which a page can call <a>show()</a>, as described in the <a href=

"#privacy">privacy considerations</a> section.

<section>

<h2>

Exposing available payment methods

</h2>

<p>

Developers might try to call the payment request API repeatedly with

only one payment method identifier to try to determine what payment

methods a <a>user agent</a> has installed. There are legitimate

scenarios for calling repeatedly (for example, to control the flow of

payment method selection). The fact that a successful match to a

payment method causes a user interface to be displayed mitigates the

disclosure risk. Implementations MAY require a user action to

initiate a payment request or they MAY rate limit the calls to the

API to prevent too many repeated calls.

</p>

</section>