Single Sign-On

Every Inklura app (the console, SMS Designer, SEO, Mail, point of sale, support) shares one login. SSO relies on two mechanisms:

  1. OpenID Connect with PKCE: each app authenticates the user against the shared identity provider, and the session held by that provider makes later logins seamless.
  2. A session hand-off from the console: to open a sibling app for a user already signed in to the console, without a new login (used for iframe embedding).

For authentication in general (session cookies, Bearer JWTs, invitation links), see Authentication.

OpenID Connect with PKCE

The identity provider is auth.1clic.pro. Each app is registered there as an OIDC client and signs users in with the authorization code flow and PKCE (S256). The tool apps (SMS Designer, Mail Designer, SEO…) are public clients, with no client secret, and request the scopes openid profile email offline_access.

One session cookie per app

When the user returns from the identity provider, each app creates its own session cookie, scoped to its host. The cookie has no Domain attribute: it is not shared across subdomains.

Why the user stays signed in from one app to the next

A shared cookie is not what produces this. What is shared is the session held at auth.1clic.pro. When an already signed-in user reaches a second app, that app's OIDC round trip completes without a password prompt, and the app creates its local cookie.

app B: no local cookie ──> redirect to auth.1clic.pro
       session already open ──> immediate authorization ──> /auth/callback
       app B creates ITS OWN session cookie

Session hand-off from the console

To open a sibling app for a user already signed in to the console (for example inside an iframe), the console issues a short-lived signed token and redirects the browser to the target app. The app verifies the token and opens its own session.

The token:

  • carries only the signed-in user's own identity (name, email, organization) and the site selected in the console: it cannot be used to act as someone else;
  • is addressed to the target app, which checks it before accepting it;
  • expires after two minutes.

The launch route

GET https://manage.inklura.fr/api/manage/designer-sso?app=<key>&next=<path>&embed=1
Parameter Purpose
app The app to open, e.g. mail, sms, seo, support, pos
next The path to land on in the app (a local path, truncated to 512 characters; /manage by default or when the value is not a local path)
embed 1 when the app is shown in a console iframe

The route requires a console session: without one, the browser is sent to the console login page, and an unknown app redirects to /manage. Otherwise it redirects to the target app, which verifies the token, opens its session, and redirects to next.

console (signed in) ──GET /api/manage/designer-sso?app=mail&next=/manage&embed=1
   token issued for the mail app (valid for two minutes)
   302 ──> maildesigner.inklura.fr, which verifies the token
      session opened ──> 302 /manage

Same site or new tab

Apps served on the console's own domain (*.inklura.fr), such as Mail, SMS, SEO, support and point of sale, are shown in an iframe. Apps that live on another domain open in a new tab, because a cross-site iframe does not receive their session cookie. The rule has exceptions both ways: an app on another domain can be shown in an iframe when it sets a partitioned cookie, and some apps open in a new tab even though they are on inklura.fr. See Iframe Embedding.

See also