> For the complete documentation index, see [llms.txt](https://developer.gyfti.fr/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.gyfti.fr/single-sign-on-sso.md).

# Single Sign-On (SSO)

SSO allows you to automatically connect a user to Gyfti from an external application using a JWT token generated via the API.

## Automatic Authentication

This method allows an external application to automatically log a user into Gyfti without requiring them to create an account or manually sign in.

The steps:

1. The application generates a user JWT token using the Gyfti API.
2. The application redirects the user to Gyfti with this token.
3. Gyfti automatically authenticates the user.

***

## Get your API Key

Before generating a token, you must retrieve your **Gyfti API key**.

1. Log in to your Gyfti account
2. Go to the [**Settings** ](https://app.gyfti.fr/reglages/portail?p=integrations\&tab=api)page
3. Copy your **API key**

⚠️ This key is used to authenticate your API requests. It must remain **confidential** and should only be used on the server side.

***

## 1. Generate a user token

For each user you want to automatically log in, you must first generate a **secure JWT token**.

Send a **POST** request to the following endpoint:

```
POST https://gyfti-widget.replit.app/api/create-token
```

#### Headers

```
Authorization: Bearer YOUR_API_KEY
Content-Type: application/json
```

#### Body

```json
{
  "email": "user@example.com",
  "companyName": "gyfti-admin",
  "firstName": "John",
  "lastName": "Doe"
}
```

#### Parameters

| Parameter   | Description                   |
| ----------- | ----------------------------- |
| email       | User email address            |
| companyName | Name of your company on Gyfti |
| firstName   | User first name               |
| lastName    | User last name                |

***

#### Example using cURL

```
curl -X POST https://gyfti-widget.replit.app/api/create-token \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
  "email": "user@example.com",
  "companyName": "gyfti-admin",
  "firstName": "John",
  "lastName": "Doe"
}'
```

***

#### Example response

```json
{
  "success": true,
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
   "destinationUrl": "https://app.gyfti.fr/login_partner/1634657344041x544157150139120900?
    token=eyJhbGciOiJIUzI1NiIs..."
}
```

***

## 2. Redirect the user to Gyfti

Once the token is generated, redirect the user to the **destinationUrl** recived from the previous response:

```
https://app.gyfti.com/login_partner/{company-id}?token=YOUR_TOKEN
```

Example:

```
https://app.gyfti.com/login_partner/00000000?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
```

***

## 3. Automatic authentication

When the user arrives at this URL:

1. Gyfti verifies the token
2. The user is automatically created if they do not already exist
3. The user is logged into their Gyfti workspace

No manual action is required from the user.

***

## Integration flow

```
External Application
        │
        │ 1. Request token
        ▼
Gyfti API
        │
        │ 2. Returns JWT
        ▼
External Application
        │
        │ 3. Redirect user
        ▼
Gyfti
        │
        │ 4. Automatic authentication
        ▼
User logged in
```

***

💡 **Tip**

For security reasons:

* Generate the token **server-side**
* Never expose your **API key** in client-side code