# Use discourse for SSO in a non-web app?

**URL:** <https://meta.discourse.org/t/use-discourse-for-sso-in-a-non-web-app/40584>\
**Category:** Development\
**Created:** [March 4, 2016, 6:46pm UTC](https://meta.discourse.org/t/use-discourse-for-sso-in-a-non-web-app/40584 "2016-03-04T18:46:50Z")\
**Posts on this page:** 1\
**Showing post:** 12

<div class="post-metadata">

**Author:** ![X\_Code](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/x_code/32/148529_2.png) [@X\_Code](https://meta.discourse.org/u/X_Code)\
**Post date:** [May 16, 2020, 5:24pm UTC](https://meta.discourse.org/t/use-discourse-for-sso-in-a-non-web-app/40584/12 "2020-05-16T17:24:43Z")

</div>

Hi,  
I am trying to develop mobile app for discourse using flutter.  
I sent GET request of /session/csrf.json to get a csrf token in my mobile app. Next I added header x-csrf-token to send a POST request to upload avatar.

Server log is:

```plaintext
Started POST "/uploads.json" for 98.199.193.94 at 2020-05-16 04:34:48 +0000
Processing by UploadsController#create as JSON
  Parameters: {"type"=>"avatar", "user_id"=>"639", "files"=>[#<ActionDispatch::Http::UploadedFile:0x00007f0b57b32478 @tempfile=#<Tempfile:/tmp/RackMultipart20200516-783-12pa37a.jpg>, @original_filename="image_picker_CE009BE9-D964-459D-B59C-ABE78F1CC5DF-20639-0000AE2EE903C2FC.jpg", @content_type="application/octet-stream", @headers="content-disposition: form-data; name=\"files[]\"; filename=\"image_picker_CE009BE9-D964-459D-B59C-ABE78F1CC5DF-20639-0000AE2EE903C2FC.jpg\"\r\ncontent-type: application/octet-stream\r\n">]}
Can't verify CSRF token authenticity.

```

So what is the right way to get valid csrf token for mobile app?

---

_[View the full topic](https://meta.discourse.org/t/use-discourse-for-sso-in-a-non-web-app/40584)._