Authentication

The OAuth API provides a convenient single sign-on (SSO) mechanism between the partner system and UpCity.

Please note that the OAuth protocol makes use of a shared secret for signing the data that is passed between the two systems. Please contact UpCity to request a secret key if you wish to support SSO for your users.

Authenticating via OAuth

Requesting an UpCity authorization token is done by submitting a signed GET request to our OAuth controller. It is best to do this by using an OAuth client library that takes care of the signing details automatically. Once an authorization token has been acquired, the user can be directed to the UpCity application by setting either the “auth_token” cookie (requires that your UpCity application is on the same domain), or the “remember_token” URL parameter, to the returned token.

GET /oauth/authorize

Required query parameters:

form user_id:The UpCity User ID of the user to authenticate

Expected Response:

oauth_token=abcde12345&oauth_token_secret=vwxyz67890&oauth_callback_confirmed=true

Example Ruby Code:

require 'oauth'

oauth = OAuth::Consumer.new('app_id', 'shared_secret',
                            :site => 'http://upcity.com',
                            :http_method => :get)
response = oauth.request(:get, '/oauth/authorize?user_id=123')
parameters = CGI.parse(response.body)
auth_token = parameters['oauth_token'].first

# as a cookie (requires that your UpCity application is on the same domain)
cookies[:auth_token] = { :value => auth_token, :domain => '.partner.com' }
redirect_to 'http://upcity.partner.com/sites/123'

# as a URL parameter
redirect_to "http://partner.upcity.com/sites/123?remember_token=#{auth_token}"