SSO Integration Guide

1. Authorize and generate token — Redirect the user to SalesVu for login; receive an access token on your callback URL.
2. SSO login — Redirect the user to SalesVu with the token to complete Single Sign-On.

All SSO endpoints for this environment use https://www.salesvu.com.

From the developer console, open Register SSO Application. Provide an HTTPS redirect URI — it must match host and path exactly on every authorize request.

Client secrets are shown only once at registration or after rotation. View audit logs from SSO Audit Logs in the console.

Endpoint: GET /sso/authorize.php

Parameter	Required	Description
client_key	Yes	Your SSO client key from the developer portal.
client_secret	Yes	Your client secret.
redirect_uri	Yes	HTTPS callback URL registered with your app.
state	Optional	Opaque value returned on redirect (recommended for CSRF protection).

On successful login, SalesVu redirects to your redirect_uri with:

Parameter	Description
token	Access token for SSO login.
state	Same value sent in the authorize request (if provided).

Endpoint: GET /sso/login.php

Parameter	Required	Description
client_key	Yes	Your SSO client key.
client_secret	Yes	Your client secret.
token	Yes	Token from the authorization step.

If credentials and token are valid, the user is logged into SalesVu and redirected to the dashboard. Invalid requests return an error.

Access token lifetime

SSO access tokens are valid for 1 year (365 days / 8760 hours) from the time they are issued during authorization.

• After a token expires (or is revoked), /sso/login.php cannot complete Single Sign-On with that token.
• The user must complete /sso/authorize.php again to obtain a new access token, then retry SSO login.
• If SalesVu detects an expired or revoked token on login, the user is redirected back to the authorization page with a message to sign in again.
• Your application should also treat SSO login failure as a signal to restart the authorize flow (defense in depth).

• HTTPS only — All redirects and callbacks must use HTTPS.
• Protect secrets — Never expose client_key or client_secret in client-side code.
• Use state — Pass a random state value and verify it on callback to prevent CSRF.
• Token expiry — Tokens last 1 year; after expiry, re-run authorize to issue a new token before calling login.
• Monitor audit logs — Review SSO audit logs in the developer console for failed login attempts.

Flow summary:

1. Your app → /sso/authorize.php on SalesVu
2. User login → redirect to your redirect_uri with token and state
3. Your app → /sso/login.php with token
4. SalesVu → user logged into dashboard