# Sec-Redemption-Record header



The HTTP **`Sec-Redemption-Record`** [Fetch Metadata Request Header](https://developer.mozilla.org/en-US/docs/Glossary/Fetch%20Metadata%20Request%20Header) is used by the [Private State Token API](https://developer.mozilla.org/en-US/docs/Web/API/Private_State_Token_API) when [forwarding redemption records](https://developer.mozilla.org/en-US/docs/Web/API/Private_State_Token_API/Using#redemption_record_usage_2). The header contains a list of issuer and redemption record pairs corresponding to each redemption record.

Note that a developer wouldn't be expected to generate `Sec-Redemption-Record` request headers — these are created automatically by the browser when invoking private state token `send-redemption-record` fetch requests.

<table class="properties">
  <tbody>
    <tr>
      <th scope="row">Header type</th>
      <td>[Fetch Metadata Request Header](https://developer.mozilla.org/en-US/docs/Glossary/Fetch%20Metadata%20Request%20Header)</td>
    </tr>
    <tr>
      <th scope="row">[Forbidden request header](https://developer.mozilla.org/en-US/docs/Glossary/Forbidden%20request%20header)</th>
      <td>Yes (<code>Sec-</code> prefix)</td>
    </tr>
    <tr>
      <th scope="row">
        [CORS-safelisted request header](https://developer.mozilla.org/en-US/docs/Glossary/CORS-safelisted%20request%20header)
      </th>
      <td>No</td>
    </tr>
  </tbody>
</table>

## Syntax

```http
Sec-Redemption-Record: <string>
```

Servers should ignore this header if it contains any other value.

## Directives

- `<string>`
  - : A string containing issuer and redemption record pairs.

## Examples

```http
Sec-Redemption-Record: "https://redeemer.example";redemption-record="eyJwdWJsaWNfbWV0YWR...
```

## Specifications

## Browser compatibility

## See also

- [Sec-Private-State-Token](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Private-State-Token)
- [Sec-Private-State-Token-Crypto-Version](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Private-State-Token-Crypto-Version)
- [Sec-Private-State-Token-Lifetime](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Private-State-Token-Lifetime)
- [Private State Token API](https://developer.mozilla.org/en-US/docs/Web/API/Private_State_Token_API)