Skip to main content

Silent login and syncing existing user database

Silent login is an elegant way to streamline the user authentication process, removing the need for users to input credentials repeatedly while ensuring robust security.

Updated over 6 months ago

Overview of Silent Login

Silent login relies on a security hash that authenticates users seamlessly via an iframe. The key components are:

  • Security Hash: A unique hash generated using the user’s email and a secret salt, both of which are securely managed.

  • Pre-synced User Database: A record of authorized users, pre-imported via CSV or API.

  • URL Parameters: Two parameters, email and hash, are passed to the iframe URL to enable silent login.

API Workflow

Step 1

To enable silent login for a client existing in your database, use the following API:

POST /v2/clients/

{

"email": "<email>",

"silent_login_enabled": true

}

Key Points:

  • silent_login_enabled must be set to true.

  • No password or additional details are required.

If the user already exists, the API will return a 422 error. See more info about server-to-server authentication in our developers documentation.

Step 2

Once the client is set up, you can use silent login in an iframe for this user. To do so, construct the URL with the following format:

https://app.digifabster.com/lts/widget/upload?email=<email>&hash=<hash>

The security hash is a critical component of silent login, ensuring that only authorized users can access the system. It is generated using the HMAC algorithm with the SHA-512 hash function.

The security hash is created by combining:

  • Email: The user’s email address.

  • Secret Salt: A private key securely stored on the server provided by DigiFabster.

The formula for generating the hash:

  • HMAC-SHA512(email + secret_salt)

The result is a unique string that serves as a digital signature for the user.

For example, Python’s hmac library provides an easy way to generate HMAC hashes.

import hmac
import hashlib

# User-specific data
user_email = "noreply@digifabster.com"
secret_salt = "your_secret_salt"

# Generate the hash
hash = hmac.new(secret_salt.encode(), user_email.encode(), hashlib.sha512).hexdigest()
print("Generated Hash:", hash)

  • Explanation:

    • hmac.new: Creates a new HMAC object.

    • .encode(): Converts strings to bytes (required for hashing).

    • hashlib.sha512: Specifies the hash function.

Important: Keep the secret_salt secure and server-side only. This ensures the integrity of the hash and prevents unauthorized access.

Once you generate the hash, you can use it as a part of URL to enable passwordless authentication for this user.

Did this answer your question?