How to Verify 2026 Chrome Email Verification API Issuer Requests?

Release timeline for issuer requests

The compatibility target is not one assumed request shape. Chrome’s issuer documentation and updates describe changes across browser versions. Treat each milestone as a test case, not as proof that every client in the field has the same behavior.

The table is a compatibility map, not a mandate to accept arbitrary input. The documented version boundaries help QA choose fixtures. They do not establish that every browser installation has upgraded or that a request without a familiar header is safe. Check the issuer guide when the Origin Trial status or implementation changes.

A Sec-Fetch-Dest value is useful request context; it is not a substitute for signature validation. Likewise, matching a known browser milestone does not establish a valid user session. The issuer should apply each check independently and record its result.

Issuer request validation for Chrome Email Verification API

The issuer and the website consuming the resulting token have different jobs. The issuer receives a browser request, validates it under the provider’s documented policy, and may issue a token. A relying website later consumes that token as part of its own email-verification process. A successful issuer response is not proof that the website has accepted the token or completed verification. The Chrome flow description sets out that separation.

Use this evidence ladder when reviewing logs or a QA report:

This distinction prevents a common test-reporting mistake: calling the whole flow successful because the endpoint returned a response. Store evidence for each boundary. A QA result should say which checks passed, whether the issuer returned a token, and whether the relying website completed its separate step.

For teams deciding how to test that last step, keep API evidence separate from inbox evidence. A test inbox reachability check can help observe an ordinary confirmation email, but it cannot demonstrate that the issuer validated a browser signature or that a website accepted a token.

Provider developers: request parsing and verification order

The Chrome Email Verification API issuer must parse the request according to the current official format. Avoid a permissive parser that treats malformed JSON, missing signed components, or an unexpected content type as an acceptable request. Parsing is only the first gate.

A safe processing sequence is:

1. Apply endpoint-level request size and content-type limits.
2. Parse the documented JSON body and reject malformed or incomplete input.
3. Validate the required signature fields and signature against the documented key and algorithm policy.
4. Recompute or validate the body digest according to the issuer guide.
5. Verify that the request belongs to a valid, appropriate user session.
6. Match the requested email to an address eligible for that user.
7. Issue a token only after every required check passes; otherwise reject or route through the service’s own email-confirmation process.

The sequence matters. If the service creates a token before it finishes session and address checks, a later rejection may not undo side effects or prevent a response from leaking. Keep token creation behind a single decision point that consumes explicit validation results.

Do not equate TLS with request authentication. TLS protects a connection in transit, but it does not itself prove that the message signature is valid. Do not equate the presence of Signature or Signature-Input with successful verification either. Those are inputs to the check, not its outcome.

Security engineers: signature coverage and proxy boundaries

The issuer implementation guide assigns the issuer responsibility for validating Signature, Signature-Input, Signature-Key, and Content-Digest according to the documented request scheme. RFC 9421 defines the HTTP Message Signatures framework, including how covered message components are represented and verified. Use the official Chrome example for the API-specific requirements and RFC 9421 for the standard mechanism; do not invent a private interpretation of either.

The important review question is whether the verification code checks the signed content that the issuer relies on. Confirm that the implementation rejects an absent signature, an invalid signature, an unsupported or inappropriate key, and a digest that does not match the received body. Check the documented algorithm identifier where applicable. Chrome’s October 2026 update describes an algorithm identifier change from Chrome 156 onward, so the verifier’s accepted algorithm policy should follow that guidance rather than silently accepting any value.

Proxying introduces another boundary. A load balancer may receive a public authority while the application sees an internal hostname. If the verification process uses the wrong authority when reconstructing the signed message, a legitimate request can fail—or a careless workaround can weaken verification. Configure the public authority from trusted deployment settings or trusted proxy metadata. Do not treat an arbitrary client-supplied forwarded-host value as authoritative.

A useful test is to send a correctly signed request through the production-like proxy path and compare the components used by the verifier with those used in the signed message. Then change the authority or a covered body component and confirm rejection. Keep diagnostic logs useful, but avoid logging private key material, session secrets, or full personal data.

Identity-service maintainers: session and email matching

A valid signature alone does not show that the request is authorized for the account named by the session. Confirm that the session is active, belongs to the expected user, and satisfies the provider’s requirements for issuing a verification token. Expired, revoked, missing, or mismatched sessions should not reach token issuance.

Then compare the requested address with an address that the session’s user is allowed to verify. This is an account authorization check, not merely a string-format check. A syntactically valid address that belongs to another account must not pass because it looks plausible or because the request was correctly signed.

Keep two values conceptually distinct:

• Internal comparison value: The provider may use its established normalization rules to find an account’s eligible address. Those rules must be consistent with account storage and must not merge addresses that the service treats as distinct.
• Token email value: Follow the current issuer requirement for the email claim. The Chrome 156 guidance says the token email claim must match the request value. Preserve the request email string for that claim instead of replacing it with a normalized internal lookup value.

This distinction helps avoid a subtle mismatch: account lookup may use a canonical form, while the token must represent the exact request value required by the current specification. The issuer guide is the authority for the required claim behavior. Recheck it when upgrading support across the documented version milestones.

Keep test sessions and test addresses isolated from production identities. A team’s privacy practices should cover test fixtures as well as analytics and logs: avoid real user addresses, minimize stored request data, and ensure that test credentials cannot access production accounts.

Security review: rejection cases and email fallback

Security reviewers should test failure behavior as deliberately as the valid path. A suite containing only a correctly signed request proves little about whether the issuer enforces its checks. Each failure case should assert both the response and the absence of token issuance or equivalent side effects.

These are tests of your own provider or an environment for which you have authorization. They are not a recipe for automating registrations on unrelated services. Use dedicated test keys, controlled sessions, and synthetic email data. Make each test fixture traceable to a specific expected decision so a QA failure can distinguish parsing, signature, session, and address problems.

Preserve an ordinary email confirmation route for cases where the API is unavailable, the browser does not support the capability, the issuer declines to issue a token, or the relying website cannot complete verification. That route belongs to the service’s own product flow. It does not mean a failed signature should be accepted, nor does it make email confirmation a substitute for issuer validation when the API path is in use.

QA engineers: release evidence and fallback checks

A release test should follow the whole chain without collapsing its stages. First capture the browser version and request shape. Then record the issuer’s signature, digest, session, and address decisions. Finally, distinguish the issuer response from browser acceptance and the relying website’s completion result. The Chrome API remains an Origin Trial in the official documentation cited above, so version and implementation evidence matters.

A practical test run can follow these steps:

1. Prepare an isolated environment. Use a test issuer, test signing keys, synthetic accounts, and non-production sessions. Confirm that the test data cannot map to a real user.
2. Capture a valid request. Save a redacted fixture containing the request format and relevant headers. Remove credentials and personal data that are not needed to reproduce the case.
3. Exercise the documented version shapes. Include the JSON and signature format described for Chrome 153 onward, and check the Sec-Fetch-Dest spelling documented for the relevant browser milestones. Do not assume a version label alone proves which format was sent.
4. Run positive and negative signature cases. Verify that a valid request reaches the issuance decision and that missing, invalid, or body-mismatched signatures do not issue a token.
5. Break session and address eligibility independently. Keep the signature valid while testing an invalid session, then keep the session valid while testing a non-matching address. This isolates authorization checks.
6. Verify the token claim. For the Chrome 156 behavior described in the official update, check that the email claim follows the current requirement and matches the request value.
7. Test the product’s mail fallback separately. Disable or decline the API path in the test environment and verify that the existing confirmation email flow remains usable. Confirm receipt as an inbox observation, not as proof of API issuance.
8. Record a release decision. Include browser version, observed request format, signature and digest results, session and address outcomes, token result, website-side result, and fallback evidence.

Do not report “email delivered” from a successful token test, or “API verified” from a message appearing in an inbox. A message reaching a test inbox shows only that the mail path was observable in that test. It is not a guarantee of production delivery, and it does not establish that the Chrome issuer or website-side token checks worked.

For a production release, keep the evidence concise and attributable. A single record should identify the browser build, request format, validation outcomes, token issuance outcome, relying-site outcome if tested, and fallback result. That makes a failure actionable without storing a production user’s email or session data.

When the test is specifically about whether your own product can still send and receive an ordinary confirmation message, a ZOSend temporary address can keep that test separate from a work inbox. It does not validate Chrome Email Verification API signatures, replace the issuer, or guarantee delivery. Use the test-receipt guidance for that narrower mail-path check; keep issuer validation and email fallback as separate release criteria.