### Author:  [@coneconecone](https://meta.discourse.org/u/coneconecone)
#### Post date: [July 26, 2021, 8:53pm UTC](https://meta.discourse.org/t/possible-to-send-an-email-login-link-via-api/198248/1 "2021-07-26T20:53:27Z")
Hello! I’m really enjoying using the Discourse API!
Following the [guide on reverse engineering the API](https://meta.discourse.org/t/how-to-reverse-engineer-the-discourse-api/20576/27), I’ve hit an issue with getting the API to send a login link.
**Background to why I’m doing this**
I’ve made a SSO service for a local hackerspace so that users can log into our Discourse with the hackerspace membership system.
However, some people may have used a different email address in the membership system to Discourse, and as logging in locally is disabled with SSO enabled, I’d like for people to be able to click “Email me a login link” so that they can be logged in, and then go and update their email address if they choose to (or keep using the login link, whatever)
**Aim**
I’d like to send a login link to user @ domain .co.uk via the API.
I’ve tried this:
```plaintext
curl -X POST "https://discourse..org.uk/u/email-login" --data "{\"login\":\"user"%"40domain.co.uk\"}" -H "Api-Key: xxxxx" -H "Api-Username: system" -H "Content-Type: application/json"
```
What I get back is
```plaintext
You are being redirected.
```
If I do not include the API key, I get `[BAD CSRF]` returned.
**So what I’m stuck on, is just how can I get Discourse to email a login link to user @ domain .co.uk via the API?**
Many thanks for any help, I’m going to keep on trying things and see what works.
* * *
P.s. I’d like not to have to use a hack like:
Make a request to `/session/csrf` and save the CSRF token
Then make a request to `/u/email-login` with the CSRF token.
Is it possible to do this just with an API key?
Thanks!
🙂
---
### Author:  [@coneconecone](https://meta.discourse.org/u/coneconecone)
#### Post date: [July 27, 2021, 11:39am UTC](https://meta.discourse.org/t/possible-to-send-an-email-login-link-via-api/198248/2 "2021-07-27T11:39:51Z")
Just to follow up, is using the CSRF route followed by the email link route the proper way of doing it?
Is there no implementation of this in the API when an API key is provided?
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [July 27, 2021, 2:10pm UTC](https://meta.discourse.org/t/possible-to-send-an-email-login-link-via-api/198248/3 "2021-07-27T14:10:09Z")
How does your SSO service interface with Discourse? If you’re using [DiscourseConnect](https://meta.discourse.org/t/13045?silent=true), then I think the `/u/email-login` endpoint will be disabled.
---
### Author:  [@coneconecone](https://meta.discourse.org/u/coneconecone)
#### Post date: [July 27, 2021, 2:35pm UTC](https://meta.discourse.org/t/possible-to-send-an-email-login-link-via-api/198248/4 "2021-07-27T14:35:34Z")
Thanks for your reply. And yes it’s using [Discourse Connect](https://meta.discourse.org/t/13045?silent=true).
See I thought that too so I disabled [Discourse Connect](https://meta.discourse.org/t/13045?silent=true) and tried to get a login link sent but I couldn’t get it working and is how I got the output on my post above.
If getting an email link is disabled when [Discourse Connect](https://meta.discourse.org/t/13045?silent=true) is enabled then I’ll need to rethink my approach as to how to link up accounts from the membership system SSO service to Discourse.
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [July 27, 2021, 2:43pm UTC](https://meta.discourse.org/t/possible-to-send-an-email-login-link-via-api/198248/5 "2021-07-27T14:43:42Z")
> [@coneconecone](#):
>
> I’ll need to rethink my approach as to how to link up accounts from the membership system SSO service to Discourse
The easiest way, as you mentioned, is for accounts to be matched up by email address. When that’s not possible, there are a couple of approaches we use:
1. Match up users using some other unique identifier. You can pre-create [DiscourseConnect](https://meta.discourse.org/t/13045?silent=true) associations for a user via the console. This will only work if you have some other identifier which is consistent between Discourse and the Identity Provider
2. (most common) allow users to sign up for new accounts, then get them to message an admin and ask for the new account to be “merged” into the old one (using the button at the bottom of user admin page). This will automatically match up the emails, and create the [DiscourseConnect](https://meta.discourse.org/t/13045?silent=true) association.
---
### Author:  [@coneconecone](https://meta.discourse.org/u/coneconecone)
#### Post date: [July 27, 2021, 2:55pm UTC](https://meta.discourse.org/t/possible-to-send-an-email-login-link-via-api/198248/6 "2021-07-27T14:55:41Z")
Thank you for your reply.
The approach of merging accounts is probably what I’ll go for.
It would be a great feature for this process to be self-serve - perhaps through an API where users can log themselves in through an email link where they can then update their email to sync the two.
Or perhaps by allowing a user to authenticate themselves by providing their Discourse email and password, alongside an updated email address.
Thanks again for your time.
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [August 26, 2021, 2:56pm UTC](https://meta.discourse.org/t/possible-to-send-an-email-login-link-via-api/198248/7 "2021-08-26T14:56:17Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.