Guides: Web Ordering SSO · Innovorder API Documentation

This guide explains how to integrate the Innovorder Web Ordering interface (Commande en Ligne) into a third-party application (WebView or iframe) using a Single Sign-On (SSO) mechanism.

Prerequisites

To generate a valid JWT, you need a Private Shared Key. Please contact Innovorder Support to define this key for your application.

1. The Mechanism

The Web Ordering application accepts a specialized query parameter named autoLoginJWT. When a user navigates to the URL with this parameter, the application attempts to automatically authenticate them.

https://commandes.your-brand.fr/?autoLoginJWT=TOKEN

2. JWT Payload Structure

The token must be a standard JWT signed with your shared secret. It must contain the following claims:

JWT Payload Schema

{
  brandId: number;       // Required: The ID of the brand
  date: string;          // Required: ISO 8601 date (must be less than 1 month old)
  
  // Identification (At least one is required)
  email?: string;        // User's email address
  badgeNumber?: string;  // User's badge number
  
  // Optional Data Sync
  balance?: number;      // Optional: External e-wallet balance to sync
}

Validation Rules

Signature: Must be signed using the secret key provided by support.
Identity: The token must contain either email or badgeNumber. The system tries to find the customer by badge number first, then by email.
Freshness: The date field must be a valid ISO date and not older than 1 month.

3. Authentication Flow

When the Web Ordering app initializes with the token:

Balance Sync (Optional): If balance is provided in the token, the system attempts to update the customer's internal e-wallet balance to match.
Login: The system authenticates the user. If successful, a session is established.
Profile Sync: If email is provided, the user's email address in the profile is updated to match the token.

4. Code Example (Node.js)

Generate Token

const jwt = require('jsonwebtoken');

// 1. Define the payload
const payload = {
  brandId: 691,
  email: "user@example.com", 
  // badgeNumber: "12345", // Optional if email is provided
  date: new Date().toISOString(),
  // balance: 1500 // Optional: 15.00 EUR
};

// 2. Sign with your shared secret (obtained from Support)
const jwtSecret = "YOUR_SHARED_PRIVATE_KEY";
const token = jwt.sign(payload, jwtSecret);

// 3. Construct the URL
const webOrderingUrl = "https://commandes.innovorder.fr";
const ssoUrl = `${webOrderingUrl}/?autoLoginJWT=${token}`;

console.log("Redirect user to:", ssoUrl);