Implement email verification and XCIM consent.

1. Check your website’s eligibility.Read live capabilities. For vendor_origin_handoff, verify your return origin with the consent_presentation_delegate role and register that exact origin in the Chrome origin trial. Visitors need a participating browser and email provider.
2. Prepare the form and session.Generate a single-use nonce on your server and render it with the native email form. When you know the address, create the session using the same nonce and the published-screen flag. See the session request and form markup.
3. Send the evidence from your backend.On submission, check the saved preparation and the address. Relay the browser token to the session’s EVP submission URI. After verification, send the visitor to hosted_consent_uri to choose their preferences. For an empty token, offer the configured OIDC alternative when available.
4. Check the first receipt and fallback.With a participating account, make a test choice and verify the signed receipt after returning to your site. Repeat with EVP unavailable to check your alternative sign-in. Follow the browser test steps.

GET https://api.emabled.com/v1/capabilities

POST https://api.emabled.com/v1/consent-sessions
Authorization: Bearer <vendor-token>
Idempotency-Key: <unique-request-key>
Content-Type: application/json

{
  "issuance_profile": "evp_hosted_consent",
  "requested_recipient": "person@example.com",
  "use_published_consent_screen": true,
  "manifest_id": "urn:xcim:manifest:your-product-v3",
  "return_uri": "https://app.example.com/xcim/complete",
  "evp_delivery_mode": "vendor_origin_handoff",
  "evp_nonce": "<32-byte base64url server challenge>",
  "identity_profiles": ["evp-01", "oidc-01"],
  "exchange_endpoint_id": "oxe_your_reviewed_endpoint"
}

Supply your registered values and keep the returned session_id and resolved_manifest_id on your backend. Verify the receipt against that version, including when someone edits the consent screen while a session is open.

Choose one presentation mode: omit evp_delivery_mode for an Emabled-hosted EVP form, or send vendor_origin_handoff when your reviewed HTTPS origin owns the Origin Trial token. EVP-only sessions send identity_profiles: ["evp-01"] and omit exchange_endpoint_id. For Google fallback within this EVP session, supply your reviewed and active exchange_endpoint_id. If your site runs its own Google, Apple, GitLab.com, Slack, Twitch or Yahoo callback, offer a separate OIDC-only session with its oidc_source_id when EVP is unavailable. Omit exchange_endpoint_id in that new session. Generate the EVP nonce as exactly 32 cryptographically random bytes encoded as unpadded base64url (43 characters); a UUID is not a valid substitute.

October 2026 update. The Origin Trial now runs through Chrome 160, with Android support from Chrome 154. Tokens from before the extension expire on November 17, 2026: renew in the Origin Trials panel and replace both response header and HTML meta values. Renewal does not deploy the token. Chrome 156+ returns the submitted email exactly; Emabled preserves canonical delivery addresses and only permits provider-reviewed case comparison. EVT validation supports EdDSA/Ed25519 for Ed25519, ES256 for P-256, and bounded key search when kid is absent. See the official verifier guide. A live browser/provider test remains required after deployment.

<input name="email-address" type="email" autocomplete="email">
<input type="hidden" name="token"
       nonce="<evp_handoff.nonce>"
       autocomplete="email-verification-token">

POST https://api.emabled.com/v1/consent-sessions/<session_id>/identity-evidence/evp
Authorization: Bearer <token with identity-evidence:submit>
Content-Type: application/json

{
  "nonce": "<evp_handoff.nonce>",
  "token": "<browser-populated EVP token>"
}

1. Prepare before the email interaction.Create a short-lived, single-use preparation on your backend. Generate a 32-byte base64url nonce and an unrelated opaque preparation ID. Render the same nonce on the hidden EVP field before the person interacts with the email field; never generate or replace it in browser JavaScript.
2. Keep one email control in one native form.The address requested by signup and the address verified by Chrome must be the same control. Do not ask for it twice, clone it, move it to a second screen, or inject the verifier form after page load.
3. Bind without destroying browser evidence.Once the field is locally valid, bind the preparation to the normalized address and create the Emabled session using the already-rendered nonce. Changes to the address invalidate the preparation. A repeated request must be idempotent or replace only an expired preparation.
4. Put the Origin Trial token on the same response as the form.Do not use a token issued for another host, subdomain, port, or protocol. The response must carry the public Origin-Trial header for that exact origin.
5. Post the native form to your own backend.Submit natively so Chrome can populate the token. JavaScript must not read, log, persist or forward the raw token. Your backend consumes the preparation once, verifies the selected email, then relays the token to Emabled over the authenticated backchannel.
6. Redirect to hosted_consent_uri after verification.Identity evidence only unlocks the frozen manifest. The person must still make the explicit XCIM purpose decision.
7. Fall back when EVP is unavailable.Use the configured OAuth/OIDC path or your product's non-XCIM continuation policy. Never silently downgrade to email reply verification.

1. EVP in a normal session.Start with the participating email provider signed in. Enter, paste or autocomplete the requested address in the prepared native form, allow Chrome to verify it, submit signup, make the separate Emabled consent decision and confirm the authenticated return to the product. A missing green checkmark alone is not a failure.
2. OAuth/OIDC without a prior provider login.Start a separate browsing session with no active provider login, such as a fresh Incognito session. Submit signup without EVP evidence. Confirm that Emabled offers Continue with Google, sign in with the same requested address, record the separate consent decision and confirm the authenticated product return. If Chrome verifies the address before submission, that attempt is another EVP test, not OIDC.

Validated on October 15, 2026. The LMGram Partner Console integration completed both paths in user-assisted live tests: Chrome EVP verification followed by consent and return, and an Incognito signup with Google OAuth/OIDC followed by consent and return. These are user-reported browser results, not unattended authentication or a direct audit of private account rows and receipts. Backend receipt verification remains mandatory; mismatch, cancellation, expiry, delayed receipts, repeated completion and revocation remain separate regression cases.