Signed SSO Redirect

Signed SSO Redirect lets a club member who is already signed in to the WL App open another of your systems (website, events platform, and so on) without a second login.

Loyal Guru signs a short-lived JWT. Your destination backend validates it and starts the session. In this flow you are both origin and destination: you configure Owner and you receive the member. Loyal Guru only signs. It does not generate or store the public key.

This is not employee SSO (SAML), and it is not the same as WL App SDK authentication (the JWT the host app passes into the SDK). Signed SSO Redirect is an outbound handoff from the WL App to your destination URL.

Who does what

Who	What they do
You	Generate the keys (or the shared secret). Keep what validates. Paste in Owner what signs. Optionally set a Key ID (kid) to version that secret. Publish an HTTPS destination URL. Validate the JWT and create the session. One action per destination URL.
Loyal Guru	WL App + runtime endpoint. Signs the JWT, stamps the configured kid on the JWT header when present, and returns URL + token + whether the App should redirect. Does not validate the token on your site.

Choose an algorithm

Loyal Guru always signs. Your system always validates. Only the material changes.

RS256

Two different keys, both yours.

Piece	Where it lives	Use
Private key (PEM)	Owner (you paste it once)	Loyal Guru signs
Public key (PEM)	Your backend — not in Owner	You validate
Key ID (kid) (recommended)	Owner and your validator (same value), if you use one	Optional version label for this key pair; stamped on the JWT header when set

You generate the pair. Store the public key in your validator. Paste the private key in Owner. Optionally set the same Key ID (kid) in Owner and in your validator so you can version keys. Owner never shows the private key again; if you set a kid, it stays visible.

HS256

One shared secret. There is no public key.

Piece	Where it lives	Use
Shared secret	Owner and your backend (the same value)	Sign and validate
Key ID (kid) (recommended)	Owner and your validator (same value), if you use one	Optional version label for this secret; stamped on the JWT header when set

You generate the secret, paste it in Owner, and configure it in your validator. Optionally set a Key ID (kid) to version the secret. Do not put the secret in a ticket, chat, or email in the clear.

Generate signing material

Replace these steps with your internal PKI if you already have one. The result is what matters.

RS256 — generate the pair

On a trusted machine:

openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out private.pem
openssl pkey -in private.pem -pubout -out public.pem

• private.pem → whoever configures Owner (secure internal channel).
• public.pem → the service that validates the JWT. Do not upload it to Loyal Guru.
• Optionally choose a Key ID (kid) for this version (for example events-2026-09) if you want to version keys in your validator.
• After Owner has the private key, delete stray copies of private.pem.

HS256 — generate the secret

openssl rand -base64 32

Use the same string in Owner and in your validator. If you use a Key ID (kid), store the secret under that same value in both places.

Configure in Owner

Path: Configuration → White Label App → Signed SSO Redirect → New action.

Field	What to enter
Display name	Internal name (for example Club website, Events platform)
Destination URL	Your HTTPS URL that receives the authenticated member
Token expiration	Configurable 60–300 seconds. Default 60.
Signing algorithm	RS256 or HS256
App behaviour	Redirect = the member leaves the app for your site. Return URL = the app uses URL + JWT inside the app.
Customer fields	customer_id is always included in the JWT. Add any extra identity or customer data your destination needs (for example customer code or email). Empty optional fields are omitted.
Key ID (kid)	Optional. Recommended version label for this secret (for example events-2026-09). If you leave it empty, it stays empty. When set, use the same value in your validator; Owner shows it after save and the JWT header carries it.
RS256	Paste only the private key PEM
HS256	Paste only the shared secret

After Save, Owner does not show the private key or secret again. If you set a Key ID (kid), it stays visible.

You need the Signed SSO Redirect permission. App Configuration (app versions) is not enough.

Rotate keys

1. Generate new material. If you use kid, assign a new kid.
2. Put the new public key / HMAC in your validator first (under that kid if you use one).
3. Paste the new signing secret in Owner (and the new kid if you use one).

Leaving the secret blank on edit keeps the current secret and kid.

If you version secrets with kid, keep two versions in your validator during rotation. Incoming tokens tell you which one to use.

What your destination system must do

1. Expose an HTTPS URL ready to receive the member.
2. Validate the JWT before creating a session:
   • If the JWT header includes a kid, pick the matching key or secret.
   • If kid is empty or missing, use the key or secret configured for that action.
   • RS256: verify with your public key.
   • HS256: verify with the same secret that you pasted in Owner.
   • Reject if exp has passed (within the configured TTL, 60–300 seconds).
   • Reject if the signature does not match.
3. Read identity: customer_id is always present. Extra fields only if you selected them in Owner (for example customer code or email). Empty optional fields are omitted.
4. Create or link the session in your system. Loyal Guru does not receive a callback.

Personal data

The token can include PII (email, document, address, and so on) if you select those fields in Owner. This is a transfer between your systems: follow your internal policy and minimise fields.

FAQ

Do we paste the public key in Loyal Guru?
No. It stays in your validator. Owner only stores what is needed to sign, and optionally the Key ID (kid).

Does Loyal Guru generate the keys?
No. You generate them. Each destination URL can have its own.

What is the Key ID (kid)?
An optional version label for the current signing secret. Recommended when you want to rotate keys cleanly. It is not a secret and not required: if you leave it empty, it stays empty. When set, Owner shows it after save and Loyal Guru copies it into the JWT header so your validator can pick the matching key.

What if we lose the private key?
Owner will not show it again. Generate a new pair, update your validator first, then update Owner (and use a new kid if you version secrets that way).

One secret for all of our URLs?
No. One action and one set of material per destination URL.

Is this employee SSO (SAML)?
No. It authenticates the club member into another of your systems, from the WL App.