If you employ multiple domains that share the same account management backend, you can now also declare that they can share credentials across one another to enable users to save credentials once and have the Chrome password manager suggest them to any of the linked websites.


![Milica Mihajlija](https://web.dev/images/authors/mihajlija.jpg) Milica Mihajlija [X](https://twitter.com/bibydigital) [GitHub](https://github.com/mihajlija) [Homepage](https://mihajlija.github.io/)

<br />

Chrome's password manager already autofills credentials for websites with saved
credentials, as well as in the following two cases:

- When two websites are in the [same-site](https://web.dev/articles/same-site-same-origin) relationship, Chrome will show autofill credentials for the other site if there's at least one credential saved on one site. For example, because `www.example.com` and `m.example.com` are the same-site, Chrome can share saved credentials between the two websites and suggest the saved password to another.
- When a developer associates an Android app with a site that uses the same credentials, Chrome can suggest Android credentials on that site. Apps are associated with websites using [Digital Asset Links (DALs)](https://developers.google.com/digital-asset-links/v1/getting-started).

You can now also associate websites in a cross-site relationship to enable users
to save their credentials once and have the password manager suggest them to any
of the associated websites.

If you employ multiple domains that share the same account management backend
(such as `https://www.example.com` and `https://www.example.co.uk)`, starting in
version 91, you can enable Chrome to suggest passwords saved to domains
associated with Digital Asset Links.

> [!NOTE]
> **Note:** There's a similar potential web platform feature called [First-Party
> Sets](https://github.com/privacycg/first-party-sets). However, while it allows for embeds from cross-site to be treated as the same party when the top-level domain is owned by the same organization, there's no plan to have any effect on handling passwords. The Digital Asset Links is Google's technology that can be used for passwords, but it has no effect on handling cookies.

To make a DAL association, developers need to put a JSON file that follows
[the DAL syntax](https://developers.google.com/digital-asset-links/v1/statements)
at `/.well-known/assetlinks.json` on the respective domains.

## Prerequisites

- Use Chrome 91 or later.
- Make sure "Offer to save passwords" is turned on in `chrome://settings/passwords`.
- Make sure your website's sign-in domain is available through HTTPS.

## Set up seamless credential sharing across your two websites

1. To declare that the website, for example
   `https://www.example.com,`can share credentials with
   `https://www.example.co.uk`, create a file named `assetlinks.json` with the
   following content:

       [{
         "relation": ["delegate_permission/common.get_login_creds"],
         "target": {
           "namespace": "web",
           "site": "https://www.example.com"
         }
        },
       {
         "relation": ["delegate_permission/common.get_login_creds"],
         "target": {
           "namespace": "web",
           "site": "https://www.example.co.uk"
         }
       }]

   The `relation` field is an array of one or more strings that describe the
   relationship between the websites. For websites to share sign-in credentials,
   specify the string `delegate_permission/common.get_login_creds`.
   The `target` field is an object that specifies the asset the declaration
   applies to. The following fields identify a website:

   |---|---|
   | `namespace` | Must be `web` for websites. |
   | `site` | The website's URL, in the format `https://domain[:optional_port]`; for example, `https://www.example.com`. |

   See the
   [Digital Asset Links reference](https://developers.google.com/digital-asset-links/v1/statements)
   for details.
2. Host the Digital Asset Links JSON file at the following location on
   the sign-in domain: `https://domain[:optional_port]/.well-known/assetlinks.json`.

   In this example, the domain is `www.example.com`, so the JSON file should
   be hosted at `https://www.example.com/.well-known/assetlinks.json`.

   The MIME type for the Digital Asset Links file needs to be JSON. Make sure
   the server sends a `Content-Type: application/json` header in the response.

   > [!IMPORTANT]
   > **Key point:** The request for a DAL file must return an HTTP `200 OK` status code, otherwise it will be treated as an error. This applies to redirects which return status codes in the `300-399` range.

3. To declare the association in both websites, host the
   `assetlinks.json`at `https://www.example.co.uk/.well-known/assetlinks.json`
   as well:

       [{
         "relation": ["delegate_permission/common.get_login_creds"],
         "target": {
           "namespace": "web",
           "site": "https://www.example.com"
         }
        },
       {
         "relation": ["delegate_permission/common.get_login_creds"],
         "target": {
           "namespace": "web",
           "site": "https://www.example.co.uk"
         }
       }]

4. Ensure that your host permits Google to retrieve your Digital Asset
   Links file. If you have a `robots.txt` file, it must allow the Googlebot
   agent to retrieve `/.well-known/assetlinks.json`. Most websites can
   allow any automated agent to retrieve files in the `/.well-known/` path so
   that other services can access the metadata in those files:

       User-agent: *
       Allow: /.well-known/

> [!NOTE]
> **Note:** It may take a while for Googlebot to fetch the resource and recognize the association.

## Set up seamless credential sharing across multiple websites

You can Set up seamless credential sharing across multiple websites by specifying
each one in the Digital Asset Links file. For example, to associate the
`example.com`, `example.co.uk,`and`example.co.jp`, specify all of those
websites in the `assetlinks.json` JSON file and host it on each website at
`https://EXAMPLE_DOMAIN_NAME/.well-known/assetlinks.json`.

    [{
         "relation":[
            "delegate_permission/common.get_login_creds"
         ],
         "target":{
            "site":"https://www.example.com",
            "namespace":"web"
         }
      },
      {
         "relation":[
            "delegate_permission/common.get_login_creds"
         ],
         "target":{
            "site":"https://www.example.co.uk",
            "namespace":"web"
         }
      },
      {
         "relation":[
            "delegate_permission/common.get_login_creds"
         ],
         "target":{
            "site":"https://www.example.co.jp",
            "namespace":"web"
         }
      }]

> [!NOTE]
> **Note:** You can use include statements if you need to [issue
> statements](https://developers.google.com/digital-asset-links/v1/statements#scaling-to-dozens-of-statements-or-more) from different websites to the same set of targets. For example, a website may be available on many different per-country top level domains, and you want to share credentials between all of them. Using include statements, you can set up pointers from many different websites to one central location, which defines statements for all of them.

Learn more about credential sharing:

- [Seamless credential sharing](https://developers.google.com/identity/credential-sharing)
- [Digital Asset Links](https://developers.google.com/digital-asset-links/)