# Sec-Private-State-Token-Crypto-Version header



The HTTP **`Sec-Private-State-Token-Crypto-Version`** [Fetch Metadata Request Header](https://developer.mozilla.org/en-US/docs/Glossary/Fetch%20Metadata%20Request%20Header) is used by the [Private State Token API](https://developer.mozilla.org/en-US/docs/Web/API/Private_State_Token_API) during [token issuance](https://developer.mozilla.org/en-US/docs/Web/API/Private_State_Token_API/Using#issuing_tokens_2) to indicate to the issuer server which cryptographic protocol version should be used to sign blinded nonces when generating tokens.

At the time of writing, there is only one version supported, but this mechanism makes it possible to support multiple versions in the future.

Note that a developer wouldn't be expected to generate `Sec-Private-State-Token-Crypto-Version` request headers — these are created automatically by the browser when invoking private state token `token-request` fetch requests.

<table class="properties">
  <tbody>
    <tr>
      <th scope="row">Header type</th>
      <td>[Fetch Metadata Request Header](https://developer.mozilla.org/en-US/docs/Glossary/Fetch%20Metadata%20Request%20Header)</td>
    </tr>
    <tr>
      <th scope="row">[Forbidden request header](https://developer.mozilla.org/en-US/docs/Glossary/Forbidden%20request%20header)</th>
      <td>Yes (<code>Sec-</code> prefix)</td>
    </tr>
    <tr>
      <th scope="row">
        [CORS-safelisted request header](https://developer.mozilla.org/en-US/docs/Glossary/CORS-safelisted%20request%20header)
      </th>
      <td>No</td>
    </tr>
  </tbody>
</table>

## Syntax

```http
Sec-Private-State-Token-Crypto-Version: <string>
```

Servers should ignore this header if it contains any other value.

## Directives

- `<string>`
  - : A string containing the cryptographic protocol version that should be used by the issuer server to sign blinded nonces when generating tokens.

## Examples

```http
Sec-Private-State-Token-Crypto-Version: PrivateStateTokenV1VOPRF
```

## Specifications

## Browser compatibility

## See also

- [Sec-Private-State-Token](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Private-State-Token)
- [Sec-Private-State-Token-Lifetime](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Private-State-Token-Lifetime)
- [Sec-Redemption-Record](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Redemption-Record)
- [Private State Token API](https://developer.mozilla.org/en-US/docs/Web/API/Private_State_Token_API)