Silent Authentication with HMAC
Silent authentication with HMAC (Hash-based Message Authentication Code) is a secure method that allows a music app to automatically sign users into a website through either a webview or an external web browser on the device. This approach offers a seamless user experience by eliminating the need for users to manually log in again when accessing website-exclusive features, such as:
- Viewing detailed profile information
- Managing subscriptions (non-Inapp)
By bridging the app and website functionalities, silent authentication significantly enhances user convenience and engagement, while maintaining strong security protocols.
How it Works
1
Token Generation
The app generates a secure URL that includes the user ID and an HMAC token as query parameters. The generated URL looks like this:
https://{{baseUrl}}?userId=123456&token=iiDBR40qKDODv26FYAvP%3A9mt1BZIA54t84xG9W62d8%2FYoceDrN%2F0OaqaZK1rWQHA%3D%3A3f3929e8-6265-46cd-8e8f-cf151c1fcada%3A1743736311
2
Website Handling
When the user is redirected to the website:
- The website extracts the userId and the token from the query string.
- The website then calls the Tuned Global ValidateHMAC API to validate the token.
3
Validation Process
- Before calling the ValidateHMAC API, the website must URL-decode the token value.
- The decoded token must be included in the
AuthorizationHTTP header as Tuned-HMAC, e.g.,Authorization: Tuned-HMAC {token}, with no payload body. - The token is only valid for 5 minutes from the time it is created and it can be consumed only once. After a successful validation, any further attempts to reuse the same token will fail.
4
Access Token Retrieval
- Upon successful validation, the ValidateHMAC endpoint returns an access token.
- This access token can then be used to retrieve the user’s profile information, including current and available subscriptions.
The following flow chart assumes you are using Tuned Global’s Whitelabel Application.
Implementation Details
- URL Decoding: Always URL-decode the token before using it. The token in the query string will be URL-encoded.
- Header Format:
Authorization: Tuned-HMAC {token}
On this page
- Silent Authentication with HMAC