turned out google went ahead and made their [own](https://developers.google.com/privacy-sandbox/3pcd/fedcm) [fucking](https://developer.mozilla.org/en-US/docs/Web/API/FedCM_API) [standard](https://fedidcg.github.io/FedCM/#browser-api-identity-credential-interface) for this and now it's even rendered by the browser in a separate popup window. which is not even properly handled and causes it to be outside of the window sometimes lol