# Can I use the Discourse API to authenticate users in another app?

**URL:** <https://meta.discourse.org/t/can-i-use-the-discourse-api-to-authenticate-users-in-another-app/266322>\
**Category:** SSO\
**Created:** [May 26, 2023, 2:29pm UTC](https://meta.discourse.org/t/can-i-use-the-discourse-api-to-authenticate-users-in-another-app/266322 "2023-05-26T14:29:17Z")\
**Posts on this page:** 1\
**Showing post:** 14

<div class="post-metadata">

**Author:** ![supermathie](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/supermathie/32/507518_2.png) [@supermathie](https://meta.discourse.org/u/supermathie)\
**Post date:** [May 30, 2023, 3:51pm UTC](https://meta.discourse.org/t/can-i-use-the-discourse-api-to-authenticate-users-in-another-app/266322/14 "2023-05-30T15:51:18Z")

</div>

> [@ygramoel](#):
>
> No idea what that means.

as admin, enable `verbose discourse connect logging`, try it, then check `/logs` on your forum to see more detailed errors, e.g. `https://forum.embeetle.com/logs`

You’ll see e.g.:

 ![image](https://global.discourse-cdn.com/meta/original/4X/d/d/e/dde6beecc5fbc3f60b4c289a4bf778cb82f14abc.png)

> [@ygramoel](#):
>
> `payload_for_url.encode('utf-8')`

You need to sign the payload, not the quoted payload, e.g.:

```plaintext
signature = hmac.new(
  sso_secret, payload_base64.encode('utf-8'), hashlib.sha256
).hexdigest()

```

And then it works!

> [@ygramoel](#):
>
> ```plaintext
> sso_secret = b'JCLSVcqbAnEPXz2p2xBY'
> 
> ```

BTW, you need to revoke and change this secret immediately because anyone with it can log onto your app as I’ve just done while testing this.

---

_[View the full topic](https://meta.discourse.org/t/can-i-use-the-discourse-api-to-authenticate-users-in-another-app/266322)._