עמוד קנוני: https://docs.teloring.com/he/api/create-sso-link עודכן לאחרונה: 2026-08-20T20:52:05.000Z # Create a single-use sign-in link import MethodEndpoint from "@theme/ApiExplorer/MethodEndpoint"; import ParamsDetails from "@theme/ParamsDetails"; import RequestSchema from "@theme/RequestSchema"; import StatusCodes from "@theme/StatusCodes"; import OperationTabs from "@theme/OperationTabs"; import TabItem from "@theme/TabItem"; import Heading from "@theme/Heading"; import Translate from "@docusaurus/Translate"; Mint a link that signs one of your agents straight into the console — no login screen, no password. ### Before it will work The `sso` scope alone grants nothing. In **Settings → API**, the credential must also name: - **the agents** it may sign in as. An agent not on that list answers `403` with `code: agent_not_allowed`, and the error lists who *is* allowed. - **the origins** allowed to embed the session, if you plan to open the link in an iframe. Requesting `embed: true` with none configured answers `400` with `code: no_embed_origins`. ### The two modes **`full`** opens the whole console, exactly as if the agent had signed in. **`conversation`** opens one contact's chat and nothing else — no navigation, no conversation list. Supply the contact by `phone` or `email`. If a conversation with them is already open it is opened; if not, the composer opens with the contact pre-selected. Add `inbox_id` and the inbox is chosen too, leaving only the message to write. This is the mode built for an iframe: open it, send a message, close it. ### The link itself Valid for **ten minutes** and redeemable **once** — a URL that bypasses the login screen is a credential, and a credential in a URL ends up in browser history and referrer headers. Mint one per use; do not cache it. Revocation is immediate: at redemption the credential and the agent are re-checked against live data, so removing an agent from the allowlist kills every link already issued for them. ### Embedding With `embed: true` the resulting pages are served with `frame-ancestors` naming only your configured origins, and the session cookie is issued `SameSite=None; Secure; Partitioned` so it lives in your site's own cookie partition and cannot be replayed from anywhere else. In `conversation` mode the embedded page posts a message to the parent window when the agent sends something, so you can close the iframe without polling: ```js window.addEventListener('message', (event) => { if (event.origin !== 'https://console.teloring.com') return; if (event.data?.source === 'teloring' && event.data.type === 'message_sent') { closeMyIframe(); } }); ``` Request