# Log in a user via the API
**URL:** https://meta.discourse.org/t/log-in-a-user-via-the-api/42862
**Category:** SSO
**Created:** [April 20, 2016, 8:02am UTC](https://meta.discourse.org/t/log-in-a-user-via-the-api/42862 "2016-04-20T08:02:42Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@wasimkham](https://meta.discourse.org/u/wasimkham)
#### Post date: [April 20, 2016, 8:02am UTC](https://meta.discourse.org/t/log-in-a-user-via-the-api/42862/1 "2016-04-20T08:02:42Z")
I’ve got SSO set up and working with my website. I’m now wondering if it’s possible to log in a user to Discourse automatically, via the API, when someone logs into the website?
This is good so that users do not have to click Log In when they visit Discourse if they’re already logged into the website.
---
### Author:  [@fefrei](https://meta.discourse.org/u/fefrei)
#### Post date: [April 20, 2016, 12:25pm UTC](https://meta.discourse.org/t/log-in-a-user-via-the-api/42862/2 "2016-04-20T12:25:13Z")
Are your users visiting Discourse directly, or via a link you control?
In the latter case, if they are logged in, send them to the `/session/sso` route, which will trigger the normal SSO login.
---
### Author:  [@wasimkham](https://meta.discourse.org/u/wasimkham)
#### Post date: [April 20, 2016, 12:51pm UTC](https://meta.discourse.org/t/log-in-a-user-via-the-api/42862/3 "2016-04-20T12:51:21Z")
Thanks, I didn’t realise about the route. But that’s not exactly what I’m trying to do, I want to log them in, in the background without them realising and without redirects. Is this possible?
Take New Relic for example - [https://discuss.newrelic.com/](https://discuss.newrelic.com/) - Say you’re logged out of Discourse - if you then log into the Support Centre section (not part of Discourse) you’re automatically logged into Discourse, without having to visit [Forums](https://discuss.newrelic.com/session/sso).
I don’t notice any redirects going on after login, but I doubt that they would redirect to every system requiring SSO after a user logs in. I can log into any part of New Relic’s website and Discourse is logged in automatically.
---
### Author:  [@fefrei](https://meta.discourse.org/u/fefrei)
#### Post date: [April 20, 2016, 12:56pm UTC](https://meta.discourse.org/t/log-in-a-user-via-the-api/42862/4 "2016-04-20T12:56:46Z")
This is tricky to do – the API alone cannot do it, because you need to set a cookie.
I’d try embedding the login-route in an invisible iframe once after the user logs in – but that’s an ugly hack.
---
### Author:  [@wasimkham](https://meta.discourse.org/u/wasimkham)
#### Post date: [April 20, 2016, 1:27pm UTC](https://meta.discourse.org/t/log-in-a-user-via-the-api/42862/5 "2016-04-20T13:27:54Z")
Hmm that is ugly, but may be necessary. I hope there could be a different way.
---
### Author:  [@rasheedamir](https://meta.discourse.org/u/rasheedamir)
#### Post date: [May 24, 2016, 8:01am UTC](https://meta.discourse.org/t/log-in-a-user-via-the-api/42862/6 "2016-05-24T08:01:24Z")
@wasimkham we are trying to do exactly similiar thing; and I am just wondering what final approach did you choose?
---
### Author:  [@wasimkham](https://meta.discourse.org/u/wasimkham)
#### Post date: [May 24, 2016, 8:19am UTC](https://meta.discourse.org/t/log-in-a-user-via-the-api/42862/7 "2016-05-24T08:19:29Z")
@rasheedamir I have not implemented anything, it’s not yet a priority so decided to put it in the back seat. If you do find a clean solution in your search I would very much appreciate if you could let me know how you did it.
---
### Author:  [@rasheedamir](https://meta.discourse.org/u/rasheedamir)
#### Post date: [May 24, 2016, 8:23am UTC](https://meta.discourse.org/t/log-in-a-user-via-the-api/42862/8 "2016-05-24T08:23:19Z")
ah ok @wasimkham sure will do
---
### Author:  [@shahidmir](https://meta.discourse.org/u/shahidmir)
#### Post date: [March 16, 2018, 5:54pm UTC](https://meta.discourse.org/t/log-in-a-user-via-the-api/42862/9 "2018-03-16T17:54:11Z")
@wasimkham @rasheedamir
Hi guys, has anyone looked into this any further, i have just stumbled across the same issue ☹
Thanks
---
### Author:  [@parisa](https://meta.discourse.org/u/parisa)
#### Post date: [March 16, 2018, 6:18pm UTC](https://meta.discourse.org/t/log-in-a-user-via-the-api/42862/10 "2018-03-16T18:18:51Z")
I have already suggested something similar.
> [@Passwordless signin via link generated by api](https://meta.discourse.org/t/passwordless-signin-via-link-generated-by-api/79617):
>
> Is it possible? I didn’t see this feature in api. I saw that [passwordless signin via email link](https://meta.discourse.org/t/passwordless-signin-via-email-link/57569) is already planned. Maybe this feature would also be possible? Use-case: users of my android application are signing in with discourse login api. Now in the application, I show some topics to the users which might be of their interest and want to post somthing. When they click on the topic name, I want to open a webpage with that topic being opened and they would be already logged in. They have alre…
---
### Author:  [@shahidmir](https://meta.discourse.org/u/shahidmir)
#### Post date: [March 19, 2018, 12:55am UTC](https://meta.discourse.org/t/log-in-a-user-via-the-api/42862/11 "2018-03-19T00:55:45Z")
Hi, thanks for the info.
So I am trying the following:
Client logs into my app via Auth0 authentication.
On successful authentication, an Auth0 rule kicks in and makes a callback to a page in my app which has a hidden iframe. This hidden iframe simply does a login to disclosure, so when the client clicks on the forum link he will already be logged in.
I am encountering a problem with the payload that is being sent to the disclosure sso URL.
The “nonce” is invalid/timed out.
Since the login is not being initiated via disclosure, I am generating a nonce in my Auth0 rule and sending that back as part of the payload to the disclosure sso URL.
Im unclear on how the nonce works so would appreciate some assistance. Is there a way to disable the nonce check in disclosure? if not, what do I need to do to get this to work?
I imagine disclosure is rejecting the sso login attempt because the nonce it received is one that it did not send in the first place.
Regards