# One Door Authentication

The Verify Token API allows third party systems and client platforms to authenticate users using the YourPropFirm token system. This lets external applications validate user identity without handling login logic themselves.

The token is stored in the browser cookie `Access-Exchange-Key`. Your system must read this cookie, and send it to the Verify Token API.

If the token is valid, the API returns the full user profile. If the token is missing or invalid, the API responds with an error.

<figure><img src="https://835503362-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZxKMBw1IB53ZJ2sltFPC%2Fuploads%2FReu19K114J4BYYbdSwP3%2Fimage.png?alt=media&#x26;token=fd4c09e5-c63a-4ecd-bb90-9198bc9ec22e" alt=""><figcaption></figcaption></figure>

## Authentication & Login Redirect

One Door Authentication allows third-party applications to delegate user authentication to the dashboard. Once a user logs in, they are redirected back to the third-party site with a token that can be verified via the [**Verify Token API**](#verify-token-api) to confirm the user's identity.

This is achieved by appending a `redirectUrl` query parameter to the login page URL.

{% hint style="warning" %}
**Important**

One Door Authentication only works with domains registered under the **same root domain** as the dashboard.
{% endhint %}

**Example**:

```
https://dashboard.domain.com/login?redirectUrl=https://another-app.domain.com
```

## Verify Token API

**Method**: `POST`

**Description**: Validates a YPF authentication token and returns the associated user profile.

**Authentication**: Basic Auth

**Required Header**:

```
X-Client-Key: Tenant Client Key
```

**Endpoint**:

```
https://api.ypf.customers.sigma-ventures.cloud/client/v1/verifytoken
```

**Request Format**:

Cookie your system must read: `Access-Exchange-Key`

**Request Body**:

```json
{
  "ypfToken": "string"
}
```

**Response 200 Success:**

```json
{
  "id": "string",
  "createdAt": "2019-08-24T14:15:22Z",
  "email": "user@example.com",
  "language": "en-US",
  "state": "Initialized",
  "type": "Admin",
  "profile": {
    "addressLine": "string",
    "city": "string",
    "zipCode": "string",
    "country": "string",
    "phone": "string",
    "firstName": "string",
    "lastName": "string",
    "avatarUrl": "string"
  },
  "kycStatus": "string",
  "emailPreferences": "string",
  "contractAgreement": "string",
  "contractTimestamp": "string",
  "lastAccessFrom": "string",
  "requestKyc": true,
  "accountId": "string",
  "subscriptionId": "string",
  "adminNote": "string",
  "noteType": "string"
}
```