If the user's carrier and operating system combination supports TS.43, the Digital Credentials API can be invoked directly from the Chrome desktop browser. The browser communicates with the user's nearby Android device through a built-in proximity check, which provides an additional layer of security by confirming the phone is physically close to the desktop.

This is the most secure desktop path because it maintains the same cryptographic guarantees as the mobile TS.43 flow, with the added proximity verification.

When TS.43 is not supported, the desktop flow relies on QR code scanning to hand off to the user's mobile device. By design, this decouples the authentication from the device that initiated the flow. The person scanning the QR and completing the carrier authentication on their phone may not necessarily be the same person sitting at the desktop.

For this reason, we recommend using non-TS.43 desktop flows for lower-risk use cases (such as login or account verification), and considering step-up verification for higher-risk actions like payments or sensitive account changes. Alternatively, you can guide the user to complete the entire flow on mobile, where the security model is tighter.