Use your existing login
Turn your authenticated application session into scoped access to the Traveler API.
On this page
Register the integration and identity
Configure the integration’s delegation policy and grant customer-sessions:create to a dedicated server credential. Provision a stable customer identity, then grant access to the intended travelers or cases.
The subject is unique within the integration and environment. A different person with the same email must not inherit another identity’s access.
Provision a customer identityAuthenticate on your own surface
The customer signs in using your existing login. Your backend validates its session and derives the subject from that session. Never accept the token subject, tenant, traveler, or resource permissions directly from an untrusted browser request.
Wincora trusts this registered integration to assert its authenticated subjects. It records both the customer identity and issuing integration in the audit trail. Keep this delegation permission separate from ordinary data access.
Request a customer session from your backend
Request only the scopes required by this experience. Wincora resolves the existing identity and relationships, then returns a session ID and a five-minute access token. This flow does not issue a renewal token.
curl --request POST https://api.wincora.com/api/v1/auth/customer-sessions \
--header "X-Api-Key: YOUR_SERVER_API_KEY" \
--header "Content-Type: application/json" \
--data '{"subject":"user_7821","scopes":["traveler:profile:read","traveler:cases:read"]}'Choose direct access or a backend proxy
| Pattern | Token handling |
|---|---|
| Direct browser or mobile access | Your backend returns the short-lived customer token. The app holds it in memory and calls Traveler with a Bearer header. |
| Backend proxy | Your backend retains the Wincora token. The browser uses your secure HttpOnly session cookie; apply CSRF protection to cookie-authenticated mutations. |
const response = await fetch("https://api.wincora.com/api/v1/traveler/cases", {
headers: { Authorization: `Bearer ${customerAccessToken}` }
});
if (!response.ok) throw new Error("Unable to load applications");
const cases = await response.json();Renew through your authenticated backend
Before expiry, ask your backend for another customer session. It must revalidate the tenant application session and current access each time. Wincora token issuance does not extend the tenant’s login session.
Record Wincora session IDs against the tenant login session. At logout, revoke every associated Wincora session. End the tenant session and clear in-memory tokens as well. Revoke current sessions when the user is suspended.
Revoke a customer sessionConnect a registered identity provider
For applications that use an identity provider without a tenant backend, configure federation during onboarding. Use Authorization Code with PKCE S256, exact registered redirect URIs, and issuer-bound subject mapping.
A tenant identity-provider token is not a Traveler access token. The configured authentication service validates its issuer and intended audience before issuing a Wincora customer session. Never accept arbitrary JWTs or use email to merge identities.