Skip to main content

Create a single-use sign-in link

POST 
/sso/login

Mint a link that signs one of your agents straight into the console — no login screen, no password.

Before it will work​

The sso scope alone grants nothing. In Settings → API, the credential must also name:

  • the agents it may sign in as. An agent not on that list answers 403 with code: agent_not_allowed, and the error lists who is allowed.
  • the origins allowed to embed the session, if you plan to open the link in an iframe. Requesting embed: true with none configured answers 400 with code: no_embed_origins.

The two modes​

full opens the whole console, exactly as if the agent had signed in.

conversation opens one contact's chat and nothing else — no navigation, no conversation list. Supply the contact by phone or email. If a conversation with them is already open it is opened; if not, the composer opens with the contact pre-selected. Add inbox_id and the inbox is chosen too, leaving only the message to write. This is the mode built for an iframe: open it, send a message, close it.

Valid for ten minutes and redeemable once — a URL that bypasses the login screen is a credential, and a credential in a URL ends up in browser history and referrer headers. Mint one per use; do not cache it.

Revocation is immediate: at redemption the credential and the agent are re-checked against live data, so removing an agent from the allowlist kills every link already issued for them.

Embedding​

With embed: true the resulting pages are served with frame-ancestors naming only your configured origins, and the session cookie is issued SameSite=None; Secure; Partitioned so it lives in your site's own cookie partition and cannot be replayed from anywhere else.

In conversation mode the embedded page posts a message to the parent window when the agent sends something, so you can close the iframe without polling:

window.addEventListener('message', (event) => {
  if (event.origin !== 'https://console.teloring.com') return;
  if (event.data?.source === 'teloring' && event.data.type === 'message_sent') {
    closeMyIframe();
  }
});

Request​

Responses​

Link created. Valid for ten minutes, once.

Response Headers
    X-Request-Id

    Correlation id for this request. Quote it when reporting a problem.