IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
Native-to-web SSO
Maya is signed in to the phone app. She taps a link that opens a web page, and suddenly she faces a login box again. Native-to-web SSO carries the sign-in across. Your goal: explain the four steps and why a ticket in a URL is safe enough.
- The app trades its refresh token for a one-time ticket.
- The ticket is single-use and lasts about 60 seconds.
- The web app redeems it and gets its own tokens.
- The refresh token never reaches the browser.
The gap between native and web
A native app is an app installed on the phone. It signs in over an API and holds a refresh token. But it has no browser session to give to the web app it opens. So the web app has nothing to trust.
The fix is a session-transfer token. It is a one-time ticket that lasts about 60 seconds. The web app uses it to sign the user in quietly. It gets its own separate session.
🎟️ Mint
The native app trades its refresh token for a single-use ticket. This is much like token exchange.
🚀 Deliver
It opens the web app and passes the ticket in the URL. Inside an in-app WebView, a cookie can carry it.
🔑 Redeem
The web app gives the ticket to /authorize. The IdP checks it and signs the user in with no first-factor prompt.
🔒 Seal
The web app's backend swaps the resulting code for its own tokens. It seals them in an HttpOnly cookie.
Two ways to redeem
With front-channel, the browser visits the IdP and is sent back. This always works, but a screen may flash by.
With back-channel, the backend calls /authorize itself. It seals the session on the server. This is silent.
Either way, the user now has two separate sessions for one identity. They have different clients, cookies and tokens. Each refreshes and ends on its own. If Maya signs out of the web app, the native app stays signed in.
Three properties make a ticket in a URL safe enough. It is single-use and lasts about 60 seconds. The refresh token never reaches the browser. And the redemption is tied to the user who started it. A session made from a ticket also cannot make another ticket until the next interactive login.
The gate of a housing society. At the main gate, the watchman gives Maya a one-time stub. At the clubhouse door, staff tear the stub and give her the clubhouse's own entry card. A torn stub is dead. If the clubhouse cancels her card, her main gate pass still works.
Go deeper: names and standards
The name "session-transfer token" and the 60 seconds follow one vendor. Yours may differ.
Minting the ticket is like token exchange, defined in RFC 8693.
🧪 Interactive lab — enable JavaScript to play with this one.
Inspect a token exchange or delegation grant with Token Exchange Check.