Enerflo's "Delegated Authentication" leverages OAuth & JWT methodologies to allow external applications to authenticate users in Enerflo without the user's express involvement.
Enerflo's Delegated Authentication
enables an external application to create direct links into Enerflo. When users click from your application to Enerflo, they can be securely authenticated in real-time and seamlessly redirected to the desired Enerflo resource/page without having to manually enter their Enerflo credentials.
See Figure 1.1 for suggestions of a generalized workflow you may consider.
One-time Setup
- Request an
Org Access Key
andOrg Secret Key
This is a one-time setup that will require Enerflo Support involvement. To get started, just scroll to the top of this page and click "Chat Support" to ask us to create an Org Access Key & Secret for use with Delegated Authentication.
Build Your Workflow
-
Does your user already have a valid session? Use
GET https://enerflo.io/check/auth
to request a gated resource (webpage). If the user has already been logged in, then this allows you to bypass the JWT exchange and reduce server load. See full documentation here. If the user is not logged, then proceed to Step 2. -
Request a JWT token. Use
POST https://api.enerflo.io/api/oauth/token
to request a JWT token. Tokens expire in 60 seconds and can be exchanged for a user session as outlined in Step 3. See full documentation here. -
Exchange token and login the user. Use
GET https://enerflo.io/verify/auth
to exchange the token for an active user session and then automatically redirect. Yourtoken
can be provided either as a header value or as a URL parameter.