Skip to main content

​
High Level Overview

Rollfi supports a streamlined single sign-on flow for embedded partners that want to move a signed-in user from their product into Rollfi without a separate username, password, or two-factor step. In the SSO model, your application authenticates to Rollfi, requests a login link for a known user, and Rollfi returns a short-lived redirect URL that contains a signed JWT.
If you think this flow is a good fit for your integration, please reach out to receive more documentation including example requests and responses.

​
How The Flow Works

  1. Your application signs the user in on your side.
  2. Your backend calls Rollfi using Basic authentication with your clientId and clientSecret.
  3. Your backend sends the user context needed for login.
  4. Rollfi validates the request and confirms the user is allowed to access the requested company.
  5. Rollfi creates a short-lived JWT and appends it to a Rollfi login URL.
  6. Your application redirects the user to that URL.
  1. Use the loginUrl to redirect the user into Rollfi. The JWT is validated and the user is logged in automatically.

​
Security Model

The current flow uses two layers of protection:
  • API authentication between your backend and Rollfi using your clientId and clientSecret
  • JWT signing by Rollfi using RS256 so the final login URL cannot be tampered with
This design keeps the Rollfi signing key on the Rollfi side while still allowing your application to control when a user should be redirected into Rollfi.

​
When To Use The SSO Model

The current Rollfi-signed redirect flow is a strong fit when:
  • You want the simplest partner implementation
  • You want to redirect users from your application without having to worry about the friction of logging them in, or handling authentication