JavaScript Document requestStorageAccessFor() Method

Beginner
5 min read
Updated: Nov 2026
3 examples
Method
Decorative image with the word REQUESTSTORAGEACCESSFOR

Definition

document.requestStorageAccessFor(requestedOrigin) lets a top-level page ask for third-party cookie access on behalf of another origin in the same related website set. It returns a Promise that fulfills with undefined if granted, or rejects if denied (MDN).

Pass the required arguments shown below. Check return values and browser support before you rely on the result.

Syntax

Call document.requestStorageAccessFor. Start with this line.

JavaScript
document.requestStorageAccessFor(requestedOrigin)
CallWhat it does
document.requestStorageAccessFor(requestedOrigin)Primary signature.
document.requestStorageAccessFor(...)Call with the arguments your case needs.

Built into the browser. Call requestStorageAccessFor(...) on document — no import required.

Library declarations
JavaScript
document.requestStorageAccessFor(requestedOrigin)

Parameters

ParameterDescription
requestedOriginRequired. Origin URL string to request access for

Return Value

Return ValueDescription
*Promise → undefined or reject

JavaScript Examples

Example 1 — Feature-Detect

Check for the method before calling (MDN pattern).

JavaScript
const ok = "requestStorageAccessFor" in document;

console.log(ok ? "legacy API available" : "missing — do not depend on it");
Try It Yourself

How It Works

  1. Use in. Tests whether the method exists on document.
  2. Branch safely. Skip the call when unsupported.
  3. Expect removal. MDN marks the API Deprecated.
  4. Literacy only. Useful to read old code, not to ship new features.

Example 2 — Request on Click

Call from a user gesture; handle resolve and reject (MDN).

JavaScript
button.addEventListener("click", async () => {
  if (!("requestStorageAccessFor" in document)) {
    console.log("not supported");
    return;
  }
  try {
    await document.requestStorageAccessFor("https://example.com");
    console.log("granted");
  } catch (err) {
    console.log(err.name); // often "NotAllowedError"
  }
});
Try It Yourself

How It Works

  1. Wire a click handler. Provides transient activation (MDN).
  2. Detect the API. Exit early when missing.
  3. Await the Promise. Resolve means grant; reject means deny.
  4. On reject, gesture is consumed. You cannot immediately retry in the same gesture (MDN).

Example 3 — Invalid Origin

A non-URL string throws TypeError (MDN).

JavaScript
async function probe() {
  if (!("requestStorageAccessFor" in document)) {
    console.log("skip");
    return;
  }
  try {
    await document.requestStorageAccessFor("not a url");
  } catch (err) {
    console.log(err.name); // "TypeError"
  }
}

probe();
Try It Yourself

How It Works

  1. Detect first. Avoid calling a missing method.
  2. Pass a bad string. Not a valid URL.
  3. Engine throws TypeError. Documented on MDN.
  4. Validate origins. Use real https://… origin URLs in legacy demos.
Compatibility

Browser Support

Document.requestStorageAccessFor() is Deprecated (to be removed) and Non-standard on MDN. It does not appear to be defined in any specification.

✓ Deprecated · Non-standard

Document.requestStorageAccessFor()

Legacy Chromium Privacy Sandbox helper. Feature-detect if you must inspect old pages; do not ship new products on it.

Legacy Deprecated API
Google Chrome All versions · Desktop & Mobile
Full support
Mozilla Firefox All versions · Desktop & Mobile
Full support
Apple Safari All versions · macOS & iOS
Full support
Microsoft Edge All versions · Chromium & Legacy
Full support
Internet Explorer IE 6+ · Legacy environments
Full support
Opera All modern versions
Full support
document.requestStorageAccessFor() Avoid

Bottom line: Literacy only. Prefer requestStorageAccess() in embeds when Storage Access is required, and design for cookie partitioning.

Frequently Asked Questions

MDN: Document.requestStorageAccessFor() allows top-level sites to request third-party cookie access on behalf of embedded content originating from another site in the same related website set. It returns a Promise that resolves if access was granted and rejects if denied.
Yes. MDN marks it Deprecated (to be removed) and Non-standard. It does not appear to be defined in any specification. Chrome withdrew related Privacy Sandbox / Related Website Sets features.
requestStorageAccess() is called by third-party embedded content for itself. requestStorageAccessFor() is called by the top-level page on behalf of another origin (for resources that cannot call the API themselves, such as cross-site images or scripts) (MDN).
A string requestedOrigin — the URL of the origin you are requesting third-party cookie access for (MDN). Invalid URLs throw TypeError.
MDN: call Permissions.query() with name "top-level-storage-access" and a requestedOrigin. That feature name differs from "storage-access" used with requestStorageAccess().
Yes in the common case. MDN: requests are automatically denied unless the top-level content is processing a user gesture (transient activation), or permission was already granted previously.

Next: startViewTransition()

Learn how to animate DOM updates with the View Transitions API.

startViewTransition() tutorial →

About the author

Mari Selvan M P
Mari Selvan M P 🔗

Developer, cloud engineer, and technical writer

  • Experience 12 years building web and cloud systems
  • Focus Full Stack Development, AWS, and Developer Education

I write practical tutorials so students and working developers can learn by doing—from databases and APIs to deployment on AWS.

AWS Certified Developer – Associate (Credly)

11 people found this page helpful

JavaScript Document requestStorageAccess() Method JavaScript Document startViewTransition() Method