Silent Authentication with HMAC

1

Token Generation

The app generates a secure URL that includes the user ID and an HMAC token as query parameters. The generated URL looks like this:

https://{{baseUrl}}?userId=123456&token=iiDBR40qKDODv26FYAvP%3A9mt1BZIA54t84xG9W62d8%2FYoceDrN%2F0OaqaZK1rWQHA%3D%3A3f3929e8-6265-46cd-8e8f-cf151c1fcada%3A1743736311

2

Website Handling

When the user is redirected to the website:

• The website extracts the userId and the token from the query string.
• The website then calls the Tuned Global ValidateHMAC API to validate the token.

3

Validation Process

• Before calling the ValidateHMAC API, the website must URL-decode the token value.
• The decoded token must be included in the Authorization HTTP header as Tuned-HMAC, e.g., Authorization: Tuned-HMAC {token}, with no payload body.
• The token is only valid for 5 minutes from the time it is created and it can be consumed only once. After a successful validation, any further attempts to reuse the same token will fail.

4

Access Token Retrieval

• Upon successful validation, the ValidateHMAC endpoint returns an access token.
• This access token can then be used to retrieve the user’s profile information, including current and available subscriptions.