I think a polling mechanism is a good idea, but the browser needs to get the user's consent before handing this information over to the merchant (just like when asking permission for a web site to use the location api for instance).
This means that when the merchant calls the polling function, a dialog will be displayed saying something like "The website 'abcmerchant.com' wants to access your payment apps. Allow / Deny".
I'm not sure whether this should be a permission to use the entire payments api, or just the polling function. A permission for the entire payments api might be the better choice.
---
You are receiving this because you commented.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/webpayments/issues/159#issuecomment-233282418