http permissions policy directive
Permissions-Policy: otp-credentials directive
Limited availability
The HTTP Permissions-Policy header otp-credentials directive controls whether the current document is allowed to use the WebOTP API to request a one-time password (OTP) from a specially-formatted SMS message sent by the app’s server, i.e., via navigator.credentials.get({otp: ..., ...}).
Specifically, where a defined policy blocks the use of this feature, the Promise returned by navigator.credentials.get({otp}) will reject with a SecurityError DOMException.
Syntax
Permissions-Policy: otp-credentials=<allowlist>;
<allowlist>- : A list of origins for which permission is granted to use the feature. See
Permissions-Policy> Syntax for more details.
- : A list of origins for which permission is granted to use the feature. See
Default policy
The default allowlist for otp-credentials is self.
Specifications
SpecificationsStandards references are available on the canonical MDN page.
Browser compatibility
Browser compatibilityCompatibility data is available on the canonical MDN page.
See also
Permissions-Policyheader- Permissions Policy
- WebOTP API
OTPCredentialinterface