Frictionless Login

If your users are already logged into your mobile app, Coda's Frictionless Login allows them to access your web store without re-entering credentials. This feature uses secure JWT tokens to seamlessly transfer authentication from your app to the web store.

When should you use Frictionless Login?

You want to eliminate login friction. With Frictionless Login, the authentication is done within your app by your existing system. Upon successful authentication, user tokens and details are then shared with your web store.

Frictionless Login user journeys

There are three scenarios that users normally find themselves in before a login attempt.

Scenario 1: User is redirected to the web store from in-app

Behaviour: The user lands on the web store in a logged-in state.

Scenario 2: User visits the web store directly on their browser (mobile)

Behaviour: The user sees a Login call-to-action (CTA). On clicking the CTA, the user will be redirected to the app, where they must perform authentication in order to be redirected back to the web store in a logged-in state.

Scenario 3: User visits the web store directly on their browser (desktop)

Behaviour: The user sees a Login CTA. On clicking the CTA, the user is shown a QR code. Scanning the QR code with their phone will redirect the user to the app, where they must perform authentication. Upon successful authentication, the desktop browser page will refresh to log the user in.

Integration requirements

• You must generate secure, short-lived JWT tokens containing user authentication data

• Your JWT tokens must include both the player ID and authentication credentials

• You must use a private key for token encryption and share the public decryption key with Coda securely

• All redirects must use HTTPS and follow the URL format: https://store.example.com?sessiontoken=<one-time-token>

• Tokens should expire within 1-2 minutes and be single-use only

JWT token structure

Your JWT token must include:

• sub: player ID

• exp: expiration (60-120 seconds recommended)

• jti: unique identifier to prevent token reuse

• aud: "webstore" as intended audience

• Signed with your private key using RS256 algorithm

Web store token processing

1. Token validation: The web store validates the JWT signature using your public key and checks expiration and audience claims.

2. Session creation: Upon successful validation, the web store creates a secure session cookie or exchanges the token for a long-lived session via your authentication API.

3. Account linking: The web store links the authenticated session to the player ID, creating a new account if one doesn't exist.