> For the complete documentation index, see [llms.txt](https://docs.coda.co/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.coda.co/coda-webstore/user-login/frictionless-login.md). # Frictionless Login If your users are already logged into your mobile app, Coda's Frictionless Login allows them to access your web store without re-entering credentials. This feature uses secure JWT tokens to seamlessly transfer authentication from your app to the web store. ## When should you use Frictionless Login? You want to eliminate login friction. With Frictionless Login, the authentication is done within your app by your existing system. Upon successful authentication, user tokens and details are then shared with your web store. ## Frictionless Login user journeys There are three scenarios that users normally find themselves in before a login attempt. #### Scenario 1: User is redirected to the web store from in-app **Behaviour**: The user lands on the web store in a logged-in state. #### Scenario 2: User visits the web store directly on their browser (mobile) **Behaviour**: The user sees a Login call-to-action (CTA). On clicking the CTA, the user will be redirected to the app, where they must perform authentication in order to be redirected back to the web store in a logged-in state. #### Scenario 3: User visits the web store directly on their browser (desktop) **Behaviour**: The user sees a Login CTA. On clicking the CTA, the user is shown a QR code. Scanning the QR code with their phone will redirect the user to the app, where they must perform authentication. Upon successful authentication, the desktop browser page will refresh to log the user in. ## Integration requirements * You must generate secure, short-lived JWT tokens containing user authentication data * Your JWT tokens must include both the player ID and authentication credentials * You must use a private key for token encryption and share the public decryption key with Coda securely * All redirects must use HTTPS and follow the URL format: `https://store.example.com?sessiontoken=` * Tokens should expire within 1-2 minutes and be single-use only #### JWT token structure Your JWT token must include: * `sub`: player ID * `exp`: expiration (60-120 seconds recommended) * `jti`: unique identifier to prevent token reuse * `aud`: "webstore" as intended audience * Signed with your private key using RS256 algorithm #### Web store token processing 1. **Token validation**: The web store validates the JWT signature using your public key and checks expiration and audience claims. 2. **Session creation**: Upon successful validation, the web store creates a secure session cookie or exchanges the token for a long-lived session via your authentication API. 3. **Account linking**: The web store links the authenticated session to the player ID, creating a new account if one doesn't exist. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.coda.co/coda-webstore/user-login/frictionless-login.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.