Origin-Trial
When a site needs access to experimental browser features in production, the unofficial Origin-Trial response header enables them for a specific origin by providing a vendor-signed trial token.
Usage
Browser vendors, primarily Google Chrome, offer origin trials as a way to test experimental web platform features in production before they become stable. Instead of requiring users to enable feature flags, a site operator registers for a trial through the Chrome Origin Trials portal and receives a Base64-encoded token. The server includes this token in the Origin-Trial response header, and the browser activates the experimental feature for pages served from the registered origin.
Each token encodes a JSON payload containing the origin, the feature name, an expiry timestamp, and whether the trial extends to subdomains. The browser validates the token signature, checks the origin and expiry, and enables the feature if everything matches. Expired or invalid tokens are silently ignored.
A single response supports multiple active trials. Multiple tokens are delivered either as comma-separated values in one header or as separate Origin-Trial headers. Large sites like YouTube, Instagram, and Facebook commonly run several origin trials simultaneously, testing features such as crash reporting APIs and session credential mechanisms.
Values
Base64-encoded token
The value is a Base64-encoded string containing a signed token. The token payload is a JSON object with the following fields:
origin: the registered origin (e.g.,https://example.re:443)feature: the experimental feature name (e.g.,CrashReportingStorageAPI)expiry: a Unix timestamp for when the trial expiresisSubdomain: a boolean indicating whether the trial covers all subdomains of the origin
The outer Base64 string also includes a cryptographic signature prefix the browser uses to verify the token was issued by the trial authority.
Example
A site enrolled in a single origin trial includes the
token in the response. The token below (truncated for
readability) encodes an origin of
https://www.example.re:443, the feature
CrashReportingStorageAPI, and an expiry timestamp.
The browser decodes and validates the token, then
activates the feature for this page load.
Origin-Trial: ArDvqjFKr1fHThlSM8Kkp74sxlOCFTeq...
Sites running multiple origin trials at the same time send comma-separated tokens. Each token activates a different experimental feature independently.
Origin-Trial: AmhMBR6zCLzDDx..., AiDEBptUfVeO93...
The token is opaque to the end user. Decoding the Base64 payload reveals the trial metadata. For instance, a decoded token payload looks like this:
{
"origin": "https://www.example.re:443",
"feature": "CrashReportingStorageAPI",
"expiry": 1776729600,
"isSubdomain": true
}
An alternative to the response header is a <meta>
tag in HTML. Both approaches activate the trial
identically.
<meta http-equiv="origin-trial"
content="ArDvqjFKr1fHThlSM8Kkp74sxlOCFTeq...">
Tokens expire with the trial
A token is issued to expire with the trial itself, a policy change from the early program where tokens lasted six weeks regardless of trial length. The operational story is trial extensions: an extended trial does not extend already-issued tokens, so renewal means generating a fresh token, and a page serving a stale one keeps shipping the header while the feature silently vanishes, since Chrome ignores invalid and expired tokens without any console error naming the header.
Verification happens entirely on the device. The token is a signed, base64-encoded statement of origin, feature, and expiry, checked without network access, and origin matching is exact on scheme, host, and port unless subdomain coverage was requested at registration.
Two placement rules catch teams. Iframes inherit nothing, so an embedded frame needs a token of its own rather than relying on the surrounding page. And third-party tokens work only from an external script element, never from the header, which makes Origin-Trial a first-party channel by construction.
Chrome retires an experimental feature automatically when usage passes half a percent of page loads, a cap lifted only for deprecation trials, which temporarily revive removed features rather than preview new ones.
The mechanism is no longer Chrome-only. Firefox runs origin trials accepting the same header and meta forms, and Edge operates its own program and portal. Safari gates experiments behind per-user feature flags in the Develop menu, so a server-side opt-in reaches the Chromium and Gecko engines.
