Integration guide for passwordless, magic-link sign-on.
Use this for all live, user-facing applications.
https://login.one-click-login.net
Contains latest features. Internal team discussion required prior to use.
http://login.one-click-login.net/
Register your service in the App Registration Page to receive your app_id. Ensure your application environment contains the master ENCRYPTION_KEY required to verify tokens locally.
You have two options for rendering the login interface for your users:
Redirect unauthenticated users directly to this Auth Service, passing your App ID in the URL query parameters. We will handle the form rendering and validation.
GET http://login.one-click-login.net/?app_id=YOUR_APP_ID
Build your own custom login screen within your application. Submit a standard HTML form POST request to this endpoint (http://login.one-click-login.net/) with a form-data payload containing:
email: The user's corporate email address.app_id: Your registered application ID.The auth aervice evaluates authorization rules and emails a 15-minute magic link via Mailgun. To bypass security scanners (like Microsoft Defender) pre-fetching and burning tokens, users are routed to a manual confirmation page.
Upon confirmation, the user is redirected to your Callback URL via a GET request with the signed JWT appended:
GET https://your-app.com/callback?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
Your application must capture the token query parameter and verify its signature using the HS256 algorithm and your shared environment secret. A successfully decoded JWT payload signature will look like this:
{
"sub": "user@bayer.com",
"app_id": "your_app_id_string",
"exp": 1715694200
}Note: Ensure your JWT library validates the exp (expiration) claim automatically to reject expired sessions.