Session transfer allows you to transfer logged in end user from the system you control into Zoined as logged in user. This is accomplished by creating JSON message with the information about the user and then signing it with cryptographic digest to ensure that message comes from your system and is not tampered with. Payload JSON message structure can be seen above.

After payload JSON is created, digest is calculated from the payload and shared secret which have been provided to you by Zoined, or retrieved via partner API.

Calculation in pseudocode is shown below:

There are two ways to implement session transfer to Zoined. First you can create link based on the instructions, and just redirect user to this link. This is easy to implement, but drawback is that this request will be stored in users browser history. Same link cannot be used to log back in due embedded timestamp, but link contains users name, role, and access restrictons, although encoded with Base64.

Second approach is to make POST request with payload and digest sent as POST parameters. This won't get stored to browser history, but is bit more complicated to implement. Server will need to provide payload and digest to web page in your service, and after that browser needs to do form submit. This can be accomplished e.g. by retrieving data from server via AJAX, filling data to hidden form, and then submitting it via Javascript.

Please note that sending server's time needs to be reasonable synchronized with the global time, as we are using timestamps from server for checking the time based link validity. Payloads with timestamp older than 5 minutes will be discarded. Please also note that shared secret must never be transferred to browser, or otherwise it can be used for unauthorized access. Forming of payload, and calculation of digest needs to happen strictly on server side.