Single Sign-On

High Level Overview

Rollfi supports a streamlined single sign-on flow for embedded partners that want to move a signed-in user from their product into Rollfi without a separate username, password, or two-factor step. In the SSO model, your application authenticates to Rollfi, requests a login link for a known user, and Rollfi returns a short-lived redirect URL that contains a signed JWT.

For more in depth information and examples, please refer to the Rollfi SSO API reference.

How The Flow Works

Your application signs the user in on your side.
Your backend calls Rollfi using Basic authentication with your clientId and clientSecret.
Your backend sends the user context needed for login.
Rollfi validates the request and confirms the user is allowed to access the requested company.
Rollfi creates a short-lived JWT and appends it to a Rollfi login URL.
Your application redirects the user to that URL.

Use the loginUrl to redirect the user into Rollfi. The JWT is validated and the user is logged in automatically.

What Rollfi Puts In The JWT

Rollfi creates the login JWT with these core attributes:

companyId
email
iat
exp
roles when roles are supplied
nbf when clock tolerance is applied

The token is signed with RS256 using a Rollfi-managed private key.

Example Request

{
  "method": "getSsoRedirectLink",
  "email": "user@example.com",
  "companyId": "YOUR_COMPANY_ID",
  "roles": ["w2Employee"]
}

Example Response

{
  "success": true,
  "loginUrl": "https://app.rollfi.xyz/...?...jwt=SIGNED_TOKEN"
}

Security Model

The current flow uses two layers of protection:

API authentication between your backend and Rollfi using your clientId and clientSecret
JWT signing by Rollfi using RS256 so the final login URL cannot be tampered with

This design keeps the Rollfi signing key on the Rollfi side while still allowing your application to control when a user should be redirected into Rollfi.

When To Use The SSO Model

The current Rollfi-signed redirect flow is a strong fit when:

You want the simplest partner implementation
You want to redirect users from your application without having to worry about the friction of logging them in, or handling authentication

​High Level Overview

​How The Flow Works

​What Rollfi Puts In The JWT

​Example Request

​Example Response

​Security Model

​When To Use The SSO Model