# Authentication Protocol re: App Integration
**URL:** https://meta.discourse.org/t/authentication-protocol-re-app-integration/114788
**Category:** Development
**Created:** [April 11, 2019, 5:24pm UTC](https://meta.discourse.org/t/authentication-protocol-re-app-integration/114788 "2019-04-11T17:24:07Z")
**Posts on this page:** 17
**Page:** 1
### Author:  [@justin.noom](https://meta.discourse.org/u/justin.noom)
#### Post date: [April 11, 2019, 5:24pm UTC](https://meta.discourse.org/t/authentication-protocol-re-app-integration/114788/1 "2019-04-11T17:24:07Z")
Hey all! My team and I have been looking into possible ways to integrate our [future] Discourse instance into our mobile application - Noom. Our iOS app is written in Objective-C with some Swift, and our Android application is written in Java with some Kotlin. We’ve been debating between full integration via API or web view as our goal is an SSO flow where our users can seamlessly transition from an in-app experience to our Discourse instance.
I’m currently waiting on our QA team to get back to me on which authentication protocols we currently use, but I was curious as to anyone else’s experience integrating Discourse into a mobile application with or without SSO, and what methods (if any) you found most useful throughout the process. I’m aware of Discourse’s compatibility with OAuth/2, although not aware of other potential protocols.
My apologies if this is in the wrong category!
---
### Author:  [@hosna](https://meta.discourse.org/u/hosna)
#### Post date: [April 11, 2019, 6:48pm UTC](https://meta.discourse.org/t/authentication-protocol-re-app-integration/114788/2 "2019-04-11T18:48:11Z")
There is a new way of authentication. However the documentation is yet to be released.
> [@Delegated authentication for Discourse Mobile app](https://meta.discourse.org/t/delegated-authentication-for-discourse-mobile-app/110414):
>
> Originally when we built the mobile app Apple offered seamless embedding of Safari in mobile apps. All was good, you could log in to Safari, and magically with one click have the application authenticated. However, fast forward a few years and Apple released iOS 11. Sadly, this broke [“shared cookies”](https://blog.branch.io/ios-11-safari-view-controller-cookie-passthrough-and-the-future-of-mobile-web/), this meant that you had to log in to the application web sites AGAIN after already being logged in, in Safari. To add additional layers of pain crying_cat_face , cookie management in Safari Vi…
---
### Author:  [@pmusaraj](https://meta.discourse.org/u/pmusaraj)
#### Post date: [April 11, 2019, 8:59pm UTC](https://meta.discourse.org/t/authentication-protocol-re-app-integration/114788/3 "2019-04-11T20:59:24Z")
I’m going to update the documentation about delegated authentication soon, but I can give you some pointers right here.
First you need to open a browser session to `discourse.site/user-api-key/new` with the following parameters:
```plaintext
scopes: 'notifications,session_info,one_time_password',
client_id: YOUR_APP_CLIENT_ID,
nonce: GENERATED_NONCE,
auth_redirect: YOUR_APP_URL_SCHEME,
application_name: YOUR_APP_NAME,
push_url: PUSH_URL (if you are going to send PNs from Discourse to your app),
public_key: PUBLIC_KEY (generated in your app)
```
You can have a look at the implementation of our [DiscourseMobile app](https://github.com/discourse/DiscourseMobile) for details on the above but the main idea is that your app will launch a browser screen to the URL above, asking the user to authenticate to the Discourse site and authorize your app access to it. Once user authorizes access, Discourse will redirect to `YOUR_APP_URL_SCHEME?payload=` with an encrypted payload. You’ll need to set up your app to decrypt the payload and store the authToken. In iOS, you should use [ASWebAuthenticationSession | Apple Developer Documentation](https://developer.apple.com/documentation/authenticationservices/aswebauthenticationsession) (I don’t know if there is an Android equivalent).
Your authToken can make API requests limited by the scopes requested initially, for a full list of scopes, please look under `allow user api key scopes` in site settings.
The `one_time_password` scope allows the authToken to make a request for a one-time-password. The endpoint for this is `/user-api-key/otp` with the parameters `auth_redirect`, `application_name` and `public_key`.
I will write a proper documentation shortly, but this should help you get started.
---
### Author:  [@justin.noom](https://meta.discourse.org/u/justin.noom)
#### Post date: [April 15, 2019, 3:16pm UTC](https://meta.discourse.org/t/authentication-protocol-re-app-integration/114788/4 "2019-04-15T15:16:37Z")
@hosna + @pmusaraj Thank you both! I will pass this information along to our QA director.
---
### Author:  [@venedie](https://meta.discourse.org/u/venedie)
#### Post date: [March 26, 2020, 1:07pm UTC](https://meta.discourse.org/t/authentication-protocol-re-app-integration/114788/5 "2020-03-26T13:07:00Z")
> [@pmusaraj](#):
>
> I will write a proper documentation shortly, but this should help you get started.
@pmusaraj hey, is there already any official documentation available to the public? I’d love to dig deeper.
---
### Author:  [@xceph](https://meta.discourse.org/u/xceph)
#### Post date: [March 26, 2020, 7:35pm UTC](https://meta.discourse.org/t/authentication-protocol-re-app-integration/114788/6 "2020-03-26T19:35:34Z")
I’m going to tackle this exact thing over the next few days, I will update on my success or failure. If anyone has any guides or pointers I’d welcome them 🙂
---
### Author:  [@pmusaraj](https://meta.discourse.org/u/pmusaraj)
#### Post date: [March 26, 2020, 8:44pm UTC](https://meta.discourse.org/t/authentication-protocol-re-app-integration/114788/7 "2020-03-26T20:44:08Z")
I think you’re looking for [User API keys specification](https://meta.discourse.org/t/user-api-keys-specification/48536) and specifically the section " API key generation flow".
---
### Author:  [@xceph](https://meta.discourse.org/u/xceph)
#### Post date: [March 26, 2020, 11:42pm UTC](https://meta.discourse.org/t/authentication-protocol-re-app-integration/114788/9 "2020-03-26T23:42:22Z")
Hey Penar, thanks for the guidance, I’m far from an expect in this stuff, I havent done much with any cryptography, or apis like this before and was wondering if you could provide some help as to how to encode some of these parameters? I’m looking at your DiscourseMobile app but I have never used JS before, so I’m having a few difficulties.
nonce and client\_id - Are these just random 16 and 32 byte strings hex encoded?
public\_key - Any guidance on how to generate this? I’m trying to use the [resource here](https://developer.apple.com/documentation/security/certificate_key_and_trust_services/keys/generating_new_cryptographic_keys?language=objc) which would leave me with a SecKeyRef, am I to convert this to NSData and then UTF8 encode?
Wouldn’t happen to have any snippets in swift or objective c would you? I’ll figure this out, its just all new to me so any bit of help is appreciated.
---
### Author:  [@pmusaraj](https://meta.discourse.org/u/pmusaraj)
#### Post date: [March 27, 2020, 12:55am UTC](https://meta.discourse.org/t/authentication-protocol-re-app-integration/114788/10 "2020-03-27T00:55:17Z")
> [@xceph](#):
>
> nonce and client\_id - Are these just random 16 and 32 byte strings hex encoded?
> public\_key - Any guidance on how to generate this? I’m trying to use the [resource here](https://developer.apple.com/documentation/security/certificate_key_and_trust_services/keys/generating_new_cryptographic_keys?language=objc) which would leave me with a SecKeyRef, am I to convert this to NSData and then UTF8 encode?
nonce is a random key, see `generateNonce` here: [DiscourseMobile/js/site\_manager.js at main · discourse/DiscourseMobile · GitHub](https://github.com/discourse/DiscourseMobile/blob/master/js/site_manager.js#L348-L354)
client\_id is the app’s deviceToken, it is passed to the app via [GitHub - react-native-push-notification/ios: React Native Push Notification API for iOS. · GitHub](https://github.com/react-native-community/push-notification-ios)
public\_key is generated by [GitHub - SamSaffron/react-native-key-pair · GitHub](https://github.com/SamSaffron/react-native-key-pair), that library is pretty small, and the relevant parts are in Objective C.
---
### Author:  [@xceph](https://meta.discourse.org/u/xceph)
#### Post date: [March 27, 2020, 3:45pm UTC](https://meta.discourse.org/t/authentication-protocol-re-app-integration/114788/11 "2020-03-27T15:45:16Z")
Hey Penar, thanks for the links very useful.
I’m making progress but believe I’m formatting my public key incorrectly, how does the formatting on this look?
`https://myserver.com/user-api-key/new?client_id=11223344556677889900AABBCCDDEEFF11223344556677889900AABBCCDDEEFF&nonce=11223344556677889900AABBCCDDEEFF&application_name=AppName&public_key=-----BEGIN%20PUBLIC%20KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtoNwaYpbUcX1vqxPkxRA%0D1EyfLPxkKL6zgx4Fkk9zkYbTPTWQFuqy+O1EJtVnsW+Tx8iarFLI+ypghcx22nI0%0DN/hDFYsaT/xri+LLDc790uf2UtyolgBJfkyjJDxIXXy0pdpi6f2dgKMN2holDkxf%0DTUUnZad+wE8gT8IciX1XjU97MOngSV+IDeKPLomTuTiI1Z0hJe4WDww5+53ci4o4%0DoE5A79H/Fz/QY8vDLTcBNrQ6OdJYsRqhE5M+1sNmxpqDKT+9NcAPY7yphxm1iLuV%0Dm7c6K/xrbZExGDQd1qHvggT2ldMJIsmQEnleMdfuaYLh8+EYt8LNQ8X86V0Jj+9C%0DmQIDAQAB-----END%20PUBLIC%20KEY-----&auth_redirect=appname://auth&scopes=notifications,session_info,one_time_password`
In the log console I see :
OpenSSL::PKey::RSAError (Neither PUB key nor PRIV key: nested asn1 error) /var/www/discourse/app/controllers/user\_api\_keys\_controller.rb:189:in `initialize’
Thanks
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [March 27, 2020, 4:09pm UTC](https://meta.discourse.org/t/authentication-protocol-re-app-integration/114788/12 "2020-03-27T16:09:27Z")
I just published a script to do this exact thing @xceph.
Check [Generating User API Keys for testing](https://meta.discourse.org/t/generating-user-api-keys-for-testing/145744).
---
### Author:  [@xceph](https://meta.discourse.org/u/xceph)
#### Post date: [March 27, 2020, 4:21pm UTC](https://meta.discourse.org/t/authentication-protocol-re-app-integration/114788/13 "2020-03-27T16:21:11Z")
Thanks! I just made progress, my issue was in the encoding of the parameters, I was using iOS’s URLQueryAllowedCharacterSet, which does not encode “/” or “+”, once I created a test ruby script to isolate out the line I was crashing on I was able to work backwards. Thanks!
---
### Author:  [@xceph](https://meta.discourse.org/u/xceph)
#### Post date: [March 30, 2020, 1:46pm UTC](https://meta.discourse.org/t/authentication-protocol-re-app-integration/114788/14 "2020-03-30T13:46:02Z")
Can’t seem to get the redirect to work properly, using the ASWebAuthenticationSession as Penar suggested. The calls seems to work as expect, I get the “Authorize” dialog and upon clicking it I am brought to a plain white screen, which I expect is the attempt to do the redirect, but it does not close and send the information to my callback.
I’ve tested that my custom URL works fine from Safari, and furthermore if I remove the auth\_redirect I am presented with the “We have just generated a new user API key to use..” site, so everything other than the redirect seems to be working.
Furthermore, and this is likely related, I’ve noticed if I try and put a hyperlink in a discussion using my custom URL it is not clickable, am I missing a setting to allow for custom urls, any help is appreciated 🙂
edit: of course, i find this immedatly after asking. In settings you do indeed need to set “Allowed user api auth redirects” to your custom schema.
---
### Author:  [@pmusaraj](https://meta.discourse.org/u/pmusaraj)
#### Post date: [March 30, 2020, 2:01pm UTC](https://meta.discourse.org/t/authentication-protocol-re-app-integration/114788/15 "2020-03-30T14:01:44Z")
> [@xceph](#):
>
> The calls seems to work as expect, I get the “Authorize” dialog and upon clicking it I am brought to a plain white screen, which I expect is the attempt to do the redirect, but it does not close and send the information to my callback.
Plain white screen is most likely a sign that the server is running into an error. When you try this again, check your Discourse site’s `/logs`, there’s probably something there. You probably are running into an issue where the same client id cannot be registered multiple times. Might need to manually clear that client ID on the Discourse instance, only doable via rails console ATM.
---
### Author:  [@xceph](https://meta.discourse.org/u/xceph)
#### Post date: [March 30, 2020, 5:44pm UTC](https://meta.discourse.org/t/authentication-protocol-re-app-integration/114788/16 "2020-03-30T17:44:44Z")
Yea it was form the : “Allowed user api auth redirects” setting in the admin panel, needed to set that and it worked fine.
Currently I can authenticate, but having trouble decoding the payload on iOS. I can take the received payload and my private key and decode them in Ruby or NodeJS to prove its working, but getting getting iOS to decode it directly is trickier than I thought for me.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [March 31, 2020, 4:01am UTC](https://meta.discourse.org/t/authentication-protocol-re-app-integration/114788/17 "2020-03-31T04:01:33Z")
If you look at the source code for our app there are examples on how to do the decoding, it was a rather complicated amount of code to get it all working.
---
### Author:  [@xceph](https://meta.discourse.org/u/xceph)
#### Post date: [March 31, 2020, 10:18am UTC](https://meta.discourse.org/t/authentication-protocol-re-app-integration/114788/18 "2020-03-31T10:18:41Z")
Thanks, I managed to get it all working, I’ll post some snippets later to help anyone else looking to do this natively on iOS. Appreciate the guidance.
Once you’ve created the API token in this way can it be used to authenticate a login in a webview? I had assumed that’s what the app was doing but I’m still workin on that piece now. Trying to provide both API access and the ability to browse via the normal web Clint reface via a single login