Glossary

Web Share API

Web Share API is a W3C browser interface that opens the device's native share sheet so a web page can pass a title, text, URL or files to an app the user picks. It adds navigator.share() and navigator.canShare(), and both exist only in secure contexts. The detail developers hit first is that share() must run inside a user gesture such as a click, or it rejects with NotAllowedError.

How it works

You call navigator.share(data) with a ShareData dictionary. Its members are title, text, url and files, and all are optional, though at least one must be present and valid. The method returns a promise. It resolves once the data has been handed to the chosen target or to the operating system, and it rejects if anything goes wrong or the user backs out.

The spec requires transient user activation and consumes it, so a second share() call needs a fresh click. The browser then shows its own picker, which acts as the security confirmation: a page cannot silently send data to a native app.

If url is present, the browser parses it against the page's base URL and shares the serialized result. An empty string therefore means the current page. The snippet below runs the same parsing rule with Node's URL class.

const page = "https://example.com/blog/post?id=7#top";
console.log(new URL("", page).href);
console.log(new URL("/blog/other", page).href);
console.log(new URL("https://example.com/a b", page).href);
try { new URL("http://", page); } catch (e) { console.log(e.name + ": " + e.message); }

Output:

https://example.com/blog/post?id=7
https://example.com/blog/other
https://example.com/a%20b
TypeError: Invalid URL

The first line shows the fragment is dropped when the string is empty. A URL that cannot be parsed makes share() reject with a TypeError.

navigator.canShare(data) validates the same dictionary and returns a boolean. Unlike share(), it needs no user activation, so you can use it on page load to decide whether to show a Share button. Passing files is the main reason to call it, because file support varies by platform and file type.

Which errors can navigator.share() reject with?

navigator.share() rejects with one of four error types. NotAllowedError means no user activation, a policy block, or a blocked file type. AbortError means the user dismissed the sheet or no share target exists. TypeError means the data failed validation. DataError means starting the target or transmitting the data failed. InvalidStateError appears when the document is not fully active or a previous share is still pending.

Common pitfalls

  • Calling share() on page load: with no transient activation the promise rejects with NotAllowedError. Call it only from a click or tap handler.
  • Treating AbortError as a failure: the user closing the sheet rejects with AbortError. Swallow it quietly instead of showing an error toast.
  • Starting a second share too soon: while one share is pending, another call rejects with InvalidStateError. Disable the button until the promise settles.
  • Sharing files without checking: call canShare({ files }) first, since the browser may refuse a file type and reject with NotAllowedError.
  • Using it inside a cross-origin iframe: the web-share feature is off in third-party frames unless the parent allows it with an allow attribute or a Permissions-Policy header.
  • Having no fallback: limited availability means some browsers lack the method. Feature-detect and fall back to a copy-link button.

Related terms

  • HTTPS — the secure context both methods require
  • Permissions-Policy header — can enable or disable the web-share feature in frames
  • URL API — the parser the share URL is resolved with
  • File API — describes the File objects passed in the files member
  • PWA — installed apps often add share buttons for content
  • Blob — the base type that File extends

See also

  • Term: URL API — explains how the shared url string is parsed and serialized