# Auto login and token exchange

Auto Login turns a token from your backend into a signed-in Genuin member, so someone signed in to your site or app is signed in to Genuin without a second login and without Genuin seeing your credentials. The sequence, the token contract, and session refresh are explained in [How Auto Login works](https://begenuin.com/developers/developer-resources/guides/genuin-auto-login); signing out and expired sessions are in [Sign members out and handle expired sessions](https://begenuin.com/developers/developer-resources/sdk/sign-members-out-and-handle-expired-sessions).

## Pass the token

| Platform | Call |
| --- | --- |
| Web | window.genuin.init({ embed_id, api_key, token: "{{SSO_TOKEN}}", params: { name, email, mobile, nickname, profileImage } }) |
| iOS | GenuinSDK.shared.ssoLogin(ssoToken: "{{SSO_TOKEN}}", params: params) { success in } |
| Android | GenuinSDK.ssoLogin(context = this, ssoToken = "{{SSO_TOKEN}}", params = params) { isSuccess -> } |
| React Native | import { ssoLogin } from 'genuin-react-native'; ssoLogin('{{SSO_TOKEN}}', { name, email }), or the ssoToken prop on the embed |
| Flutter | GenuinSdk().ssoLogin('{{SSO_TOKEN}}') once for the whole app |
| Any embed | ssoToken / setSSOToken on the embed itself; skip the separate call |

**Sign out** – `GenuinSDK.shared.ssoLogout()` on iOS, `GenuinSDK.ssoLogout(context)` on Android, `ssoLogout()` in React Native and Flutter; the SDKs call `POST /api/v4/auth/signout` for you.

**Let the SDK ask your app to sign in** – implement `GenuinDelegate.presentLoginViewController(baseViewController:)` on iOS or `GenuinInterface.onLogin(context)` on Android, or define `window.genuinAuth` on the web, then call `ssoLogin` after your own login succeeds.

**Choose the method** – Genuin sign-in, single sign-on through your identity provider (see [Set up single sign-on with your identity provider](https://begenuin.com/developers/developer-resources/guides/log-in-seamlessly-across-your-brand-ecosystem-using-sso)), or Auto Login: [Choose how members sign in to the Genuin SDK](https://begenuin.com/developers/developer-resources/guides/user-authentication-mechanisms-in-genuin-sdk) compares them.

## API & SDK

Access: the calls in the table are the proposed Business Account API (see [Business Account API: provisioning, OAuth, and the resource map](https://begenuin.com/developers/get-started/any-business/business-account-api-provisioning-oauth-and-the-resource-map)), authenticated with a key scoped to the account and a role or an OAuth client acting for it; every confirmation in this article becomes a proposal you can approve by API (`POST /proposals/{proposalId}:approve`). Live today, the server API under `/api/thirdparty` authenticates with a `gn-access-token` (see [Generate an access token](https://begenuin.com/developers/developer-resources/api/generate-access-token-using-authentication-api)), and [Live API today and the Business Account API roadmap](https://begenuin.com/developers/developer-resources/guides/live-api-today-and-the-business-account-api-roadmap) maps what is live to what is proposed.

| Call | Purpose |
| --- | --- |
| POST /sessions | Auto login token exchange: your signed user token for a Genuin session |
| PUT /brands/{brandId}/auth | Auto login provider, claims passed, consent behaviour, member-only communities |

```js
// proposed server SDK (Business Account API)
import { Genuin } from '@genuin/sdk';
const genuin = new Genuin({ apiKey: process.env.GENUIN_KEY });
await genuin.sessions.create({ token });
await genuin.auth.update(brandId, { provider: 'okta', claims: ['hashed_email'] });
```

Live today: [Add members to a community](https://begenuin.com/developers/developer-resources/api/add-members-to-a-community-programmatically-api) · [How Auto Login works](https://begenuin.com/developers/developer-resources/guides/genuin-auto-login) · [Update a group and its members](https://begenuin.com/developers/developer-resources/api/add-or-manage-group-members-collaborators-using-api).

SDKs: Web SDK 2.0.6 (see [Embed the Genuin Web SDK on your website](https://begenuin.com/developers/developer-resources/sdk/how-do-you-embed-and-configure-the-genuin-web-sdk-on-your-website)), iOS SDK 2.1.5 (see [Integrate the Genuin iOS SDK](https://begenuin.com/developers/developer-resources/sdk/developer/genuin-sdk/native-compatibility/ios/how-to-integrate-and-power-your-brand-community-in-ios-apps)), Android SDK 2.1.5 (see [Integrate the Genuin Android SDK](https://begenuin.com/developers/developer-resources/sdk/how-to-integrate-and-power-your-brand-community-in-android-apps)), React Native 3.0.3 (see [Integrate the Genuin SDK with React Native apps](https://begenuin.com/developers/developer-resources/sdk/how-do-you-integrate-the-genuin-react-native-sdk-into-your-application)), and Flutter (see [Integrate the Genuin SDK with Flutter apps](https://begenuin.com/developers/developer-resources/sdk/how-do-you-integrate-the-genuin-flutter-sdk-into-your-application)) render Genuin and sign members in; the Node (`@genuin/sdk`) and Python (`genuin`) server SDKs are proposed with [Business Account API: provisioning, OAuth, and the resource map](https://begenuin.com/developers/get-started/any-business/business-account-api-provisioning-oauth-and-the-resource-map).