# Authentication Protocol re: App Integration

**URL:** https://meta.discourse.org/t/authentication-protocol-re-app-integration/114788
**Category:** Development
**Created:** [April 11, 2019, 5:24pm UTC](https://meta.discourse.org/t/authentication-protocol-re-app-integration/114788 "2019-04-11T17:24:07Z")
**Posts on this page:** 1
**Showing post:** 3

<div class="post-metadata">

### Author: ![pmusaraj](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/pmusaraj/32/119489_2.png) [@pmusaraj](https://meta.discourse.org/u/pmusaraj)
#### Post date: [April 11, 2019, 8:59pm UTC](https://meta.discourse.org/t/authentication-protocol-re-app-integration/114788/3 "2019-04-11T20:59:24Z")

</div>

I’m going to update the documentation about delegated authentication soon, but I can give you some pointers right here.

First you need to open a browser session to `discourse.site/user-api-key/new` with the following parameters:

```plaintext
scopes: 'notifications,session_info,one_time_password',
client_id: YOUR_APP_CLIENT_ID,
nonce: GENERATED_NONCE,
auth_redirect: YOUR_APP_URL_SCHEME,
application_name: YOUR_APP_NAME,
push_url: PUSH_URL (if you are going to send PNs from Discourse to your app),
public_key: PUBLIC_KEY (generated in your app)

```

You can have a look at the implementation of our [DiscourseMobile app](https://github.com/discourse/DiscourseMobile) for details on the above but the main idea is that your app will launch a browser screen to the URL above, asking the user to authenticate to the Discourse site and authorize your app access to it. Once user authorizes access, Discourse will redirect to `YOUR_APP_URL_SCHEME?payload=` with an encrypted payload. You’ll need to set up your app to decrypt the payload and store the authToken. In iOS, you should use [ASWebAuthenticationSession | Apple Developer Documentation](https://developer.apple.com/documentation/authenticationservices/aswebauthenticationsession) (I don’t know if there is an Android equivalent).

Your authToken can make API requests limited by the scopes requested initially, for a full list of scopes, please look under `allow user api key scopes` in site settings.

The `one_time_password` scope allows the authToken to make a request for a one-time-password. The endpoint for this is `/user-api-key/otp` with the parameters `auth_redirect`, `application_name` and `public_key`.

I will write a proper documentation shortly, but this should help you get started.

---

_[View the full topic](https://meta.discourse.org/t/authentication-protocol-re-app-integration/114788)._