What is FedCM? A guide to Federated Credential Management
Learn how Federated Credential Management (FedCM) solves the privacy risks of social logins in a cookieless world, offering secure, seamless user authentication.

Learn how Federated Credential Management (FedCM) solves the privacy risks of social logins in a cookieless world, offering secure, seamless user authentication.

For years, the "Sign in with Google" or "Log in with Facebook" button symbolized digital convenience. For businesses, it promised lower friction for user acquisition; for users, it meant one less password to remember. However, the technological foundation that made this convenience possible is evolving. The widespread shift away from third-party cookies, driven by a global demand for greater user privacy, isn't just an advertising problem. It's creating new challenges for federated identity systems that impact the core functionality of websites worldwide. That simple login button now represents a potential point of failure.
This shift requires more than a technical patch; it demands a new strategic approach to user identity. This guide provides a clear, business-focused overview of the challenge, introduces the solution in the form of Federated Credential Management (FedCM), and outlines a strategic path forward using modern, API-first identity solutions.
The move away from third-party cookies is the culmination of years of growing public unease and regulatory action surrounding digital privacy. This isn't a niche concern; it's a powerful market force. While 62% of Americans believe it's impossible to go through daily life without companies collecting data about them, that resignation doesn't equal consent. A staggering 81% of users say the potential risks they face from data collection outweigh the benefits (Pew Research Center), and 63% believe most companies aren’t transparent about how their data is used (Tableau). Google's decision to phase out third-party cookies in its Chrome browser, which commands nearly two-thirds of the global market, is the tipping point that transforms this issue from a future consideration into an urgent business reality.
While headlines have focused on the disruption to digital advertising, a more fundamental business process is being impacted: federated user authentication. Traditional federated identity systems—the technology behind social logins—have historically relied on browser mechanisms, like third-party cookies, that also enabled cross-site tracking. When a user clicks "Sign in with Google" on your-business.com, the flow relies on a connection to a separate domain, like accounts.google.com. This cross-domain communication has historically depended on third-party cookies to recognize the user and maintain a seamless experience.
As browsers restrict third-party cookies, these legacy authentication flows can break. The user's browser can no longer connect their identity across different websites, leading to failed logins, interrupted user journeys, and customer frustration. It's important to distinguish this from first-party cookies, which are set by the website a user visits directly. These remain a secure and essential tool for managing user sessions and preferences within a single domain. The challenge lies specifically with federated identity flows that operate across different domains. This technical evolution requires a strategic response. Businesses must now consider how to adapt their federated identity approach for this new privacy-centric environment. Adopting a modern solution isn't merely a technical upgrade; it's a public declaration of alignment with contemporary user expectations, which can serve as a significant competitive differentiator.
While convenient, traditional social logins have faced challenges. The technical mechanisms they relied upon—namely <iframe>s, navigational redirects, and third-party cookies—are the same tools that have come under scrutiny for their role in cross-site tracking. This overlap created privacy concerns at the heart of the login process.
This flawed foundation gave rise to a widely recognized user interface anti-pattern known as the "NASCAR Problem". Coined by designer Daniel Burka, the term describes a cluttered, visually noisy login page plastered with a jumble of branded buttons for various identity providers (IdPs). Like a race car covered in sponsorship decals, these login pages present an overwhelming array of choices that vie for the user's attention.
This isn't a mere aesthetic complaint; it's a direct impediment to conversion. The well-documented "paradox of choice" principle suggests that an excess of options can lead to confusion, decision paralysis, and ultimately, user abandonment. In an attempt to offer comprehensive login options, businesses were inadvertently damaging their own sign-up funnels. Furthermore, these legacy flows created security vulnerabilities by training users to enter highly sensitive credentials into pop-up windows or redirected pages, making them more susceptible to sophisticated phishing attacks.
The NASCAR Problem is the visible symptom of a decentralized and broken trust model. Each logo represents a separate, siloed transaction that the website must manage. The solution requires a fundamental shift in how this interaction is handled. By moving the point of interaction from the website to the browser itself, a new model emerges—one that centralizes the trust exchange in a neutral, user-controlled, and standardized environment.
FedCM is the purpose-built solution to this challenge. Developed as a new web standard by the World Wide Web Consortium (W3C) and major browser vendors, FedCM is designed from the ground up to enable federated identity in a privacy-preserving way. Its core innovation is to position the web browser as a trusted intermediary—a "mediator" that handles the sensitive identity transaction on the user's behalf without revealing unnecessary information to any party.
FedCM separates the act of authentication from the possibility of tracking. For business and application owners, this translates into several key benefits:
The standard isn't a theoretical proposal; it's being actively developed and adopted by major identity providers like Google and implemented by large-scale platforms like Shopify, signaling its long-term viability and importance in the new web ecosystem. This represents a strategic "re-bundling" of identity at the browser level. Where identity was once unbundled, with every website cobbling together different IdP software development kits (SDKs), FedCM bundles the interaction layer back into the browser. This creates a more efficient and secure market for identity services, where providers compete on the quality of their service, not the design of their login button. For a business, this shift is a massive strategic advantage, as it dramatically lowers technical debt and increases agility by standardizing the integration point.
While the underlying technology is sophisticated, the FedCM authentication flow is conceptually straightforward. It's a carefully choreographed handshake mediated by the browser, designed for security and simplicity.
The process unfolds in five key steps:
This entire sequence is designed to function without third-party cookies, jarring page reloads, or the need for the website to manage complex pop-ups or <iframe>s. The following table illustrates the strategic evolution this represents.
| Feature | Traditional Federated Flow | FedCM Flow (The New Standard) | Business Implication |
|---|---|---|---|
| Key mechanism | Relies on <iframe>, redirects, and pop-ups | Uses a browser-mediated API call (navigator.credentials.get()) | Reduced technical complexity and fewer points of failure. |
| Privacy model | Often relied on third-party cookies, which could enable passive cross-site tracking | No third-party cookies; explicit user consent required before IdP is contacted | Higher user trust and alignment with evolving privacy standards. |
| User experience | Potentially jarring redirects; "NASCAR Problem" with multiple buttons | Seamless, one-tap, native browser UI that is consistent across sites | Lower friction, reduced user confusion, and increased sign-up conversion rates. |
| Security posture | Higher risk of phishing due to inconsistent, site-controlled UI elements | Lower risk due to a standardized, trusted prompt controlled by the browser | Enhanced protection for users and reduced brand risk from security incidents. |
Understanding the FedCM standard is one thing; implementing it in a scalable, secure, and maintainable way is another. This is where an enterprise-grade identity platform like Ory becomes a strategic enabler. Ory provides a complete identity and access control ecosystem, with Ory Kratos serving as the identity management backend and the Ory Network offering it as a fully managed service. This is critical because FedCM manages the browser-side interaction, but a business still needs a robust backend to handle user profiles, sessions, permissions, and other identity-related logic.
Ory abstracts away the low-level complexities of FedCM, transforming what could be a daunting engineering challenge into a series of straightforward configuration steps:
FedCM Config URL supplied by the IdP. This is a configuration setting, not a code change.Behind the scenes, the Ory Network handles the heavy lifting: generating the correct parameters for the FedCM call, including security measures like CSRF tokens to prevent attacks, and then receiving and validating the identity assertion from the browser to issue a secure user session.
The value here extends far beyond initial implementation. FedCM isn't a static standard; it's actively evolving within the W3C's Federated Identity Working Group, with new capabilities like multi-IdP support and enhanced APIs under development. A business that builds a custom FedCM solution today is committing to a hidden, ongoing operational cost: dedicating engineering resources to perpetually monitor, test, and update their code as the standard and browser behaviors change.
By contrast, using a platform like Ory offloads this significant maintenance burden. It effectively outsources the R&D required to stay current with the identity landscape. This transforms a volatile and unpredictable technical challenge into a stable and predictable operational expense—a powerful value proposition for any technology or finance leader.
Investing in a modern identity platform to adopt FedCM isn't a cost center; it's a driver of tangible business value and return on investment. The business case rests on four key pillars:
The fundamental architecture of the web is evolving. Old methods for managing federated user identity, which often relied on mechanisms like third-party cookies, are becoming less viable as browsers prioritize user privacy. FedCM has emerged as the new, privacy-first standard, offering a more secure, trustworthy, and seamless experience for users.
Navigating this transition alone is a risky and resource-intensive proposition. Attempting to build and maintain a compliant identity system in-house diverts valuable engineering talent from core product innovation. Modern identity platforms like Ory provide a strategic, future-proof path to not only adopt the new standard but to leverage it as a competitive advantage.
Business and technology leaders must stop viewing identity as a solved commodity. It's time to re-evaluate current identity strategies in light of these profound technological shifts. It's time to ask: Is our federated sign-in flow prepared for a world with restricted third-party cookies? Does it suffer from the NASCAR problem, frustrating users and hurting conversion? By exploring how a modern identity platform can accelerate business goals, leaders can transform a strategic risk into a user-centric opportunity.
For additional details on implementing FedCM with Ory, see our documentation: https://www.ory.sh/docs/kratos/social-signin/fedcm
Learn more about FedCM, including a video and a mock FedCM utility you can test out the standard: https://www.ory.sh/fedcm