <a href="https://github.com/fedidcg/FedCM/issues/319">here</a>. <a class="issue-return" href="#issue-ade48fb1" title="Jump to section">↵</a></div>
-   <div class="issue"> We should perhaps provide a way to let the <a data-link-type="dfn" href="#rp">RP</a> request that
-    the second option is provided, possibly gated on a user gesture.
-    See <a href="https://github.com/fedidcg/FedCM/issues/442">this issue</a> for discussion. <a class="issue-return" href="#issue-c651807c" title="Jump to section">↵</a></div>
    <div class="issue"> The spec is yet to be updated so that all <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request">requests</a> are created
 with <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-mode">mode</a> set to "user-agent-no-cors". See the relevant <a href="https://github.com/whatwg/fetch/pull/1533">pull request</a> for details. <a class="issue-return" href="#issue-8da66a63" title="Jump to section">↵</a></div>
    <div class="issue"> <a href="https://github.com/fedidcg/FedCM/issues/333">relax</a> the size of the
@@ -5141,11 +5200,12 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "1802ab9b": {"dfnID":"1802ab9b","dfnText":"matching capabilities","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-matching-capabilities"}],"title":"5.1. Extension capability"}],"url":"https://w3c.github.io/webdriver/#dfn-matching-capabilities"},
 "1ab127d6": {"dfnID":"1ab127d6","dfnText":"window","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-request-window"}],"title":"2.2.1.1. Disconnect request"},{"refs":[{"id":"ref-for-concept-request-window\u2460"},{"id":"ref-for-concept-request-window\u2461"}],"title":"2.2.5. Fetch the config file"},{"refs":[{"id":"ref-for-concept-request-window\u2462"},{"id":"ref-for-concept-request-window\u2463"}],"title":"2.2.6. Fetch the accounts"},{"refs":[{"id":"ref-for-concept-request-window\u2464"}],"title":"2.2.7. Fetch an identity assertion"},{"refs":[{"id":"ref-for-concept-request-window\u2465"}],"title":"2.2.8. Request permission to sign-up"}],"url":"https://fetch.spec.whatwg.org/#concept-request-window"},
 "218f0f24": {"dfnID":"218f0f24","dfnText":"hsl()","external":true,"refSections":[{"refs":[{"id":"ref-for-funcdef-hsl"}],"title":"3.2. The config file"}],"url":"https://drafts.csswg.org/css-color-4/#funcdef-hsl"},
-"228be966": {"dfnID":"228be966","dfnText":"navigable","external":true,"refSections":[{"refs":[{"id":"ref-for-window-navigable"},{"id":"ref-for-window-navigable\u2460"}],"title":"2.3. The IdentityProvider Interface"}],"url":"https://html.spec.whatwg.org/multipage/nav-history-apis.html#window-navigable"},
-"30717154": {"dfnID":"30717154","dfnText":"top-level traversable (for navigable)","external":true,"refSections":[{"refs":[{"id":"ref-for-nav-top"}],"title":"2.3. The IdentityProvider Interface"}],"url":"https://html.spec.whatwg.org/multipage/document-sequences.html#nav-top"},
+"228be966": {"dfnID":"228be966","dfnText":"navigable","external":true,"refSections":[{"refs":[{"id":"ref-for-window-navigable"}],"title":"2.2.4. Create an IdentityCredential"},{"refs":[{"id":"ref-for-window-navigable\u2460"},{"id":"ref-for-window-navigable\u2461"}],"title":"2.3. The IdentityProvider Interface"}],"url":"https://html.spec.whatwg.org/multipage/nav-history-apis.html#window-navigable"},
+"30717154": {"dfnID":"30717154","dfnText":"top-level traversable (for navigable)","external":true,"refSections":[{"refs":[{"id":"ref-for-nav-top"}],"title":"2.2.4. Create an IdentityCredential"},{"refs":[{"id":"ref-for-nav-top\u2460"}],"title":"2.3. The IdentityProvider Interface"}],"url":"https://html.spec.whatwg.org/multipage/document-sequences.html#nav-top"},
 "3349d69f": {"dfnID":"3349d69f","dfnText":"associated Document","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-document-window"},{"id":"ref-for-concept-document-window\u2460"}],"title":"2.1. The connected accounts set"},{"refs":[{"id":"ref-for-concept-document-window\u2461"},{"id":"ref-for-concept-document-window\u2462"}],"title":"2.2.1. The disconnect method"},{"refs":[{"id":"ref-for-concept-document-window\u2463"}],"title":"2.2.1.1. Disconnect request"},{"refs":[{"id":"ref-for-concept-document-window\u2464"}],"title":"2.2.5. Fetch the config file"},{"refs":[{"id":"ref-for-concept-document-window\u2465"}],"title":"2.2.7. Fetch an identity assertion"},{"refs":[{"id":"ref-for-concept-document-window\u2466"}],"title":"2.2.8. Request permission to sign-up"},{"refs":[{"id":"ref-for-concept-document-window\u2467"}],"title":"2.3. The IdentityProvider Interface"}],"url":"https://html.spec.whatwg.org/multipage/nav-history-apis.html#concept-document-window"},
 "3610bd67": {"dfnID":"3610bd67","dfnText":"allowed to use","external":true,"refSections":[{"refs":[{"id":"ref-for-allowed-to-use"}],"title":"2.2.1. The disconnect method"},{"refs":[{"id":"ref-for-allowed-to-use\u2460"}],"title":"2.3. The IdentityProvider Interface"},{"refs":[{"id":"ref-for-allowed-to-use\u2461"}],"title":"4. Permissions Policy Integration"}],"url":"https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use"},
 "36858240": {"dfnID":"36858240","dfnText":"boolean","external":true,"refSections":[{"refs":[{"id":"ref-for-boolean"}],"title":"5.1. Extension capability"}],"url":"https://infra.spec.whatwg.org/#boolean"},
+"3685aee5": {"dfnID":"3685aee5","dfnText":"serialize a JavaScript value to a JSON string","external":true,"refSections":[{"refs":[{"id":"ref-for-serialize-a-javascript-value-to-a-json-string"}],"title":"2.2.7. Fetch an identity assertion"}],"url":"https://infra.spec.whatwg.org/#serialize-a-javascript-value-to-a-json-string"},
 "36a75887": {"dfnID":"36a75887","dfnText":"extracting a MIME type","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-header-extract-mime-type"}],"title":"2.2.9. Helper algorithms"}],"url":"https://fetch.spec.whatwg.org/#concept-header-extract-mime-type"},
 "36f0fef5": {"dfnID":"36f0fef5","dfnText":"get the login status","external":true,"refSections":[{"refs":[{"id":"ref-for-get-the-login-status"}],"title":"2.2.4. Create an IdentityCredential"},{"refs":[{"id":"ref-for-get-the-login-status\u2460"}],"title":"2.2.9. Helper algorithms"}],"url":"https://w3c-fedid.github.io/login-status#get-the-login-status"},
 "3a711be7": {"dfnID":"3a711be7","dfnText":"scheme","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-url-scheme"},{"id":"ref-for-concept-url-scheme\u2460"},{"id":"ref-for-concept-url-scheme\u2461"}],"title":"2.2.5. Fetch the config file"}],"url":"https://url.spec.whatwg.org/#concept-url-scheme"},
@@ -5155,6 +5215,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "3d4e20bd": {"dfnID":"3d4e20bd","dfnText":"no such alert","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-no-such-alert"}],"title":"5.2. Cancel dialog"},{"refs":[{"id":"ref-for-dfn-no-such-alert\u2460"}],"title":"5.3. Select account"},{"refs":[{"id":"ref-for-dfn-no-such-alert\u2461"}],"title":"5.4. Click dialog button"},{"refs":[{"id":"ref-for-dfn-no-such-alert\u2462"}],"title":"5.5. Account list"},{"refs":[{"id":"ref-for-dfn-no-such-alert\u2463"}],"title":"5.6. Get title"},{"refs":[{"id":"ref-for-dfn-no-such-alert\u2464"}],"title":"5.7. Get dialog type"}],"url":"https://w3c.github.io/webdriver/#dfn-no-such-alert"},
 "3e12e042": {"dfnID":"3e12e042","dfnText":"environment settings object","external":true,"refSections":[{"refs":[{"id":"ref-for-environment-settings-object"}],"title":"2.2.3. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method"}],"url":"https://html.spec.whatwg.org/multipage/webappapis.html#environment-settings-object"},
 "43ac8374": {"dfnID":"43ac8374","dfnText":"origin (for environment settings object)","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-settings-object-origin"}],"title":"2.2.3. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method"}],"url":"https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin"},
+"47fe679e": {"dfnID":"47fe679e","dfnText":"transient activation","external":true,"refSections":[{"refs":[{"id":"ref-for-transient-activation"}],"title":"2.2.4. Create an IdentityCredential"}],"url":"https://html.spec.whatwg.org/multipage/interaction.html#transient-activation"},
 "48438eb3": {"dfnID":"48438eb3","dfnText":"queue a global task","external":true,"refSections":[{"refs":[{"id":"ref-for-queue-a-global-task"},{"id":"ref-for-queue-a-global-task\u2460"}],"title":"2.2.3. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method"},{"refs":[{"id":"ref-for-queue-a-global-task\u2461"},{"id":"ref-for-queue-a-global-task\u2462"},{"id":"ref-for-queue-a-global-task\u2463"}],"title":"2.2.9. Helper algorithms"}],"url":"https://html.spec.whatwg.org/multipage/webappapis.html#queue-a-global-task"},
 "4b84a0bc": {"dfnID":"4b84a0bc","dfnText":"name","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-header-name"}],"title":"2.2.1.1. Disconnect request"},{"refs":[{"id":"ref-for-concept-header-name\u2460"},{"id":"ref-for-concept-header-name\u2461"}],"title":"2.2.5. Fetch the config file"},{"refs":[{"id":"ref-for-concept-header-name\u2462"}],"title":"2.2.6. Fetch the accounts"},{"refs":[{"id":"ref-for-concept-header-name\u2463"}],"title":"2.2.7. Fetch an identity assertion"},{"refs":[{"id":"ref-for-concept-header-name\u2464"}],"title":"2.2.8. Request permission to sign-up"}],"url":"https://fetch.spec.whatwg.org/#concept-header-name"},
 "4be6272b": {"dfnID":"4be6272b","dfnText":"success","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-success"}],"title":"5.2. Cancel dialog"},{"refs":[{"id":"ref-for-dfn-success\u2460"}],"title":"5.3. Select account"},{"refs":[{"id":"ref-for-dfn-success\u2461"}],"title":"5.4. Click dialog button"},{"refs":[{"id":"ref-for-dfn-success\u2462"}],"title":"5.5. Account list"},{"refs":[{"id":"ref-for-dfn-success\u2463"}],"title":"5.6. Get title"},{"refs":[{"id":"ref-for-dfn-success\u2464"}],"title":"5.7. Get dialog type"},{"refs":[{"id":"ref-for-dfn-success\u2465"}],"title":"5.8. Set delay enabled"},{"refs":[{"id":"ref-for-dfn-success\u2466"}],"title":"5.9. Reset cooldown"}],"url":"https://w3c.github.io/webdriver/#dfn-success"},
@@ -5213,7 +5274,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "a3b18719": {"dfnID":"a3b18719","dfnText":"append (for set)","external":true,"refSections":[{"refs":[{"id":"ref-for-set-append"}],"title":"2.1. The connected accounts set"}],"url":"https://infra.spec.whatwg.org/#set-append"},
 "a41102eb": {"dfnID":"a41102eb","dfnText":"permissions policy","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-document-permissions-policy"}],"title":"2.2.3. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method"},{"refs":[{"id":"ref-for-concept-document-permissions-policy\u2460"}],"title":"4. Permissions Policy Integration"}],"url":"https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy"},
 "a4f8c442": {"dfnID":"a4f8c442","dfnText":"Sec-Fetch-Dest","external":true,"refSections":[{"refs":[{"id":"ref-for-http-headerdef-sec-fetch-dest"}],"title":"3.1. The Well-Known File"},{"refs":[{"id":"ref-for-http-headerdef-sec-fetch-dest\u2460"}],"title":"3.2. The config file"},{"refs":[{"id":"ref-for-http-headerdef-sec-fetch-dest\u2461"}],"title":"3.3. Accounts endpoint"},{"refs":[{"id":"ref-for-http-headerdef-sec-fetch-dest\u2462"}],"title":"3.4. Client Metadata"},{"refs":[{"id":"ref-for-http-headerdef-sec-fetch-dest\u2463"}],"title":"3.5. Identity assertion endpoint"},{"refs":[{"id":"ref-for-http-headerdef-sec-fetch-dest\u2464"}],"title":"3.6. Disconnect endpoint"},{"refs":[{"id":"ref-for-http-headerdef-sec-fetch-dest\u2465"}],"title":"6.2. Sec-Fetch-Dest Header"},{"refs":[{"id":"ref-for-http-headerdef-sec-fetch-dest\u2466"}],"title":"6.3. CORS Header"}],"url":"https://w3c.github.io/webappsec-fetch-metadata/#http-headerdef-sec-fetch-dest"},
-"a72449dd": {"dfnID":"a72449dd","dfnText":"in parallel","external":true,"refSections":[{"refs":[{"id":"ref-for-in-parallel"},{"id":"ref-for-in-parallel\u2460"}],"title":"2.2.1. The disconnect method"},{"refs":[{"id":"ref-for-in-parallel\u2461"}],"title":"2.2.3. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method"},{"refs":[{"id":"ref-for-in-parallel\u2462"}],"title":"2.2.4. Create an IdentityCredential"},{"refs":[{"id":"ref-for-in-parallel\u2463"}],"title":"2.2.8. Request permission to sign-up"},{"refs":[{"id":"ref-for-in-parallel\u2464"},{"id":"ref-for-in-parallel\u2465"},{"id":"ref-for-in-parallel\u2466"}],"title":"2.2.9. Helper algorithms"},{"refs":[{"id":"ref-for-in-parallel\u2467"}],"title":"2.3. The IdentityProvider Interface"},{"refs":[{"id":"ref-for-in-parallel\u2468"}],"title":"4. Permissions Policy Integration"}],"url":"https://html.spec.whatwg.org/multipage/infrastructure.html#in-parallel"},
+"a72449dd": {"dfnID":"a72449dd","dfnText":"in parallel","external":true,"refSections":[{"refs":[{"id":"ref-for-in-parallel"},{"id":"ref-for-in-parallel\u2460"}],"title":"2.2.1. The disconnect method"},{"refs":[{"id":"ref-for-in-parallel\u2461"}],"title":"2.2.3. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method"},{"refs":[{"id":"ref-for-in-parallel\u2462"}],"title":"2.2.4. Create an IdentityCredential"},{"refs":[{"id":"ref-for-in-parallel\u2463"}],"title":"2.2.8. Request permission to sign-up"},{"refs":[{"id":"ref-for-in-parallel\u2464"},{"id":"ref-for-in-parallel\u2465"},{"id":"ref-for-in-parallel\u2466"},{"id":"ref-for-in-parallel\u2467"}],"title":"2.2.9. Helper algorithms"},{"refs":[{"id":"ref-for-in-parallel\u2468"}],"title":"2.3. The IdentityProvider Interface"},{"refs":[{"id":"ref-for-in-parallel\u2460\u24ea"}],"title":"4. Permissions Policy Integration"}],"url":"https://html.spec.whatwg.org/multipage/infrastructure.html#in-parallel"},
 "abcb119a": {"dfnID":"abcb119a","dfnText":"[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credential-discoverfromexternalsource-slot"},{"id":"ref-for-dom-credential-discoverfromexternalsource-slot\u2460"}],"title":"2.2.3. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credential-discoverfromexternalsource-slot"},
 "accounts-endpoint": {"dfnID":"accounts-endpoint","dfnText":"accounts endpoint","external":false,"refSections":[{"refs":[{"id":"ref-for-accounts-endpoint"}],"title":"2.2.6. Fetch the accounts"},{"refs":[{"id":"ref-for-accounts-endpoint\u2460"}],"title":"2.3. The IdentityProvider Interface"},{"refs":[{"id":"ref-for-accounts-endpoint\u2461"}],"title":"3.3. Accounts endpoint"},{"refs":[{"id":"ref-for-accounts-endpoint\u2462"}],"title":"7.2. Network requests"}],"url":"#accounts-endpoint"},
 "ad09952f": {"dfnID":"ad09952f","dfnText":"[[discovery]]","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credential-discovery-slot"},{"id":"ref-for-dom-credential-discovery-slot\u2460"}],"title":"2.2. The IdentityCredential Interface"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credential-discovery-slot"},
@@ -5239,7 +5300,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "c1b65051": {"dfnID":"c1b65051","dfnText":"unknown","external":true,"refSections":[{"refs":[{"id":"ref-for-unknown"},{"id":"ref-for-unknown\u2460"}],"title":"2.2.4. Create an IdentityCredential"}],"url":"https://w3c-fedid.github.io/login-status#unknown"},
 "c1eab6d6": {"dfnID":"c1eab6d6","dfnText":"requires user mediation","external":true,"refSections":[{"refs":[{"id":"ref-for-origin-requires-user-mediation"}],"title":"2.2.4. Create an IdentityCredential"}],"url":"https://w3c.github.io/webappsec-credential-management/#origin-requires-user-mediation"},
 "c62cd7cf": {"dfnID":"c62cd7cf","dfnText":"origin","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-document-origin"},{"id":"ref-for-concept-document-origin\u2460"}],"title":"2.1. The connected accounts set"},{"refs":[{"id":"ref-for-concept-document-origin\u2461"}],"title":"2.2.1. The disconnect method"},{"refs":[{"id":"ref-for-concept-document-origin\u2462"}],"title":"2.2.1.1. Disconnect request"},{"refs":[{"id":"ref-for-concept-document-origin\u2463"}],"title":"2.2.5. Fetch the config file"},{"refs":[{"id":"ref-for-concept-document-origin\u2464"}],"title":"2.2.7. Fetch an identity assertion"},{"refs":[{"id":"ref-for-concept-document-origin\u2465"}],"title":"2.2.8. Request permission to sign-up"},{"refs":[{"id":"ref-for-concept-document-origin\u2466"}],"title":"2.3. The IdentityProvider Interface"}],"url":"https://dom.spec.whatwg.org/#concept-document-origin"},
-"c74f29b9": {"dfnID":"c74f29b9","dfnText":"NetworkError","external":true,"refSections":[{"refs":[{"id":"ref-for-networkerror"},{"id":"ref-for-networkerror\u2460"},{"id":"ref-for-networkerror\u2461"},{"id":"ref-for-networkerror\u2462"},{"id":"ref-for-networkerror\u2463"},{"id":"ref-for-networkerror\u2464"},{"id":"ref-for-networkerror\u2465"},{"id":"ref-for-networkerror\u2466"}],"title":"2.2.1. The disconnect method"},{"refs":[{"id":"ref-for-networkerror\u2467"},{"id":"ref-for-networkerror\u2468"}],"title":"2.2.3. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method"},{"refs":[{"id":"ref-for-networkerror\u2460\u24ea"},{"id":"ref-for-networkerror\u2460\u2460"},{"id":"ref-for-networkerror\u2460\u2461"}],"title":"2.2.9. Helper algorithms"},{"refs":[{"id":"ref-for-networkerror\u2460\u2462"},{"id":"ref-for-networkerror\u2460\u2463"},{"id":"ref-for-networkerror\u2460\u2464"},{"id":"ref-for-networkerror\u2460\u2465"},{"id":"ref-for-networkerror\u2460\u2466"},{"id":"ref-for-networkerror\u2460\u2467"}],"title":"2.3. The IdentityProvider Interface"}],"url":"https://webidl.spec.whatwg.org/#networkerror"},
+"c74f29b9": {"dfnID":"c74f29b9","dfnText":"NetworkError","external":true,"refSections":[{"refs":[{"id":"ref-for-networkerror"},{"id":"ref-for-networkerror\u2460"},{"id":"ref-for-networkerror\u2461"},{"id":"ref-for-networkerror\u2462"},{"id":"ref-for-networkerror\u2463"},{"id":"ref-for-networkerror\u2464"},{"id":"ref-for-networkerror\u2465"},{"id":"ref-for-networkerror\u2466"}],"title":"2.2.1. The disconnect method"},{"refs":[{"id":"ref-for-networkerror\u2467"},{"id":"ref-for-networkerror\u2468"}],"title":"2.2.3. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method"},{"refs":[{"id":"ref-for-networkerror\u2460\u24ea"}],"title":"2.2.4. Create an IdentityCredential"},{"refs":[{"id":"ref-for-networkerror\u2460\u2460"},{"id":"ref-for-networkerror\u2460\u2461"},{"id":"ref-for-networkerror\u2460\u2462"}],"title":"2.2.9. Helper algorithms"},{"refs":[{"id":"ref-for-networkerror\u2460\u2463"},{"id":"ref-for-networkerror\u2460\u2464"},{"id":"ref-for-networkerror\u2460\u2465"},{"id":"ref-for-networkerror\u2460\u2466"},{"id":"ref-for-networkerror\u2460\u2467"},{"id":"ref-for-networkerror\u2460\u2468"}],"title":"2.3. The IdentityProvider Interface"}],"url":"https://webidl.spec.whatwg.org/#networkerror"},
 "c8ff8493": {"dfnID":"c8ff8493","dfnText":"error code","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-error-code"}],"title":"5.1. Extension capability"},{"refs":[{"id":"ref-for-dfn-error-code\u2460"}],"title":"5.2. Cancel dialog"},{"refs":[{"id":"ref-for-dfn-error-code\u2461"},{"id":"ref-for-dfn-error-code\u2462"},{"id":"ref-for-dfn-error-code\u2463"}],"title":"5.3. Select account"},{"refs":[{"id":"ref-for-dfn-error-code\u2464"},{"id":"ref-for-dfn-error-code\u2465"},{"id":"ref-for-dfn-error-code\u2466"}],"title":"5.4. Click dialog button"},{"refs":[{"id":"ref-for-dfn-error-code\u2467"}],"title":"5.5. Account list"},{"refs":[{"id":"ref-for-dfn-error-code\u2468"}],"title":"5.6. Get title"},{"refs":[{"id":"ref-for-dfn-error-code\u2460\u24ea"}],"title":"5.7. Get dialog type"},{"refs":[{"id":"ref-for-dfn-error-code\u2460\u2460"},{"id":"ref-for-dfn-error-code\u2460\u2461"}],"title":"5.8. Set delay enabled"}],"url":"https://w3c.github.io/webdriver/#dfn-error-code"},
 "c9e7c11a": {"dfnID":"c9e7c11a","dfnText":"header","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-header"}],"title":"2.2.1.1. Disconnect request"},{"refs":[{"id":"ref-for-concept-header\u2460"},{"id":"ref-for-concept-header\u2461"}],"title":"2.2.5. Fetch the config file"},{"refs":[{"id":"ref-for-concept-header\u2462"}],"title":"2.2.6. Fetch the accounts"},{"refs":[{"id":"ref-for-concept-header\u2463"}],"title":"2.2.7. Fetch an identity assertion"},{"refs":[{"id":"ref-for-concept-header\u2464"}],"title":"2.2.8. Request permission to sign-up"}],"url":"https://fetch.spec.whatwg.org/#concept-header"},
 "ca3ca4ae": {"dfnID":"ca3ca4ae","dfnText":"URL parser","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-url-parser"},{"id":"ref-for-concept-url-parser\u2460"},{"id":"ref-for-concept-url-parser\u2461"}],"title":"2.2.9. Helper algorithms"}],"url":"https://url.spec.whatwg.org/#concept-url-parser"},
@@ -5265,9 +5326,8 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "d78cb661": {"dfnID":"d78cb661","dfnText":"validating capabilities","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-validate-capabilities"}],"title":"5.1. Extension capability"}],"url":"https://w3c.github.io/webdriver/#dfn-validate-capabilities"},
 "d7edb843": {"dfnID":"d7edb843","dfnText":"urlencoded serializer","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-urlencoded-serializer"}],"title":"2.2.1.1. Disconnect request"},{"refs":[{"id":"ref-for-concept-urlencoded-serializer\u2460"}],"title":"2.2.7. Fetch an identity assertion"},{"refs":[{"id":"ref-for-concept-urlencoded-serializer\u2461"}],"title":"2.2.9. Helper algorithms"}],"url":"https://url.spec.whatwg.org/#concept-urlencoded-serializer"},
 "d9070155": {"dfnID":"d9070155","dfnText":"CredentialRequestOptions","external":true,"refSections":[{"refs":[{"id":"ref-for-dictdef-credentialrequestoptions"},{"id":"ref-for-dictdef-credentialrequestoptions\u2460"}],"title":"2.2.2. The CredentialRequestOptions"},{"refs":[{"id":"ref-for-dictdef-credentialrequestoptions\u2461"}],"title":"2.2.3. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method"},{"refs":[{"id":"ref-for-dictdef-credentialrequestoptions\u2462"}],"title":"2.2.4. Create an IdentityCredential"}],"url":"https://w3c.github.io/webappsec-credential-management/#dictdef-credentialrequestoptions"},
-"da05c516": {"dfnID":"da05c516","dfnText":"serializing a JavaScript value to a JSON string","external":true,"refSections":[{"refs":[{"id":"ref-for-serialize-a-javascript-value-to-a-json-string"}],"title":"2.2.7. Fetch an identity assertion"}],"url":"https://infra.spec.whatwg.org/#serialize-a-javascript-value-to-a-json-string"},
 "dc1cd39b": {"dfnID":"dc1cd39b","dfnText":"URL","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-request-url"}],"title":"2.2.1.1. Disconnect request"},{"refs":[{"id":"ref-for-concept-request-url\u2460"},{"id":"ref-for-concept-request-url\u2461"}],"title":"2.2.5. Fetch the config file"},{"refs":[{"id":"ref-for-concept-request-url\u2462"},{"id":"ref-for-concept-request-url\u2463"}],"title":"2.2.6. Fetch the accounts"},{"refs":[{"id":"ref-for-concept-request-url\u2464"}],"title":"2.2.7. Fetch an identity assertion"},{"refs":[{"id":"ref-for-concept-request-url\u2465"}],"title":"2.2.8. Request permission to sign-up"}],"url":"https://fetch.spec.whatwg.org/#concept-request-url"},
-"dca2de17": {"dfnID":"dca2de17","dfnText":"DOMException","external":true,"refSections":[{"refs":[{"id":"ref-for-idl-DOMException"},{"id":"ref-for-idl-DOMException\u2460"},{"id":"ref-for-idl-DOMException\u2461"},{"id":"ref-for-idl-DOMException\u2462"},{"id":"ref-for-idl-DOMException\u2463"},{"id":"ref-for-idl-DOMException\u2464"},{"id":"ref-for-idl-DOMException\u2465"},{"id":"ref-for-idl-DOMException\u2466"},{"id":"ref-for-idl-DOMException\u2467"},{"id":"ref-for-idl-DOMException\u2468"}],"title":"2.2.1. The disconnect method"},{"refs":[{"id":"ref-for-idl-DOMException\u2460\u24ea"},{"id":"ref-for-idl-DOMException\u2460\u2460"}],"title":"2.2.3. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method"},{"refs":[{"id":"ref-for-idl-DOMException\u2460\u2461"},{"id":"ref-for-idl-DOMException\u2460\u2462"},{"id":"ref-for-idl-DOMException\u2460\u2463"}],"title":"2.2.9. Helper algorithms"},{"refs":[{"id":"ref-for-idl-DOMException\u2460\u2464"},{"id":"ref-for-idl-DOMException\u2460\u2465"},{"id":"ref-for-idl-DOMException\u2460\u2466"},{"id":"ref-for-idl-DOMException\u2460\u2467"},{"id":"ref-for-idl-DOMException\u2460\u2468"},{"id":"ref-for-idl-DOMException\u2461\u24ea"},{"id":"ref-for-idl-DOMException\u2461\u2460"},{"id":"ref-for-idl-DOMException\u2461\u2461"},{"id":"ref-for-idl-DOMException\u2461\u2462"}],"title":"2.3. The IdentityProvider Interface"},{"refs":[{"id":"ref-for-idl-DOMException\u2461\u2463"}],"title":"4. Permissions Policy Integration"}],"url":"https://webidl.spec.whatwg.org/#idl-DOMException"},
+"dca2de17": {"dfnID":"dca2de17","dfnText":"DOMException","external":true,"refSections":[{"refs":[{"id":"ref-for-idl-DOMException"},{"id":"ref-for-idl-DOMException\u2460"},{"id":"ref-for-idl-DOMException\u2461"},{"id":"ref-for-idl-DOMException\u2462"},{"id":"ref-for-idl-DOMException\u2463"},{"id":"ref-for-idl-DOMException\u2464"},{"id":"ref-for-idl-DOMException\u2465"},{"id":"ref-for-idl-DOMException\u2466"},{"id":"ref-for-idl-DOMException\u2467"},{"id":"ref-for-idl-DOMException\u2468"}],"title":"2.2.1. The disconnect method"},{"refs":[{"id":"ref-for-idl-DOMException\u2460\u24ea"},{"id":"ref-for-idl-DOMException\u2460\u2460"}],"title":"2.2.3. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method"},{"refs":[{"id":"ref-for-idl-DOMException\u2460\u2461"}],"title":"2.2.4. Create an IdentityCredential"},{"refs":[{"id":"ref-for-idl-DOMException\u2460\u2462"},{"id":"ref-for-idl-DOMException\u2460\u2463"},{"id":"ref-for-idl-DOMException\u2460\u2464"}],"title":"2.2.9. Helper algorithms"},{"refs":[{"id":"ref-for-idl-DOMException\u2460\u2465"},{"id":"ref-for-idl-DOMException\u2460\u2466"},{"id":"ref-for-idl-DOMException\u2460\u2467"},{"id":"ref-for-idl-DOMException\u2460\u2468"},{"id":"ref-for-idl-DOMException\u2461\u24ea"},{"id":"ref-for-idl-DOMException\u2461\u2460"},{"id":"ref-for-idl-DOMException\u2461\u2461"},{"id":"ref-for-idl-DOMException\u2461\u2462"},{"id":"ref-for-idl-DOMException\u2461\u2463"}],"title":"2.3. The IdentityProvider Interface"},{"refs":[{"id":"ref-for-idl-DOMException\u2461\u2464"}],"title":"4. Permissions Policy Integration"}],"url":"https://webidl.spec.whatwg.org/#idl-DOMException"},
 "dcffbccd": {"dfnID":"dcffbccd","dfnText":"URL","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-url"}],"title":"2.2.1.1. Disconnect request"},{"refs":[{"id":"ref-for-concept-url\u2460"}],"title":"2.2.5. Fetch the config file"},{"refs":[{"id":"ref-for-concept-url\u2461"},{"id":"ref-for-concept-url\u2462"}],"title":"2.2.9. Helper algorithms"}],"url":"https://url.spec.whatwg.org/#concept-url"},
 "ddf444bb": {"dfnID":"ddf444bb","dfnText":"origin","external":true,"refSections":[{"refs":[{"id":"ref-for-http-origin"}],"title":"3.1. The Well-Known File"},{"refs":[{"id":"ref-for-http-origin\u2460"}],"title":"3.2. The config file"},{"refs":[{"id":"ref-for-http-origin\u2461"}],"title":"3.3. Accounts endpoint"},{"refs":[{"id":"ref-for-http-origin\u2462"}],"title":"3.4. Client Metadata"},{"refs":[{"id":"ref-for-http-origin\u2463"},{"id":"ref-for-http-origin\u2464"},{"id":"ref-for-http-origin\u2465"}],"title":"3.5. Identity assertion endpoint"},{"refs":[{"id":"ref-for-http-origin\u2466"}],"title":"3.6. Disconnect endpoint"}],"url":"https://fetch.spec.whatwg.org/#http-origin"},
 "dictdef-disconnectedaccount": {"dfnID":"dictdef-disconnectedaccount","dfnText":"DisconnectedAccount","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-disconnectedaccount"}],"title":"2.2.1.1. Disconnect request"},{"refs":[{"id":"ref-for-dictdef-disconnectedaccount\u2460"}],"title":"3.6. Disconnect endpoint"}],"url":"#dictdef-disconnectedaccount"},
@@ -5278,7 +5338,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "dictdef-identityproviderapiconfig": {"dfnID":"dictdef-identityproviderapiconfig","dfnText":"IdentityProviderAPIConfig","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-identityproviderapiconfig"},{"id":"ref-for-dictdef-identityproviderapiconfig\u2460"}],"title":"2.2.5. Fetch the config file"},{"refs":[{"id":"ref-for-dictdef-identityproviderapiconfig\u2461"}],"title":"2.2.6. Fetch the accounts"},{"refs":[{"id":"ref-for-dictdef-identityproviderapiconfig\u2462"}],"title":"2.2.7. Fetch an identity assertion"},{"refs":[{"id":"ref-for-dictdef-identityproviderapiconfig\u2463"},{"id":"ref-for-dictdef-identityproviderapiconfig\u2464"}],"title":"2.2.8. Request permission to sign-up"},{"refs":[{"id":"ref-for-dictdef-identityproviderapiconfig\u2465"}],"title":"2.2.9. Helper algorithms"},{"refs":[{"id":"ref-for-dictdef-identityproviderapiconfig\u2466"},{"id":"ref-for-dictdef-identityproviderapiconfig\u2467"}],"title":"3.2. The config file"}],"url":"#dictdef-identityproviderapiconfig"},
 "dictdef-identityproviderbranding": {"dfnID":"dictdef-identityproviderbranding","dfnText":"IdentityProviderBranding","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-identityproviderbranding"}],"title":"2.2.5. Fetch the config file"},{"refs":[{"id":"ref-for-dictdef-identityproviderbranding\u2460"}],"title":"2.2.8. Request permission to sign-up"},{"refs":[{"id":"ref-for-dictdef-identityproviderbranding\u2461"},{"id":"ref-for-dictdef-identityproviderbranding\u2462"},{"id":"ref-for-dictdef-identityproviderbranding\u2463"}],"title":"3.2. The config file"}],"url":"#dictdef-identityproviderbranding"},
 "dictdef-identityproviderclientmetadata": {"dfnID":"dictdef-identityproviderclientmetadata","dfnText":"IdentityProviderClientMetadata","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-identityproviderclientmetadata"},{"id":"ref-for-dictdef-identityproviderclientmetadata\u2460"}],"title":"2.2.8. Request permission to sign-up"},{"refs":[{"id":"ref-for-dictdef-identityproviderclientmetadata\u2461"},{"id":"ref-for-dictdef-identityproviderclientmetadata\u2462"}],"title":"3.4. Client Metadata"}],"url":"#dictdef-identityproviderclientmetadata"},
-"dictdef-identityproviderconfig": {"dfnID":"dictdef-identityproviderconfig","dfnText":"IdentityProviderConfig","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-identityproviderconfig"},{"id":"ref-for-dictdef-identityproviderconfig\u2460"},{"id":"ref-for-dictdef-identityproviderconfig\u2461"},{"id":"ref-for-dictdef-identityproviderconfig\u2462"}],"title":"2.1. The connected accounts set"},{"refs":[{"id":"ref-for-dictdef-identityproviderconfig\u2463"}],"title":"2.2. The IdentityCredential Interface"},{"refs":[{"id":"ref-for-dictdef-identityproviderconfig\u2464"},{"id":"ref-for-dictdef-identityproviderconfig\u2465"},{"id":"ref-for-dictdef-identityproviderconfig\u2466"}],"title":"2.2.2. The CredentialRequestOptions"},{"refs":[{"id":"ref-for-dictdef-identityproviderconfig\u2467"}],"title":"2.2.9. Helper algorithms"},{"refs":[{"id":"ref-for-dictdef-identityproviderconfig\u2468"},{"id":"ref-for-dictdef-identityproviderconfig\u2460\u24ea"}],"title":"2.3. The IdentityProvider Interface"}],"url":"#dictdef-identityproviderconfig"},
+"dictdef-identityproviderconfig": {"dfnID":"dictdef-identityproviderconfig","dfnText":"IdentityProviderConfig","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-identityproviderconfig"},{"id":"ref-for-dictdef-identityproviderconfig\u2460"},{"id":"ref-for-dictdef-identityproviderconfig\u2461"},{"id":"ref-for-dictdef-identityproviderconfig\u2462"}],"title":"2.1. The connected accounts set"},{"refs":[{"id":"ref-for-dictdef-identityproviderconfig\u2463"}],"title":"2.2. The IdentityCredential Interface"},{"refs":[{"id":"ref-for-dictdef-identityproviderconfig\u2464"},{"id":"ref-for-dictdef-identityproviderconfig\u2465"},{"id":"ref-for-dictdef-identityproviderconfig\u2466"}],"title":"2.2.2. The CredentialRequestOptions"},{"refs":[{"id":"ref-for-dictdef-identityproviderconfig\u2467"},{"id":"ref-for-dictdef-identityproviderconfig\u2468"}],"title":"2.2.9. Helper algorithms"},{"refs":[{"id":"ref-for-dictdef-identityproviderconfig\u2460\u24ea"},{"id":"ref-for-dictdef-identityproviderconfig\u2460\u2460"}],"title":"2.3. The IdentityProvider Interface"}],"url":"#dictdef-identityproviderconfig"},
 "dictdef-identityprovidericon": {"dfnID":"dictdef-identityprovidericon","dfnText":"IdentityProviderIcon","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-identityprovidericon"}],"title":"2.2.5. Fetch the config file"},{"refs":[{"id":"ref-for-dictdef-identityprovidericon\u2460"},{"id":"ref-for-dictdef-identityprovidericon\u2461"},{"id":"ref-for-dictdef-identityprovidericon\u2462"}],"title":"3.2. The config file"}],"url":"#dictdef-identityprovidericon"},
 "dictdef-identityproviderrequestoptions": {"dfnID":"dictdef-identityproviderrequestoptions","dfnText":"IdentityProviderRequestOptions","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-identityproviderrequestoptions"}],"title":"2.2.2. The CredentialRequestOptions"},{"refs":[{"id":"ref-for-dictdef-identityproviderrequestoptions\u2460"}],"title":"2.2.4. Create an IdentityCredential"},{"refs":[{"id":"ref-for-dictdef-identityproviderrequestoptions\u2461"}],"title":"2.2.5. Fetch the config file"},{"refs":[{"id":"ref-for-dictdef-identityproviderrequestoptions\u2462"}],"title":"2.2.6. Fetch the accounts"},{"refs":[{"id":"ref-for-dictdef-identityproviderrequestoptions\u2463"}],"title":"2.2.7. Fetch an identity assertion"},{"refs":[{"id":"ref-for-dictdef-identityproviderrequestoptions\u2464"},{"id":"ref-for-dictdef-identityproviderrequestoptions\u2465"}],"title":"2.2.8. Request permission to sign-up"},{"refs":[{"id":"ref-for-dictdef-identityproviderrequestoptions\u2466"}],"title":"2.2.9. Helper algorithms"},{"refs":[{"id":"ref-for-dictdef-identityproviderrequestoptions\u2467"}],"title":"5.5. Account list"}],"url":"#dictdef-identityproviderrequestoptions"},
 "dictdef-identityprovidertoken": {"dfnID":"dictdef-identityprovidertoken","dfnText":"IdentityProviderToken","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-identityprovidertoken"}],"title":"2.2.7. Fetch an identity assertion"},{"refs":[{"id":"ref-for-dictdef-identityprovidertoken\u2460"},{"id":"ref-for-dictdef-identityprovidertoken\u2461"}],"title":"3.5. Identity assertion endpoint"}],"url":"#dictdef-identityprovidertoken"},
@@ -5303,11 +5363,14 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "dom-identitycredential-token": {"dfnID":"dom-identitycredential-token","dfnText":"token","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-identitycredential-token"},{"id":"ref-for-dom-identitycredential-token\u2460"}],"title":"2.2. The IdentityCredential Interface"},{"refs":[{"id":"ref-for-dom-identitycredential-token\u2461"}],"title":"2.2.7. Fetch an identity assertion"}],"url":"#dom-identitycredential-token"},
 "dom-identitycredentialdisconnectoptions-accounthint": {"dfnID":"dom-identitycredentialdisconnectoptions-accounthint","dfnText":"accountHint","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-identitycredentialdisconnectoptions-accounthint"}],"title":"2.2.1.1. Disconnect request"}],"url":"#dom-identitycredentialdisconnectoptions-accounthint"},
 "dom-identitycredentialrequestoptions-context": {"dfnID":"dom-identitycredentialrequestoptions-context","dfnText":"context","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-identitycredentialrequestoptions-context"}],"title":"2.2.4. Create an IdentityCredential"},{"refs":[{"id":"ref-for-dom-identitycredentialrequestoptions-context\u2460"}],"title":"2.2.8. Request permission to sign-up"},{"refs":[{"id":"ref-for-dom-identitycredentialrequestoptions-context"}],"title":"5.6. Get title"}],"url":"#dom-identitycredentialrequestoptions-context"},
+"dom-identitycredentialrequestoptions-mode": {"dfnID":"dom-identitycredentialrequestoptions-mode","dfnText":"mode","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-identitycredentialrequestoptions-mode"},{"id":"ref-for-dom-identitycredentialrequestoptions-mode\u2460"}],"title":"2.2.4. Create an IdentityCredential"},{"refs":[{"id":"ref-for-dom-identitycredentialrequestoptions-mode\u2461"}],"title":"2.2.8. Request permission to sign-up"}],"url":"#dom-identitycredentialrequestoptions-mode"},
 "dom-identitycredentialrequestoptions-providers": {"dfnID":"dom-identitycredentialrequestoptions-providers","dfnText":"providers","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-identitycredentialrequestoptions-providers"},{"id":"ref-for-dom-identitycredentialrequestoptions-providers\u2460"}],"title":"2.2.3. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method"}],"url":"#dom-identitycredentialrequestoptions-providers"},
 "dom-identitycredentialrequestoptionscontext-continue": {"dfnID":"dom-identitycredentialrequestoptionscontext-continue","dfnText":"\"continue\"","external":false,"refSections":[],"url":"#dom-identitycredentialrequestoptionscontext-continue"},
 "dom-identitycredentialrequestoptionscontext-signin": {"dfnID":"dom-identitycredentialrequestoptionscontext-signin","dfnText":"\"signin\"","external":false,"refSections":[],"url":"#dom-identitycredentialrequestoptionscontext-signin"},
 "dom-identitycredentialrequestoptionscontext-signup": {"dfnID":"dom-identitycredentialrequestoptionscontext-signup","dfnText":"\"signup\"","external":false,"refSections":[],"url":"#dom-identitycredentialrequestoptionscontext-signup"},
 "dom-identitycredentialrequestoptionscontext-use": {"dfnID":"dom-identitycredentialrequestoptionscontext-use","dfnText":"\"use\"","external":false,"refSections":[],"url":"#dom-identitycredentialrequestoptionscontext-use"},
+"dom-identitycredentialrequestoptionsmode-active": {"dfnID":"dom-identitycredentialrequestoptionsmode-active","dfnText":"\"active\"","external":false,"refSections":[],"url":"#dom-identitycredentialrequestoptionsmode-active"},
+"dom-identitycredentialrequestoptionsmode-passive": {"dfnID":"dom-identitycredentialrequestoptionsmode-passive","dfnText":"\"passive\"","external":false,"refSections":[],"url":"#dom-identitycredentialrequestoptionsmode-passive"},
 "dom-identityprovider-close": {"dfnID":"dom-identityprovider-close","dfnText":"close","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-identityprovider-close"}],"title":"2.2.9. Helper algorithms"},{"refs":[{"id":"ref-for-dom-identityprovider-close\u2460"},{"id":"ref-for-dom-identityprovider-close\u2461"}],"title":"2.3. The IdentityProvider Interface"}],"url":"#dom-identityprovider-close"},
 "dom-identityprovider-getuserinfo": {"dfnID":"dom-identityprovider-getuserinfo","dfnText":"getUserInfo","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-identityprovider-getuserinfo"},{"id":"ref-for-dom-identityprovider-getuserinfo\u2460"},{"id":"ref-for-dom-identityprovider-getuserinfo\u2461"}],"title":"2.3. The IdentityProvider Interface"}],"url":"#dom-identityprovider-getuserinfo"},
 "dom-identityprovider-getuserinfo-config-config": {"dfnID":"dom-identityprovider-getuserinfo-config-config","dfnText":"config","external":false,"refSections":[],"url":"#dom-identityprovider-getuserinfo-config-config"},
@@ -5347,6 +5410,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "dom-identityuserinfo-name": {"dfnID":"dom-identityuserinfo-name","dfnText":"name","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-identityuserinfo-name"}],"title":"2.3. The IdentityProvider Interface"}],"url":"#dom-identityuserinfo-name"},
 "dom-identityuserinfo-picture": {"dfnID":"dom-identityuserinfo-picture","dfnText":"picture","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-identityuserinfo-picture"}],"title":"2.3. The IdentityProvider Interface"}],"url":"#dom-identityuserinfo-picture"},
 "e10e7eb7": {"dfnID":"e10e7eb7","dfnText":"DOM manipulation task source","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-manipulation-task-source"},{"id":"ref-for-dom-manipulation-task-source\u2460"}],"title":"2.2.3. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method"},{"refs":[{"id":"ref-for-dom-manipulation-task-source\u2461"},{"id":"ref-for-dom-manipulation-task-source\u2462"}],"title":"2.2.9. Helper algorithms"}],"url":"https://html.spec.whatwg.org/multipage/webappapis.html#dom-manipulation-task-source"},
+"e2a51d55": {"dfnID":"e2a51d55","dfnText":"active","external":true,"refSections":[{"refs":[{"id":"ref-for-extendableevent-active"},{"id":"ref-for-extendableevent-active\u2460"}],"title":"2.2.4. Create an IdentityCredential"}],"url":"https://w3c.github.io/ServiceWorker/#extendableevent-active"},
 "e97a9688": {"dfnID":"e97a9688","dfnText":"unsigned long","external":true,"refSections":[{"refs":[{"id":"ref-for-idl-unsigned-long"}],"title":"2.2.5. Fetch the config file"},{"refs":[{"id":"ref-for-idl-unsigned-long\u2460"}],"title":"3.2. The config file"}],"url":"https://webidl.spec.whatwg.org/#idl-unsigned-long"},
 "ea9cb8e8": {"dfnID":"ea9cb8e8","dfnText":"signal","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credentialrequestoptions-signal"}],"title":"2.2.3. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-signal"},
 "eb1b1af3": {"dfnID":"eb1b1af3","dfnText":"network error","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-network-error"}],"title":"2.2.9. Helper algorithms"}],"url":"https://fetch.spec.whatwg.org/#concept-network-error"},
@@ -5355,6 +5419,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "efa5c464": {"dfnID":"efa5c464","dfnText":"<named-color>","external":true,"refSections":[{"refs":[{"id":"ref-for-typedef-named-color"}],"title":"3.2. The config file"}],"url":"https://drafts.csswg.org/css-color-4/#typedef-named-color"},
 "eligible-for-auto-reauthentication": {"dfnID":"eligible-for-auto-reauthentication","dfnText":"eligible for auto reauthentication","external":false,"refSections":[{"refs":[{"id":"ref-for-eligible-for-auto-reauthentication"}],"title":"2.2.4. Create an IdentityCredential"},{"refs":[{"id":"ref-for-eligible-for-auto-reauthentication\u2460"}],"title":"2.3. The IdentityProvider Interface"}],"url":"#eligible-for-auto-reauthentication"},
 "enumdef-identitycredentialrequestoptionscontext": {"dfnID":"enumdef-identitycredentialrequestoptionscontext","dfnText":"IdentityCredentialRequestOptionsContext","external":false,"refSections":[{"refs":[{"id":"ref-for-enumdef-identitycredentialrequestoptionscontext"},{"id":"ref-for-enumdef-identitycredentialrequestoptionscontext\u2460"}],"title":"2.2.2. The CredentialRequestOptions"}],"url":"#enumdef-identitycredentialrequestoptionscontext"},
+"enumdef-identitycredentialrequestoptionsmode": {"dfnID":"enumdef-identitycredentialrequestoptionsmode","dfnText":"IdentityCredentialRequestOptionsMode","external":false,"refSections":[{"refs":[{"id":"ref-for-enumdef-identitycredentialrequestoptionsmode"},{"id":"ref-for-enumdef-identitycredentialrequestoptionsmode\u2460"}],"title":"2.2.2. The CredentialRequestOptions"}],"url":"#enumdef-identitycredentialrequestoptionsmode"},
 "extract-the-json-fetch-response": {"dfnID":"extract-the-json-fetch-response","dfnText":"extract the JSON fetch response","external":false,"refSections":[{"refs":[{"id":"ref-for-extract-the-json-fetch-response"}],"title":"2.2.1.1. Disconnect request"},{"refs":[{"id":"ref-for-extract-the-json-fetch-response\u2460"},{"id":"ref-for-extract-the-json-fetch-response\u2461"}],"title":"2.2.5. Fetch the config file"},{"refs":[{"id":"ref-for-extract-the-json-fetch-response\u2462"}],"title":"2.2.6. Fetch the accounts"},{"refs":[{"id":"ref-for-extract-the-json-fetch-response\u2463"}],"title":"2.2.7. Fetch an identity assertion"},{"refs":[{"id":"ref-for-extract-the-json-fetch-response\u2464"}],"title":"2.2.8. Request permission to sign-up"}],"url":"#extract-the-json-fetch-response"},
 "f41069dd": {"dfnID":"f41069dd","dfnText":"[[type]]","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credential-type-slot"},{"id":"ref-for-dom-credential-type-slot\u2460"}],"title":"2.2. The IdentityCredential Interface"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credential-type-slot"},
 "f78d5b5c": {"dfnID":"f78d5b5c","dfnText":"origin (for request)","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-request-origin"}],"title":"2.2.1.1. Disconnect request"},{"refs":[{"id":"ref-for-concept-request-origin\u2460"},{"id":"ref-for-concept-request-origin\u2461"}],"title":"2.2.5. Fetch the config file"},{"refs":[{"id":"ref-for-concept-request-origin\u2462"},{"id":"ref-for-concept-request-origin\u2463"}],"title":"2.2.6. Fetch the accounts"},{"refs":[{"id":"ref-for-concept-request-origin\u2464"}],"title":"2.2.7. Fetch an identity assertion"},{"refs":[{"id":"ref-for-concept-request-origin\u2465"}],"title":"2.2.8. Request permission to sign-up"}],"url":"https://fetch.spec.whatwg.org/#concept-request-origin"},
@@ -5365,7 +5430,8 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "fetch-the-account-picture": {"dfnID":"fetch-the-account-picture","dfnText":"fetch the account picture","external":false,"refSections":[{"refs":[{"id":"ref-for-fetch-the-account-picture"}],"title":"2.2.4. Create an IdentityCredential"}],"url":"#fetch-the-account-picture"},
 "fetch-the-accounts": {"dfnID":"fetch-the-accounts","dfnText":"fetch the accounts","external":false,"refSections":[{"refs":[{"id":"ref-for-fetch-the-accounts"}],"title":"2.2.4. Create an IdentityCredential"},{"refs":[{"id":"ref-for-fetch-the-accounts\u2460"}],"title":"2.2.6. Fetch the accounts"},{"refs":[{"id":"ref-for-fetch-the-accounts\u2461"}],"title":"2.3. The IdentityProvider Interface"},{"refs":[{"id":"ref-for-fetch-the-accounts\u2462"}],"title":"3.3. Accounts endpoint"}],"url":"#fetch-the-accounts"},
 "fetch-the-client-metadata": {"dfnID":"fetch-the-client-metadata","dfnText":"fetch the client metadata","external":false,"refSections":[{"refs":[{"id":"ref-for-fetch-the-client-metadata"}],"title":"2.2.8. Request permission to sign-up"},{"refs":[{"id":"ref-for-fetch-the-client-metadata\u2460"}],"title":"3.4. Client Metadata"}],"url":"#fetch-the-client-metadata"},
-"fetch-the-config-file": {"dfnID":"fetch-the-config-file","dfnText":"fetch the config file","external":false,"refSections":[{"refs":[{"id":"ref-for-fetch-the-config-file"}],"title":"2.2.1. The disconnect method"},{"refs":[{"id":"ref-for-fetch-the-config-file\u2460"},{"id":"ref-for-fetch-the-config-file\u2461"}],"title":"2.2.4. Create an IdentityCredential"},{"refs":[{"id":"ref-for-fetch-the-config-file\u2462"}],"title":"2.2.5. Fetch the config file"},{"refs":[{"id":"ref-for-fetch-the-config-file\u2463"}],"title":"2.3. The IdentityProvider Interface"},{"refs":[{"id":"ref-for-fetch-the-config-file\u2464"}],"title":"3.1. The Well-Known File"},{"refs":[{"id":"ref-for-fetch-the-config-file\u2465"}],"title":"3.2. The config file"}],"url":"#fetch-the-config-file"},
+"fetch-the-config-file": {"dfnID":"fetch-the-config-file","dfnText":"fetch the config file","external":false,"refSections":[{"refs":[{"id":"ref-for-fetch-the-config-file"}],"title":"2.2.1. The disconnect method"},{"refs":[{"id":"ref-for-fetch-the-config-file\u2460"}],"title":"2.2.4. Create an IdentityCredential"},{"refs":[{"id":"ref-for-fetch-the-config-file\u2461"}],"title":"2.2.5. Fetch the config file"},{"refs":[{"id":"ref-for-fetch-the-config-file\u2462"}],"title":"2.2.9. Helper algorithms"},{"refs":[{"id":"ref-for-fetch-the-config-file\u2463"}],"title":"2.3. The IdentityProvider Interface"},{"refs":[{"id":"ref-for-fetch-the-config-file\u2464"}],"title":"3.1. The Well-Known File"},{"refs":[{"id":"ref-for-fetch-the-config-file\u2465"}],"title":"3.2. The config file"}],"url":"#fetch-the-config-file"},
+"fetch-the-config-file-and-show-an-idp-login-dialog": {"dfnID":"fetch-the-config-file-and-show-an-idp-login-dialog","dfnText":"fetch the config file and show an IDP login dialog","external":false,"refSections":[{"refs":[{"id":"ref-for-fetch-the-config-file-and-show-an-idp-login-dialog"},{"id":"ref-for-fetch-the-config-file-and-show-an-idp-login-dialog\u2460"}],"title":"2.2.4. Create an IdentityCredential"}],"url":"#fetch-the-config-file-and-show-an-idp-login-dialog"},
 "identity-assertion-endpoint": {"dfnID":"identity-assertion-endpoint","dfnText":"identity assertion endpoint","external":false,"refSections":[{"refs":[{"id":"ref-for-identity-assertion-endpoint"}],"title":"2.2.7. Fetch an identity assertion"},{"refs":[{"id":"ref-for-identity-assertion-endpoint\u2460"}],"title":"3.5. Identity assertion endpoint"},{"refs":[{"id":"ref-for-identity-assertion-endpoint\u2461"}],"title":"6.3. CORS Header"}],"url":"#identity-assertion-endpoint"},
 "identity-credentials-get": {"dfnID":"identity-credentials-get","dfnText":"identity-credentials-get","external":false,"refSections":[{"refs":[{"id":"ref-for-identity-credentials-get"}],"title":"2.2.1. The disconnect method"},{"refs":[{"id":"ref-for-identity-credentials-get\u2460"}],"title":"2.3. The IdentityProvider Interface"},{"refs":[{"id":"ref-for-identity-credentials-get\u2461"}],"title":"4. Permissions Policy Integration"}],"url":"#identity-credentials-get"},
 "identitycredential": {"dfnID":"identitycredential","dfnText":"IdentityCredential","external":false,"refSections":[{"refs":[{"id":"ref-for-identitycredential"}],"title":"2. The Browser API"},{"refs":[{"id":"ref-for-identitycredential\u2460"},{"id":"ref-for-identitycredential\u2461"},{"id":"ref-for-identitycredential\u2462"},{"id":"ref-for-identitycredential\u2463"}],"title":"2.2. The IdentityCredential Interface"},{"refs":[{"id":"ref-for-identitycredential\u2464"},{"id":"ref-for-identitycredential\u2465"},{"id":"ref-for-identitycredential\u2466"}],"title":"2.2.3. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method"},{"refs":[{"id":"ref-for-identitycredential\u2467"},{"id":"ref-for-identitycredential\u2468"}],"title":"2.2.4. Create an IdentityCredential"},{"refs":[{"id":"ref-for-identitycredential\u2460\u24ea"},{"id":"ref-for-identitycredential\u2460\u2460"}],"title":"2.2.7. Fetch an identity assertion"}],"url":"#identitycredential"},
@@ -5377,11 +5443,11 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "remove-a-connection": {"dfnID":"remove-a-connection","dfnText":"remove a connection","external":false,"refSections":[{"refs":[{"id":"ref-for-remove-a-connection"}],"title":"2.2.1. The disconnect method"}],"url":"#remove-a-connection"},
 "remove-all-connections": {"dfnID":"remove-all-connections","dfnText":"remove all connections","external":false,"refSections":[{"refs":[{"id":"ref-for-remove-all-connections"},{"id":"ref-for-remove-all-connections\u2460"}],"title":"2.2.1. The disconnect method"}],"url":"#remove-all-connections"},
 "request-permission-to-sign-up": {"dfnID":"request-permission-to-sign-up","dfnText":"request permission to sign-up","external":false,"refSections":[{"refs":[{"id":"ref-for-request-permission-to-sign-up"},{"id":"ref-for-request-permission-to-sign-up\u2460"}],"title":"2.2.4. Create an IdentityCredential"},{"refs":[{"id":"ref-for-request-permission-to-sign-up\u2461"}],"title":"2.2.8. Request permission to sign-up"},{"refs":[{"id":"ref-for-request-permission-to-sign-up\u2462"}],"title":"3.3. Accounts endpoint"},{"refs":[{"id":"ref-for-request-permission-to-sign-up\u2463"}],"title":"3.5. Identity assertion endpoint"},{"refs":[{"id":"ref-for-request-permission-to-sign-up\u2464"}],"title":"5.3. Select account"}],"url":"#request-permission-to-sign-up"},
-"rp": {"dfnID":"rp","dfnText":"RP","external":false,"refSections":[{"refs":[{"id":"ref-for-rp"},{"id":"ref-for-rp\u2460"},{"id":"ref-for-rp\u2461"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-rp\u2462"},{"id":"ref-for-rp\u2463"},{"id":"ref-for-rp\u2464"},{"id":"ref-for-rp\u2465"}],"title":"2. The Browser API"},{"refs":[{"id":"ref-for-rp\u2466"},{"id":"ref-for-rp\u2467"},{"id":"ref-for-rp\u2468"}],"title":"2.1. The connected accounts set"},{"refs":[{"id":"ref-for-rp\u2460\u24ea"}],"title":"2.2.1.1. Disconnect request"},{"refs":[{"id":"ref-for-rp\u2460\u2460"},{"id":"ref-for-rp\u2460\u2461"},{"id":"ref-for-rp\u2460\u2462"},{"id":"ref-for-rp\u2460\u2463"},{"id":"ref-for-rp\u2460\u2464"},{"id":"ref-for-rp\u2460\u2465"},{"id":"ref-for-rp\u2460\u2466"}],"title":"2.2.2. The CredentialRequestOptions"},{"refs":[{"id":"ref-for-rp\u2460\u2467"},{"id":"ref-for-rp\u2460\u2468"}],"title":"2.2.4. Create an IdentityCredential"},{"refs":[{"id":"ref-for-rp\u2461\u24ea"}],"title":"2.2.5. Fetch the config file"},{"refs":[{"id":"ref-for-rp\u2461\u2460"}],"title":"2.2.7. Fetch an identity assertion"},{"refs":[{"id":"ref-for-rp\u2461\u2461"}],"title":"2.2.8. Request permission to sign-up"},{"refs":[{"id":"ref-for-rp\u2461\u2462"},{"id":"ref-for-rp\u2461\u2463"}],"title":"2.3. The IdentityProvider Interface"},{"refs":[{"id":"ref-for-rp\u2461\u2464"}],"title":"3.1. The Well-Known File"},{"refs":[{"id":"ref-for-rp\u2461\u2465"}],"title":"3.2. The config file"},{"refs":[{"id":"ref-for-rp\u2461\u2466"},{"id":"ref-for-rp\u2461\u2467"},{"id":"ref-for-rp\u2461\u2468"},{"id":"ref-for-rp\u2462\u24ea"}],"title":"3.3. Accounts endpoint"},{"refs":[{"id":"ref-for-rp\u2462\u2460"},{"id":"ref-for-rp\u2462\u2461"},{"id":"ref-for-rp\u2462\u2462"},{"id":"ref-for-rp\u2462\u2463"}],"title":"3.4. Client Metadata"},{"refs":[{"id":"ref-for-rp\u2462\u2464"},{"id":"ref-for-rp\u2462\u2465"},{"id":"ref-for-rp\u2462\u2466"},{"id":"ref-for-rp\u2462\u2467"},{"id":"ref-for-rp\u2462\u2468"},{"id":"ref-for-rp\u2463\u24ea"},{"id":"ref-for-rp\u2463\u2460"}],"title":"3.5. Identity assertion endpoint"},{"refs":[{"id":"ref-for-rp\u2463\u2461"},{"id":"ref-for-rp\u2463\u2462"},{"id":"ref-for-rp\u2463\u2463"},{"id":"ref-for-rp\u2463\u2464"},{"id":"ref-for-rp\u2463\u2465"}],"title":"3.6. Disconnect endpoint"},{"refs":[{"id":"ref-for-rp\u2463\u2466"},{"id":"ref-for-rp\u2463\u2467"},{"id":"ref-for-rp\u2463\u2468"},{"id":"ref-for-rp\u2464\u24ea"},{"id":"ref-for-rp\u2464\u2460"},{"id":"ref-for-rp\u2464\u2461"}],"title":"6.1. Content Security Policy"},{"refs":[{"id":"ref-for-rp\u2464\u2462"}],"title":"6.3. CORS Header"},{"refs":[{"id":"ref-for-rp\u2464\u2463"},{"id":"ref-for-rp\u2464\u2464"},{"id":"ref-for-rp\u2464\u2465"},{"id":"ref-for-rp\u2464\u2466"},{"id":"ref-for-rp\u2464\u2467"},{"id":"ref-for-rp\u2464\u2468"},{"id":"ref-for-rp\u2465\u24ea"},{"id":"ref-for-rp\u2465\u2460"},{"id":"ref-for-rp\u2465\u2461"},{"id":"ref-for-rp\u2465\u2462"},{"id":"ref-for-rp\u2465\u2463"},{"id":"ref-for-rp\u2465\u2464"},{"id":"ref-for-rp\u2465\u2465"},{"id":"ref-for-rp\u2465\u2466"},{"id":"ref-for-rp\u2465\u2467"}],"title":"7.1. Principals"},{"refs":[{"id":"ref-for-rp\u2465\u2468"},{"id":"ref-for-rp\u2466\u24ea"},{"id":"ref-for-rp\u2466\u2460"},{"id":"ref-for-rp\u2466\u2461"},{"id":"ref-for-rp\u2466\u2462"},{"id":"ref-for-rp\u2466\u2463"},{"id":"ref-for-rp\u2466\u2464"},{"id":"ref-for-rp\u2466\u2465"}],"title":"7.2. Network requests"},{"refs":[{"id":"ref-for-rp\u2466\u2466"},{"id":"ref-for-rp\u2466\u2467"},{"id":"ref-for-rp\u2466\u2468"}],"title":"7.3. Attack Scenarios"},{"refs":[{"id":"ref-for-rp\u2467\u24ea"},{"id":"ref-for-rp\u2467\u2460"}],"title":"7.3.1. Manifest Fingerprinting"},{"refs":[{"id":"ref-for-rp\u2467\u2461"},{"id":"ref-for-rp\u2467\u2462"},{"id":"ref-for-rp\u2467\u2463"},{"id":"ref-for-rp\u2467\u2464"},{"id":"ref-for-rp\u2467\u2465"}],"title":"7.3.2. Timing Attacks"},{"refs":[{"id":"ref-for-rp\u2467\u2466"},{"id":"ref-for-rp\u2467\u2467"}],"title":"7.3.3. IDP Intrusion"},{"refs":[{"id":"ref-for-rp\u2467\u2468"},{"id":"ref-for-rp\u2468\u24ea"},{"id":"ref-for-rp\u2468\u2460"},{"id":"ref-for-rp\u2468\u2461"},{"id":"ref-for-rp\u2468\u2462"}],"title":"7.3.4. Cross-Site Correlation"},{"refs":[{"id":"ref-for-rp\u2468\u2463"},{"id":"ref-for-rp\u2468\u2464"},{"id":"ref-for-rp\u2468\u2465"}],"title":"7.3.5. Unauthorized Data Usage"},{"refs":[{"id":"ref-for-rp\u2468\u2466"},{"id":"ref-for-rp\u2468\u2467"},{"id":"ref-for-rp\u2468\u2468"}],"title":"7.3.6. RP Fingerprinting"},{"refs":[{"id":"ref-for-rp\u2460\u24ea\u24ea"},{"id":"ref-for-rp\u2460\u24ea\u2460"},{"id":"ref-for-rp\u2460\u24ea\u2461"}],"title":"7.3.7. Secondary Use"}],"url":"#rp"},
+"rp": {"dfnID":"rp","dfnText":"RP","external":false,"refSections":[{"refs":[{"id":"ref-for-rp"},{"id":"ref-for-rp\u2460"},{"id":"ref-for-rp\u2461"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-rp\u2462"},{"id":"ref-for-rp\u2463"},{"id":"ref-for-rp\u2464"},{"id":"ref-for-rp\u2465"}],"title":"2. The Browser API"},{"refs":[{"id":"ref-for-rp\u2466"},{"id":"ref-for-rp\u2467"},{"id":"ref-for-rp\u2468"}],"title":"2.1. The connected accounts set"},{"refs":[{"id":"ref-for-rp\u2460\u24ea"}],"title":"2.2.1.1. Disconnect request"},{"refs":[{"id":"ref-for-rp\u2460\u2460"},{"id":"ref-for-rp\u2460\u2461"},{"id":"ref-for-rp\u2460\u2462"},{"id":"ref-for-rp\u2460\u2463"},{"id":"ref-for-rp\u2460\u2464"},{"id":"ref-for-rp\u2460\u2465"},{"id":"ref-for-rp\u2460\u2466"}],"title":"2.2.2. The CredentialRequestOptions"},{"refs":[{"id":"ref-for-rp\u2460\u2467"}],"title":"2.2.4. Create an IdentityCredential"},{"refs":[{"id":"ref-for-rp\u2460\u2468"}],"title":"2.2.5. Fetch the config file"},{"refs":[{"id":"ref-for-rp\u2461\u24ea"}],"title":"2.2.7. Fetch an identity assertion"},{"refs":[{"id":"ref-for-rp\u2461\u2460"}],"title":"2.2.8. Request permission to sign-up"},{"refs":[{"id":"ref-for-rp\u2461\u2461"},{"id":"ref-for-rp\u2461\u2462"}],"title":"2.3. The IdentityProvider Interface"},{"refs":[{"id":"ref-for-rp\u2461\u2463"}],"title":"3.1. The Well-Known File"},{"refs":[{"id":"ref-for-rp\u2461\u2464"}],"title":"3.2. The config file"},{"refs":[{"id":"ref-for-rp\u2461\u2465"},{"id":"ref-for-rp\u2461\u2466"},{"id":"ref-for-rp\u2461\u2467"},{"id":"ref-for-rp\u2461\u2468"}],"title":"3.3. Accounts endpoint"},{"refs":[{"id":"ref-for-rp\u2462\u24ea"},{"id":"ref-for-rp\u2462\u2460"},{"id":"ref-for-rp\u2462\u2461"},{"id":"ref-for-rp\u2462\u2462"}],"title":"3.4. Client Metadata"},{"refs":[{"id":"ref-for-rp\u2462\u2463"},{"id":"ref-for-rp\u2462\u2464"},{"id":"ref-for-rp\u2462\u2465"},{"id":"ref-for-rp\u2462\u2466"},{"id":"ref-for-rp\u2462\u2467"},{"id":"ref-for-rp\u2462\u2468"},{"id":"ref-for-rp\u2463\u24ea"}],"title":"3.5. Identity assertion endpoint"},{"refs":[{"id":"ref-for-rp\u2463\u2460"},{"id":"ref-for-rp\u2463\u2461"},{"id":"ref-for-rp\u2463\u2462"},{"id":"ref-for-rp\u2463\u2463"},{"id":"ref-for-rp\u2463\u2464"}],"title":"3.6. Disconnect endpoint"},{"refs":[{"id":"ref-for-rp\u2463\u2465"},{"id":"ref-for-rp\u2463\u2466"},{"id":"ref-for-rp\u2463\u2467"},{"id":"ref-for-rp\u2463\u2468"},{"id":"ref-for-rp\u2464\u24ea"},{"id":"ref-for-rp\u2464\u2460"}],"title":"6.1. Content Security Policy"},{"refs":[{"id":"ref-for-rp\u2464\u2461"}],"title":"6.3. CORS Header"},{"refs":[{"id":"ref-for-rp\u2464\u2462"},{"id":"ref-for-rp\u2464\u2463"},{"id":"ref-for-rp\u2464\u2464"},{"id":"ref-for-rp\u2464\u2465"},{"id":"ref-for-rp\u2464\u2466"},{"id":"ref-for-rp\u2464\u2467"},{"id":"ref-for-rp\u2464\u2468"},{"id":"ref-for-rp\u2465\u24ea"},{"id":"ref-for-rp\u2465\u2460"},{"id":"ref-for-rp\u2465\u2461"},{"id":"ref-for-rp\u2465\u2462"},{"id":"ref-for-rp\u2465\u2463"},{"id":"ref-for-rp\u2465\u2464"},{"id":"ref-for-rp\u2465\u2465"},{"id":"ref-for-rp\u2465\u2466"}],"title":"7.1. Principals"},{"refs":[{"id":"ref-for-rp\u2465\u2467"},{"id":"ref-for-rp\u2465\u2468"},{"id":"ref-for-rp\u2466\u24ea"},{"id":"ref-for-rp\u2466\u2460"},{"id":"ref-for-rp\u2466\u2461"},{"id":"ref-for-rp\u2466\u2462"},{"id":"ref-for-rp\u2466\u2463"},{"id":"ref-for-rp\u2466\u2464"}],"title":"7.2. Network requests"},{"refs":[{"id":"ref-for-rp\u2466\u2465"},{"id":"ref-for-rp\u2466\u2466"},{"id":"ref-for-rp\u2466\u2467"}],"title":"7.3. Attack Scenarios"},{"refs":[{"id":"ref-for-rp\u2466\u2468"},{"id":"ref-for-rp\u2467\u24ea"}],"title":"7.3.1. Manifest Fingerprinting"},{"refs":[{"id":"ref-for-rp\u2467\u2460"},{"id":"ref-for-rp\u2467\u2461"},{"id":"ref-for-rp\u2467\u2462"},{"id":"ref-for-rp\u2467\u2463"},{"id":"ref-for-rp\u2467\u2464"}],"title":"7.3.2. Timing Attacks"},{"refs":[{"id":"ref-for-rp\u2467\u2465"},{"id":"ref-for-rp\u2467\u2466"}],"title":"7.3.3. IDP Intrusion"},{"refs":[{"id":"ref-for-rp\u2467\u2467"},{"id":"ref-for-rp\u2467\u2468"},{"id":"ref-for-rp\u2468\u24ea"},{"id":"ref-for-rp\u2468\u2460"},{"id":"ref-for-rp\u2468\u2461"}],"title":"7.3.4. Cross-Site Correlation"},{"refs":[{"id":"ref-for-rp\u2468\u2462"},{"id":"ref-for-rp\u2468\u2463"},{"id":"ref-for-rp\u2468\u2464"}],"title":"7.3.5. Unauthorized Data Usage"},{"refs":[{"id":"ref-for-rp\u2468\u2465"},{"id":"ref-for-rp\u2468\u2466"},{"id":"ref-for-rp\u2468\u2467"}],"title":"7.3.6. RP Fingerprinting"},{"refs":[{"id":"ref-for-rp\u2468\u2468"},{"id":"ref-for-rp\u2460\u24ea\u24ea"},{"id":"ref-for-rp\u2460\u24ea\u2460"}],"title":"7.3.7. Secondary Use"}],"url":"#rp"},
 "select-an-account": {"dfnID":"select-an-account","dfnText":"select an account","external":false,"refSections":[{"refs":[{"id":"ref-for-select-an-account"}],"title":"2.2.4. Create an IdentityCredential"}],"url":"#select-an-account"},
 "send-a-disconnect-request": {"dfnID":"send-a-disconnect-request","dfnText":"send a disconnect request","external":false,"refSections":[{"refs":[{"id":"ref-for-send-a-disconnect-request"}],"title":"2.2.1. The disconnect method"},{"refs":[{"id":"ref-for-send-a-disconnect-request\u2460"}],"title":"2.2.1.1. Disconnect request"}],"url":"#send-a-disconnect-request"},
 "setdelayenabled": {"dfnID":"setdelayenabled","dfnText":"setdelayenabled","external":false,"refSections":[{"refs":[{"id":"ref-for-setdelayenabled"}],"title":"2.2.3. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method"}],"url":"#setdelayenabled"},
-"show-an-idp-login-dialog": {"dfnID":"show-an-idp-login-dialog","dfnText":"show an IDP login dialog","external":false,"refSections":[{"refs":[{"id":"ref-for-show-an-idp-login-dialog"},{"id":"ref-for-show-an-idp-login-dialog\u2460"},{"id":"ref-for-show-an-idp-login-dialog\u2461"},{"id":"ref-for-show-an-idp-login-dialog\u2462"}],"title":"2.2.4. Create an IdentityCredential"},{"refs":[{"id":"ref-for-show-an-idp-login-dialog\u2463"}],"title":"2.3. The IdentityProvider Interface"}],"url":"#show-an-idp-login-dialog"},
+"show-an-idp-login-dialog": {"dfnID":"show-an-idp-login-dialog","dfnText":"show an IDP login dialog","external":false,"refSections":[{"refs":[{"id":"ref-for-show-an-idp-login-dialog"},{"id":"ref-for-show-an-idp-login-dialog\u2460"},{"id":"ref-for-show-an-idp-login-dialog\u2461"}],"title":"2.2.4. Create an IdentityCredential"},{"refs":[{"id":"ref-for-show-an-idp-login-dialog\u2462"}],"title":"2.2.9. Helper algorithms"},{"refs":[{"id":"ref-for-show-an-idp-login-dialog\u2463"}],"title":"2.3. The IdentityProvider Interface"}],"url":"#show-an-idp-login-dialog"},
 "tracker": {"dfnID":"tracker","dfnText":"tracker","external":false,"refSections":[{"refs":[{"id":"ref-for-tracker"},{"id":"ref-for-tracker\u2460"},{"id":"ref-for-tracker\u2461"},{"id":"ref-for-tracker\u2462"},{"id":"ref-for-tracker\u2463"}],"title":"7.1. Principals"}],"url":"#tracker"},
 "well-known-file": {"dfnID":"well-known-file","dfnText":"well-known file","external":false,"refSections":[{"refs":[{"id":"ref-for-well-known-file"},{"id":"ref-for-well-known-file\u2460"},{"id":"ref-for-well-known-file\u2461"},{"id":"ref-for-well-known-file\u2462"}],"title":"2.2.5. Fetch the config file"},{"refs":[{"id":"ref-for-well-known-file\u2463"},{"id":"ref-for-well-known-file\u2464"}],"title":"3.1. The Well-Known File"}],"url":"#well-known-file"},
 };
@@ -5830,6 +5896,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "#dom-identitycredential-token": {"displayText":"token","export":true,"for_":["IdentityCredential"],"level":"1","normative":true,"shortname":"fedcm","spec":"fedcm-1","status":"local","text":"token","type":"attribute","url":"#dom-identitycredential-token"},
 "#dom-identitycredentialdisconnectoptions-accounthint": {"displayText":"accountHint","export":true,"for_":["IdentityCredentialDisconnectOptions"],"level":"1","normative":true,"shortname":"fedcm","spec":"fedcm-1","status":"local","text":"accountHint","type":"dict-member","url":"#dom-identitycredentialdisconnectoptions-accounthint"},
 "#dom-identitycredentialrequestoptions-context": {"displayText":"context","export":true,"for_":["IdentityCredentialRequestOptions"],"level":"1","normative":true,"shortname":"fedcm","spec":"fedcm-1","status":"local","text":"context","type":"dict-member","url":"#dom-identitycredentialrequestoptions-context"},
+"#dom-identitycredentialrequestoptions-mode": {"displayText":"mode","export":true,"for_":["IdentityCredentialRequestOptions"],"level":"1","normative":true,"shortname":"fedcm","spec":"fedcm-1","status":"local","text":"mode","type":"dict-member","url":"#dom-identitycredentialrequestoptions-mode"},
 "#dom-identitycredentialrequestoptions-providers": {"displayText":"providers","export":true,"for_":["IdentityCredentialRequestOptions"],"level":"1","normative":true,"shortname":"fedcm","spec":"fedcm-1","status":"local","text":"providers","type":"dict-member","url":"#dom-identitycredentialrequestoptions-providers"},
 "#dom-identityprovider-close": {"displayText":"close()","export":true,"for_":["IdentityProvider"],"level":"1","normative":true,"shortname":"fedcm","spec":"fedcm-1","status":"local","text":"close()","type":"method","url":"#dom-identityprovider-close"},
 "#dom-identityprovider-getuserinfo": {"displayText":"getUserInfo(config)","export":true,"for_":["IdentityProvider"],"level":"1","normative":true,"shortname":"fedcm","spec":"fedcm-1","status":"local","text":"getUserInfo(config)","type":"method","url":"#dom-identityprovider-getuserinfo"},
@@ -5869,6 +5936,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "#dom-identityuserinfo-picture": {"displayText":"picture","export":true,"for_":["IdentityUserInfo"],"level":"1","normative":true,"shortname":"fedcm","spec":"fedcm-1","status":"local","text":"picture","type":"dict-member","url":"#dom-identityuserinfo-picture"},
 "#eligible-for-auto-reauthentication": {"displayText":"eligible for auto reauthentication","export":true,"for_":[],"level":"1","normative":true,"shortname":"fedcm","spec":"fedcm-1","status":"local","text":"eligible for auto reauthentication","type":"dfn","url":"#eligible-for-auto-reauthentication"},
 "#enumdef-identitycredentialrequestoptionscontext": {"displayText":"IdentityCredentialRequestOptionsContext","export":true,"for_":[],"level":"1","normative":true,"shortname":"fedcm","spec":"fedcm-1","status":"local","text":"IdentityCredentialRequestOptionsContext","type":"enum","url":"#enumdef-identitycredentialrequestoptionscontext"},
+"#enumdef-identitycredentialrequestoptionsmode": {"displayText":"IdentityCredentialRequestOptionsMode","export":true,"for_":[],"level":"1","normative":true,"shortname":"fedcm","spec":"fedcm-1","status":"local","text":"IdentityCredentialRequestOptionsMode","type":"enum","url":"#enumdef-identitycredentialrequestoptionsmode"},
 "#extract-the-json-fetch-response": {"displayText":"extract the json fetch response","export":true,"for_":[],"level":"1","normative":true,"shortname":"fedcm","spec":"fedcm-1","status":"local","text":"extract the json fetch response","type":"dfn","url":"#extract-the-json-fetch-response"},
 "#fetch-accounts-step": {"displayText":"fetch accounts step","export":true,"for_":[],"level":"1","normative":true,"shortname":"fedcm","spec":"fedcm-1","status":"local","text":"fetch accounts step","type":"dfn","url":"#fetch-accounts-step"},
 "#fetch-an-identity-assertion": {"displayText":"fetch an identity assertion","export":true,"for_":[],"level":"1","normative":true,"shortname":"fedcm","spec":"fedcm-1","status":"local","text":"fetch an identity assertion","type":"dfn","url":"#fetch-an-identity-assertion"},
@@ -5877,6 +5945,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "#fetch-the-accounts": {"displayText":"fetch the accounts","export":true,"for_":[],"level":"1","normative":true,"shortname":"fedcm","spec":"fedcm-1","status":"local","text":"fetch the accounts","type":"dfn","url":"#fetch-the-accounts"},
 "#fetch-the-client-metadata": {"displayText":"fetch the client metadata","export":true,"for_":[],"level":"1","normative":true,"shortname":"fedcm","spec":"fedcm-1","status":"local","text":"fetch the client metadata","type":"dfn","url":"#fetch-the-client-metadata"},
 "#fetch-the-config-file": {"displayText":"fetch the config file","export":true,"for_":[],"level":"1","normative":true,"shortname":"fedcm","spec":"fedcm-1","status":"local","text":"fetch the config file","type":"dfn","url":"#fetch-the-config-file"},
+"#fetch-the-config-file-and-show-an-idp-login-dialog": {"displayText":"fetch the config file and show an idp login dialog","export":true,"for_":[],"level":"1","normative":true,"shortname":"fedcm","spec":"fedcm-1","status":"local","text":"fetch the config file and show an idp login dialog","type":"dfn","url":"#fetch-the-config-file-and-show-an-idp-login-dialog"},
 "#identity-assertion-endpoint": {"displayText":"identity assertion endpoint","export":true,"for_":[],"level":"1","normative":true,"shortname":"fedcm","spec":"fedcm-1","status":"local","text":"identity assertion endpoint","type":"dfn","url":"#identity-assertion-endpoint"},
 "#identity-credentials-get": {"displayText":"identity-credentials-get","export":true,"for_":[],"level":"1","normative":true,"shortname":"fedcm","spec":"fedcm-1","status":"local","text":"identity-credentials-get","type":"dfn","url":"#identity-credentials-get"},
 "#identitycredential": {"displayText":"IdentityCredential","export":true,"for_":[],"level":"1","normative":true,"shortname":"fedcm","spec":"fedcm-1","status":"local","text":"IdentityCredential","type":"interface","url":"#identitycredential"},
@@ -5941,6 +6010,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy": {"displayText":"permissions policy","export":true,"for_":["Document"],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"permissions policy","type":"dfn","url":"https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy"},
 "https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use": {"displayText":"allowed to use","export":true,"for_":[],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"allowed to use","type":"dfn","url":"https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use"},
 "https://html.spec.whatwg.org/multipage/infrastructure.html#in-parallel": {"displayText":"in parallel","export":true,"for_":[],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"in parallel","type":"dfn","url":"https://html.spec.whatwg.org/multipage/infrastructure.html#in-parallel"},
+"https://html.spec.whatwg.org/multipage/interaction.html#transient-activation": {"displayText":"transient activation","export":true,"for_":[],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"transient activation","type":"dfn","url":"https://html.spec.whatwg.org/multipage/interaction.html#transient-activation"},
 "https://html.spec.whatwg.org/multipage/nav-history-apis.html#concept-document-window": {"displayText":"associated Document","export":true,"for_":[],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"associated document","type":"dfn","url":"https://html.spec.whatwg.org/multipage/nav-history-apis.html#concept-document-window"},
 "https://html.spec.whatwg.org/multipage/nav-history-apis.html#window-navigable": {"displayText":"navigable","export":true,"for_":["Window"],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"navigable","type":"dfn","url":"https://html.spec.whatwg.org/multipage/nav-history-apis.html#window-navigable"},
 "https://html.spec.whatwg.org/multipage/webappapis.html#concept-global-object-realm": {"displayText":"realm","export":true,"for_":["global object"],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"realm","type":"dfn","url":"https://html.spec.whatwg.org/multipage/webappapis.html#concept-global-object-realm"},
@@ -5964,7 +6034,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "https://infra.spec.whatwg.org/#ordered-map": {"displayText":"ordered map","export":true,"for_":[],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"ordered map","type":"dfn","url":"https://infra.spec.whatwg.org/#ordered-map"},
 "https://infra.spec.whatwg.org/#ordered-set": {"displayText":"ordered set","export":true,"for_":[],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"ordered set","type":"dfn","url":"https://infra.spec.whatwg.org/#ordered-set"},
 "https://infra.spec.whatwg.org/#parse-json-bytes-to-a-javascript-value": {"displayText":"parse JSON bytes to a JavaScript value","export":true,"for_":[],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"parse json bytes to a javascript value","type":"dfn","url":"https://infra.spec.whatwg.org/#parse-json-bytes-to-a-javascript-value"},
-"https://infra.spec.whatwg.org/#serialize-a-javascript-value-to-a-json-string": {"displayText":"serializing a JavaScript value to a JSON string","export":true,"for_":[],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"serializing a javascript value to a json string","type":"dfn","url":"https://infra.spec.whatwg.org/#serialize-a-javascript-value-to-a-json-string"},
+"https://infra.spec.whatwg.org/#serialize-a-javascript-value-to-a-json-string": {"displayText":"serialize a JavaScript value to a JSON string","export":true,"for_":[],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"serialize a javascript value to a json string","type":"dfn","url":"https://infra.spec.whatwg.org/#serialize-a-javascript-value-to-a-json-string"},
 "https://infra.spec.whatwg.org/#set-append": {"displayText":"append","export":true,"for_":["set"],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"append","type":"dfn","url":"https://infra.spec.whatwg.org/#set-append"},
 "https://infra.spec.whatwg.org/#string": {"displayText":"string","export":true,"for_":[],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"string","type":"dfn","url":"https://infra.spec.whatwg.org/#string"},
 "https://infra.spec.whatwg.org/#string-is": {"displayText":"is","export":true,"for_":["string"],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"is","type":"dfn","url":"https://infra.spec.whatwg.org/#string-is"},
@@ -5985,6 +6055,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "https://w3c-fedid.github.io/login-status#logged-out": {"displayText":"logged-out","export":true,"for_":[],"level":"","normative":true,"shortname":"login-status","spec":"login-status","status":"anchor-block","text":"logged-out","type":"dfn","url":"https://w3c-fedid.github.io/login-status#logged-out"},
 "https://w3c-fedid.github.io/login-status#set-the-login-status": {"displayText":"set the login status","export":true,"for_":[],"level":"","normative":true,"shortname":"login-status","spec":"login-status","status":"anchor-block","text":"set the login status","type":"dfn","url":"https://w3c-fedid.github.io/login-status#set-the-login-status"},
 "https://w3c-fedid.github.io/login-status#unknown": {"displayText":"unknown","export":true,"for_":[],"level":"","normative":true,"shortname":"login-status","spec":"login-status","status":"anchor-block","text":"unknown","type":"dfn","url":"https://w3c-fedid.github.io/login-status#unknown"},
+"https://w3c.github.io/ServiceWorker/#extendableevent-active": {"displayText":"active","export":true,"for_":["ExtendableEvent"],"level":"1","normative":true,"shortname":"service-workers","spec":"service-workers","status":"current","text":"active","type":"dfn","url":"https://w3c.github.io/ServiceWorker/#extendableevent-active"},
 "https://w3c.github.io/webappsec-credential-management/#abstract-opdef-request-a-credential": {"displayText":"Request a Credential","export":true,"for_":[],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"Request a Credential","type":"abstract-op","url":"https://w3c.github.io/webappsec-credential-management/#abstract-opdef-request-a-credential"},
 "https://w3c.github.io/webappsec-credential-management/#credential": {"displayText":"Credential","export":true,"for_":[],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"Credential","type":"interface","url":"https://w3c.github.io/webappsec-credential-management/#credential"},
 "https://w3c.github.io/webappsec-credential-management/#credentialscontainer": {"displayText":"CredentialsContainer","export":true,"for_":[],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"CredentialsContainer","type":"interface","url":"https://w3c.github.io/webappsec-credential-management/#credentialscontainer"},