Skip to main content

Authentication Flow

xTrakt uses a two-step authentication model: first authenticate with the SSO service, then establish a platform session.

sequenceDiagram
  participant Browser
  participant SSO as SSO API
  participant Platform as Platform API
  Browser->>SSO: Authenticate with OIDC PKCE
  SSO-->>Browser: access_token
  Browser->>Platform: POST /user/get-platform-token
  Platform-->>Browser: platform token
  Browser->>Platform: POST /auth/exchange-redirect-code
  Platform-->>Browser: HttpOnly xtrakt_session cookie and CSRF token

Important Details​

  • The SSO API handles OAuth2/OpenID Connect authentication.
  • The frontend exchanges the SSO token for a platform token.
  • The redirect code exchange creates the product session.
  • Mutating requests must send the companion CSRF token.
  • Browser cookies must be available for the xtrakt_session HttpOnly cookie.