View source for WHMCS Single Sign-On Developer Guide

WHMCS Single Sign-on allows trusted applications and third parties to authenticate users into a WHMCS installation automatically, without the user having to re-authenticate.

Our Single Sign-On implementation is based on the popular and widely used OAuth 2.0 authorization framework which outlines a secure workflow for accessing user data while protecting their account credentials.

==Single Sign-on Workflow==

Here's how the process works.

# The application requests an access token by sending its credentials to the OAuth Token API Endpoint
# If the application credentials check out, the WHMCS auth server will return an access token to the application
# The application then redirects the user to the Single Sign-On API Endpoint passing in the token and desired destination (scope)
# The user is authenticated and redirected to the requested destination.

Performing Single Sign-On requires an [https://developers.whmcs.com/api-reference/createoauthcredentia OAuth Credential Set]] with the single sign-on grant type.

==Supported Destinations==

<table class="table table-striped">
<tr><td>'''Scope Name'''</td><td>'''Destination'''</td></tr>
<tr><td>clientarea:profile</td><td>My Details</td></tr>
<tr><td>clientarea:billing_info</td><td>Manage Billing Information/Credit Card</td></tr>
<tr><td>clientarea:emails</td><td>My Emails</td></tr>
<tr><td>clientarea:announcements</td><td>Announcements</td></tr>
<tr><td>clientarea:downloads</td><td>Downloads</td></tr>
<tr><td>clientarea:knowledgebase</td><td>Knowledgebase</td></tr>
<tr><td>clientarea:network_status</td><td>Network Status</td></tr>
<tr><td>clientarea:services</td><td>My Products/Services</td></tr>
<tr><td>clientarea:product_details</td><td>Product Details/Information</td></tr>
<tr><td>clientarea:domains</td><td>My Domains</td></tr>
<tr><td>clientarea:domain_details</td><td>Domain Details/Information</td></tr>
<tr><td>clientarea:invoices</td><td>My Invoices</td></tr>
<tr><td>clientarea:tickets</td><td>My Support Tickets</td></tr>
<tr><td>clientarea:submit_ticket</td><td>Open New Ticket</td></tr>
<tr><td>clientarea:shopping_cart</td><td>Shopping Cart Default Product Group</td></tr>
<tr><td>clientarea:shopping_cart_addons</td><td>Shopping Cart Addons</td></tr>
<tr><td>clientarea:shopping_cart_domain_register</td><td>Shopping Cart Register Domain</td></tr>
<tr><td>clientarea:shopping_cart_domain_transfer</td><td>Shopping Cart Transfer Domain</td></tr>
</table>

==Failure Definitions==

The following are the possible error messages you may receive in working with the Single Sign-On API:

''Single Sign-On authentication denied for "Closed" User ID: xx''<br />
Single Sign-On can only be performed for clients in Active or Inactive status.

''Single Sign-On authentication denied per configuration for User ID: xx''<br />
Single Sign-On will not be permitted if the client has disabled it via the Security Settings of their account.

''Unable to authenticate with Single Sign-On token for User ID: xx''<br />
If authentication with the given token fails for an unspecified reason.

''OAuth authorization request denied due to unexpected active login session for "Closed" User ID: xx''<br />
Indicates the user has an existing active session that they are not permitted to have due to the account status being Closed.
No results found.