Sign in with an external provider¶

Target Audience: Developers, Stakeholders

Introduced in Payway 4.10.

Introduction¶

Let your users sign in to your Payway-powered site or app with an existing Google, Microsoft, or Apple account instead of creating and remembering another password. Payway handles the sign-in with the provider and turns it into a normal Payway (SSO2) session — the same session your integration already uses — so for returning users it "just works", and for new users it becomes a short "complete your account" step.

Payway runs the provider sign-in on your behalf, and you never handle Google / Microsoft / Apple client secrets — those are configured per organisation by Adeprimo. Your integration's API user does need the right scopes and SSO2 client enabled, though — see API Users for setup.

Info

This builds on SSO2. If you are new to SSO2, read the Implementation guide first — it reuses its session, landing page, and ticket exchange.

What your users experience¶

First time — the user picks "Continue with Google", approves at the provider, then fills in a short complete-your-account form (terms + any details you require). An account is created and they are signed in.
Returning — the user picks "Continue with Google" and is signed straight in. No form.
They already have a Payway account with that email — for security Payway never links automatically. The user signs in with their password once and can then connect the provider to their account.

Two ways to integrate¶

Path	Who runs the provider sign-in	Best for
Web	Payway, as a redirect flow	web sites
Native app	your app — you obtain the provider `id_token`, then hand it to Payway	iOS / Android apps using the platform sign-in SDKs

Both end in the same Payway session and the same account behind the scenes — a user who signs up on the web is the same account when they later use your app (for Google; see the per-provider notes in the guides).

How accounts are matched¶

When a user signs in with a provider, Payway matches the provider identity to a Payway account and reports one of three outcomes your integration handles:

Outcome	Meaning	What you do
resolved	this provider identity is already linked to an account	nothing — Payway signs the user in
new	no account yet	show your complete-account form, then create — Payway signs the user in
link_required	an account with that email exists but isn't linked to this provider	send the user to your normal login; they connect the provider afterwards

The link between a provider identity and a Payway account is durable, keyed by the provider's stable user id — once connected, that user always matches the same account.

Where it runs¶

Signing in with an external provider spans the two Payway hosts you may already use:

payway-sso (sso.worldoftulo.com) — the sign-in and the session (the same host as SSO2 Identify / Authenticate).
the Payway API (backend.worldoftulo.com) — account creation and connecting / disconnecting a provider.

Providers¶

Google, Microsoft, and Apple are available.

Guides¶

Sign in on the web — the redirect flow for web sites.
Sign in in a native app — the id_token flow for iOS / Android.
Connect a provider to an existing account — let signed-in users manage their connected logins.