Storage Access API

How it works

In many browsers, a cross-site frame gets no third-party cookies, or only a partitioned copy. The frame calls document.requestStorageAccess() after a click or a tap. If the browser grants access, the promise resolves. If not, it rejects with a NotAllowedError.

The browser stores the grant for the pair of the top-level site and the frame's site. After the grant, the embed must reload itself. The browser then sends the cookies with the new requests. document.hasStorageAccess() tells the frame if it has access already.

Browser rules

Browser	When the browser shows a prompt
Safari	For each embed that did not get access before
Firefox	Only after an origin asked for access on more than a set number of sites
Chrome	For each embed that did not get access before

In October 2025, Google said that Chrome will remove Related Website Sets. Do not count on a set to skip the prompt.

A grant expires after 30 days. The exact rule is different in each browser. The storage-access Permissions-Policy directive also controls if a frame may use the API.

button.addEventListener("click", async () => {
  if (await document.hasStorageAccess()) return;
  await document.requestStorageAccess();
  location.reload();
});

async function askForCookies() {
  if (await document.hasStorageAccess()) return true;
  try {
    await document.requestStorageAccess();
    location.reload();
    return true;
  } catch {
    return false; // denied: open the site in a new tab
  }
}