Use Wincora customer authentication

Register your application and invite the identity#

Register the application’s tenant, environment, allowed origins, and session policy. The public applicationId selects that configuration; it is not a credential.

Provision a managed customer identity and its access relationships through the Tenant API. The sign-in contact must belong to that explicit enrollment or invitation. A verified email cannot discover or claim unrelated traveler records.

Start a sign-in challenge#

Generate a fresh cryptographically random verifier, keep it in memory, and send its base64url SHA-256 digest as codeChallenge with method S256. Submit the contact address and registered application ID.

The endpoint returns an indistinguishable accepted response for known and unknown contacts. It sends a one-time code only to an eligible managed identity. Challenges expire after ten minutes; attempts and sends are rate limited.

{
  "applicationId": "app_example",
  "email": "alex@example.com",
  "codeChallenge": "BASE64URL_SHA256_OF_YOUR_VERIFIER",
  "codeChallengeMethod": "S256"
}

Verify the code and proof key#

Submit the one-time code, original verifier, and application ID to the challenge verification endpoint. Verification binds the challenge to the same application, tenant, environment, and enrolled identity, then consumes it once.

Successful verification returns a five-minute customer access token and a single-use managed-session renewal token. Failed verification does not disclose whether a contact address is enrolled.

Rotate the managed session safely#

Exchange the renewal token for a fresh access token and replacement renewal token. Replace the old credential immediately and serialize renewal requests. Reuse of a consumed token revokes its token family.

The managed session has an eight-hour absolute lifetime. Rotation does not extend that deadline. Keep tokens in memory or behind a backend proxy with a secure HttpOnly cookie. On a page reload without an active proxy session, restart sign-in instead of restoring tokens from localStorage.

End the session and its renewal family#

Call DELETE /traveler/session with the current access token, then clear local session state. Server revocation invalidates that session’s access and renewal credentials. Re-enrollment or a changed contact address does not silently reassign old access.

Keep authentication separate from authorization#

CORS restricts browser access from registered origins; it does not authenticate a person. A public application ID cannot read any case. Even after verification, every Traveler operation checks the identity’s current scope and resource relationships.

No tenant API key is sent through this flow. Sign-in challenges and token responses must not be cached, logged, included in URLs, or sent to analytics.