JavaScript Navigator login Property

What You’ll Learn

navigator.login is the entry point for the Login Status API used by federated identity providers. Learn NavigatorLogin.setStatus, FedCM context, secure context rules, five examples, and try-it labs.

Introduction

Federated sign-in (“Sign in with …”) involves an identity provider (IdP) and a relying party (RP) website. The browser’s FedCM flow needs to know whether anyone is actually signed into the IdP before asking for accounts.

navigator.login returns a NavigatorLogin object. On the IdP’s own site, after login or logout, you call setStatus("logged-in") or setStatus("logged-out") so the browser can store that IdP login status.

Understanding the login Property

Think of navigator.login as a signal light the IdP flips for the browser: “someone is logged in here” vs “everyone is logged out.”

• NavigatorLogin — object returned by navigator.login.
• setStatus(status) — IdP reports login status to the browser.
• "logged-in" — at least one IdP account is signed in.
• "logged-out" — all IdP accounts are signed out.
• FedCM — uses the signal to avoid useless account requests.
• Secure context — HTTPS / localhost; same-origin iframe rules apply.

📝 Syntax

General form of the property:

navigator.login

Value

• A NavigatorLogin object when the Login Status API is available.

Common patterns

// MDN examples — call from the IdP origin after auth changes:
navigator.login.setStatus("logged-in");
navigator.login.setStatus("logged-out");

// Safe feature-detect + await:
if (navigator.login && typeof navigator.login.setStatus === "function") {
  await navigator.login.setStatus("logged-in");
}

Examples Gallery

Examples follow MDN Login Status / navigator.login.setStatus patterns. Prefer Try It Yourself on HTTPS. Real FedCM value appears when called from an IdP origin after login/logout.

const supported = Boolean(navigator.login);
console.log(supported ? "Login Status API available" : "Login Status API missing");

Login Status API missing
(or "Login Status API available" in a supporting browser)

console.log("secure: " + window.isSecureContext);
console.log("login: " + Boolean(navigator.login));

if (!window.isSecureContext) {
  console.log("Serve over HTTPS to use navigator.login");
} else if (!navigator.login) {
  console.log("Secure, but Login Status API not exposed");
} else {
  console.log("Ready to call setStatus");
}

secure: true
login: false
Secure, but Login Status API not exposed
(messages vary by browser)

async function markLoggedIn() {
  if (!navigator.login) {
    return "Login Status API not supported.";
  }
  await navigator.login.setStatus("logged-in");
  return "status set: logged-in";
}

markLoggedIn().then(console.log).catch((err) => {
  console.log(String(err.name || "Error") + ": " + (err.message || err));
});

Login Status API not supported.
(or "status set: logged-in" / a SecurityError in bad frames)

async function markLoggedOut() {
  if (!navigator.login) {
    return "Login Status API not supported.";
  }
  await navigator.login.setStatus("logged-out");
  return "status set: logged-out";
}

markLoggedOut().then(console.log).catch((err) => {
  console.log(String(err.name || "Error") + ": " + (err.message || err));
});

Login Status API not supported.
(or "status set: logged-out")

async function setIdpLoginStatus(status) {
  if (!navigator.login || typeof navigator.login.setStatus !== "function") {
    return { ok: false, reason: "unsupported" };
  }
  try {
    await navigator.login.setStatus(status);
    return { ok: true, status: status };
  } catch (err) {
    return {
      ok: false,
      reason: String(err.name || "Error"),
      message: String(err.message || err)
    };
  }
}

setIdpLoginStatus("logged-in").then((r) => console.log(JSON.stringify(r)));

{"ok":false,"reason":"unsupported"}
(or {"ok":true,"status":"logged-in"})

🚀 Common Use Cases

• IdP sign-in success — setStatus("logged-in") after auth completes.
• IdP logout — setStatus("logged-out") when no accounts remain.
• FedCM readiness — help the browser skip empty account fetches.
• Privacy / timing — reduce signals that enable timing attacks (FedCM design goal).
• HTTP alternative — some flows also use a Set-Login response header (see FedCM docs).

📝 Notes

• Not Deprecated, Experimental, or Non-standard on MDN — no status banner on this page.
• Limited availability (e.g. Safari typically unsupported) — always feature-detect.
• Secure context required (HTTPS / localhost).
• Intended for IdP origins used with the FedCM / Login Status API.
• Related: maxTouchPoints, credentials, JavaScript hub.

💡 Best Practices