http header
Sec-Private-State-Token-Crypto-Version header
Limited availability
The HTTP Sec-Private-State-Token-Crypto-Version Fetch Metadata Request Header is used by the Private State Token API during token issuance to indicate to the issuer server which cryptographic protocol version should be used to sign blinded nonces when generating tokens.
At the time of writing, there is only one version supported, but this mechanism makes it possible to support multiple versions in the future.
Note that a developer wouldn’t be expected to generate Sec-Private-State-Token-Crypto-Version request headers — these are created automatically by the browser when invoking private state token token-request fetch requests.
| Header type | [Fetch Metadata Request Header](https://developer.mozilla.org/en-US/docs/Glossary/Fetch%20Metadata%20Request%20Header) |
|---|---|
| [Forbidden request header](https://developer.mozilla.org/en-US/docs/Glossary/Forbidden%20request%20header) | Yes (Sec- prefix) |
| [CORS-safelisted request header](https://developer.mozilla.org/en-US/docs/Glossary/CORS-safelisted%20request%20header) | No |
Syntax
Sec-Private-State-Token-Crypto-Version: <string>
Servers should ignore this header if it contains any other value.
Directives
<string>- : A string containing the cryptographic protocol version that should be used by the issuer server to sign blinded nonces when generating tokens.
Examples
Sec-Private-State-Token-Crypto-Version: PrivateStateTokenV1VOPRF
Specifications
SpecificationsStandards references are available on the canonical MDN page.
Browser compatibility
Browser compatibilityCompatibility data is available on the canonical MDN page.