Implementation

The high level focus of every successful SSO integration centers around the following concepts:

• Generating an SSO token with patient data.

• Providing an SSO token whenever the 98point6 SDK requests it. All tokens live for 15 minutes and partners are responsible for creating refresh logic.

• Providing a publicly available, public key endpoint for 98point6 to validate SSO tokens.

Implementation Best Practices

We recommend partners use the following best practices when implementing SSO:

• DO:

  • Use separate keys and endpoints for each environment (one for staging, one for prod).

  • Treat the RSA256 private-public key pair as you would a master password.

  • Make the SSO token code passing single purpose.

  • Make sure you are switching the private signing key used on the tokens based on the environment.

• DON'T:

  • Store the SSO token anywhere in mobile code. It should be a fleeting item that is only in memory for a brief moment of time. Review any analytics or debugging libraries to ensure that tokens aren’t accidentally collected.

  • Use the same SSO token with multiple accounts. Currently, only one SSO token can be used with one phone number.

  • Pass an empty string as an SSO token. Empty string is not considered a well-formed SSO token.

FAQs

Why do I keep getting an error screen when trying to log in?

You may see one of three main errors when attempting to log in:

• Date of birth token does not match the account on file.

• The phone number already has an associated SSO token.

For other, more general issues:

• If you are receiving a general error screen, it most likely means there is something wrong with your token on a technical level. Refer to the schema above to validate everything within your token is correct and to make sure the public key matches the environment

Why is the account on the SSO token not the account I logged into?

We recommend to validate that you are not caching the SSO token. If you still encounter this issue, contact 98point6 to help with additional debugging

Why are only a few items in the onboarding screen are pre-filled?

While we only require a small subset of items for a token to work if you want pre-filled onboarding it requires the entire token