{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-products/rest/guides/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":[]},"type":"markdown"},"seo":{"title":"Trust Relationship Authentication","description":"Embed DailyPay On Demand Pay into your applications with our APIs and SDKs.","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"trust-relationship-authentication","__idx":0},"children":["Trust Relationship Authentication"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"goal","__idx":1},"children":["Goal"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use industry standards to power developer access to DailyPay APIs and Embedded Experiences, minimizing user and developer surprise and maximizing user-session reuse."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"approach","__idx":2},"children":["Approach"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use nested OIDC flows to authenticate users for DailyPay using the developer’s Identity Provider."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"methods","__idx":3},"children":["Methods"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Developers will use OAuth2.0 Authorization Code Flow + PKCE and OIDC to retrieve access and refresh tokens for use with ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/rest/reference/"},"children":["DailyPay APIs"]}," and ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/rest/elements"},"children":["DailyPay Elements"]},": see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/rest/guides/auth/authorization-code-flow"},"children":["Authorization Code Flow"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Within the Authorization Code Flow, DailyPay will reach out to the partner’s Identity Provider to identify the user. DailyPay prefers an OIDC Identity Provider wherever possible, and our Auth Server will initiate its own, ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["nested"]}," OAuth2.0 Authorization Code Flow to the partner’s Auth Server. If the partner’s Auth Server identifies an active session, the experience is seamless and potentially zero-touch for the end user, and DailyPay will match the subject identifier from the active session to an identity loaded into DailyPay from the Data Exchange or elsewhere. DailyPay Auth Server will then return the payload needed to complete the Authorization Code Flow and obtain an access token for the API or Element."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Note"]},": An important prerequisite is that a unique identifier for each user is shared across systems, usually through the DailyPay Data Exchange."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The following diagram details all steps of the OIDC-in-OIDC or SAML-in-OIDC approach."]},{"$$mdtype":"Tag","name":"Diagram","attributes":{"data-language":"mermaid","diagramType":"mermaid","diagramSource":"%%{init: {'theme': 'forest'}}%%\nsequenceDiagram\n autonumber\n actor User\n participant Your Auth Server\n participant Your Application\n participant DailyPay Auth Server\n participant DailyPay API\n Your Auth Server-->>User: Has an authenticated session\n User->>Your Application: Clicks on funtionality requiring DailyPay user access\n Your Application->>Your Application: Construct a signed OAuth2 Request URL\n Your Application->>User: Open a webview or secure tab to request URL with iss=your_auth_url\n User->>DailyPay Auth Server: Initiate OAuth2 Authorization Code Flow\n critical OIDC (Preferred)\n DailyPay Auth Server->>User: Redirect to your auth URL with DailyPay client parameters\n User->>Your Auth Server: Login or reuse session\n Your Auth Server->>User: Redirect user to DailyPay callback URL with authorization code\n User->>DailyPay Auth Server: Authorization code\n DailyPay Auth Server->>Your Auth Server: Exchange authorization code\n Your Auth Server->>DailyPay Auth Server: Return access token and (optionally) ID token\n DailyPay Auth Server->>DailyPay Auth Server: Extract unique ID from ID token\n end\n opt SAML\n DailyPay Auth Server->>User: Redirect to your SSO URL\n User->>Your Auth Server: Login or reuse session\n Your Auth Server->>User: Redirect user with SAML response\n User->>DailyPay Auth Server: SAML response forwarded\n DailyPay Auth Server->>DailyPay Auth Server: Validate SAML response\n DailyPay Auth Server->>DailyPay Auth Server: Extract unique ID from SAML\n end\n DailyPay Auth Server->>User: Present terms and conditions\n User->>DailyPay Auth Server: Click to sign terms and conditions\n DailyPay Auth Server-->>DailyPay API: Activate user\n DailyPay Auth Server->>User: Redirect user to your callback URL with authorization code\n User->>Your Application: authorization code\n Your Application->>DailyPay Auth Server: Exchange authorization code\n DailyPay Auth Server->>Your Application: Return API access token\n Your Application->>DailyPay API: Authenticate API calls\n","diagramHtml":"","diagramHtmlDark":""},"children":["%%{init: {'theme': 'forest'}}%%\nsequenceDiagram\n autonumber\n actor User\n participant Your Auth Server\n participant Your Application\n participant DailyPay Auth Server\n participant DailyPay API\n Your Auth Server-->>User: Has an authenticated session\n User->>Your Application: Clicks on funtionality requiring DailyPay user access\n Your Application->>Your Application: Construct a signed OAuth2 Request URL\n Your Application->>User: Open a webview or secure tab to request URL with iss=your_auth_url\n User->>DailyPay Auth Server: Initiate OAuth2 Authorization Code Flow\n critical OIDC (Preferred)\n DailyPay Auth Server->>User: Redirect to your auth URL with DailyPay client parameters\n User->>Your Auth Server: Login or reuse session\n Your Auth Server->>User: Redirect user to DailyPay callback URL with authorization code\n User->>DailyPay Auth Server: Authorization code\n DailyPay Auth Server->>Your Auth Server: Exchange authorization code\n Your Auth Server->>DailyPay Auth Server: Return access token and (optionally) ID token\n DailyPay Auth Server->>DailyPay Auth Server: Extract unique ID from ID token\n end\n opt SAML\n DailyPay Auth Server->>User: Redirect to your SSO URL\n User->>Your Auth Server: Login or reuse session\n Your Auth Server->>User: Redirect user with SAML response\n User->>DailyPay Auth Server: SAML response forwarded\n DailyPay Auth Server->>DailyPay Auth Server: Validate SAML response\n DailyPay Auth Server->>DailyPay Auth Server: Extract unique ID from SAML\n end\n DailyPay Auth Server->>User: Present terms and conditions\n User->>DailyPay Auth Server: Click to sign terms and conditions\n DailyPay Auth Server-->>DailyPay API: Activate user\n DailyPay Auth Server->>User: Redirect user to your callback URL with authorization code\n User->>Your Application: authorization code\n Your Application->>DailyPay Auth Server: Exchange authorization code\n DailyPay Auth Server->>Your Application: Return API access token\n Your Application->>DailyPay API: Authenticate API calls\n"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"guidance-for-developers-without-preexisting-oidc-or-sso","__idx":4},"children":["Guidance for Developers Without Preexisting OIDC or SSO"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In order to establish a trust relationship, DailyPay needs a way to verify the authenticity of the user session that wraps the Authorization Code Flow. OAuth2.0 with OIDC provides a set of mechanisms to establish that trust relationship. Below are the critical elements, that even without full OIDC support, are advised or required to create the highest security and lowest friction user auth experience."]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Accept an OAuth2.0-style GET request (6), and return an authorization code using an http redirect to the DailyPay callback endpoint (8).",{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["If the user is already logged in with an active session (1), the authorization server should detect the session (7) and return the authorization code without prompting the user for additional information."]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Allow only the DailyPay preregistered client to exchange that authorization code (10) for an access token (11), using a client secret or a signature using our public key."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Populate the access token or an OIDC-style JWT Identity Token with signed claims, and provide a way to validate those claims.",{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The claims must include the shared unique identifier for the user (12)."]}]}]}]}]},"headings":[{"value":"Trust Relationship Authentication","id":"trust-relationship-authentication","depth":1},{"value":"Goal","id":"goal","depth":2},{"value":"Approach","id":"approach","depth":2},{"value":"Methods","id":"methods","depth":2},{"value":"Guidance for Developers Without Preexisting OIDC or SSO","id":"guidance-for-developers-without-preexisting-oidc-or-sso","depth":2}],"frontmatter":{"seo":{"title":"Trust Relationship Authentication"}},"lastModified":"2026-07-14T14:30:25.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/products/rest/guides/auth/trust-relationship","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}