Activate user with an OTP

An user completes a separate Process (e.g., either they onboard for the first time, or they register a new email or mobile to their existing User entity). Once that Process completes, Storefront Gateway will:

Issue an action token for the Activate User Process, and store the token in the cloud.
Send a notification to the newly registered email or mobile. The message contains either a verification link, or a verification One-time Passcode (OTP), or both. Note: The verification type (link or OTP) that Storefront Gateway sends is dependent on your organization’s notification settings and notification templates. These settings are configured during your initial onboarding and integration period with Storefront Gateway.
Return a Proof Key for Action Token (PKAT) to the client application.

In this use case, the user receives an OTP. Therefore, your client application needs to prompt the user to supply that OTP that was sent to their contact channel.

Request

Once the user provides their OTP to your application, the client then calls the Session Token API to invoke the Activate User Process. Your client must supply the OTP and PKAT as URL path parameters:

**GET https://\{your/url\}/session/token?customToken=12345&amp;pkat=sdfsd-gfsdfgsd-sdgsdg-sfddsf-dsfsdf**
<no body>

Custom Token = OTP
”Custom Token” may be a bit confusing at first. When a Process issues an action token, and the token is sent to the user in a clickable redirect URL, the actual internal token ID is appended directly to that URL. However, when the token is sent, the code only represents or correlates to the actual token ID.

Process Complete

If the token and PKAT are valid, then the Process starts. Storefront Gateway activates the User ID (and user’s authN ID), authenticates the user, and returns a 200 HTTP status:

**RESPONSE - body**
{
   "processId": "eec918ff-5db4-4fee-a601-5ff76a099c8e",
   "lastStep": true,
   "runtimeId": 229,
   "userId": 12345,
   "userAuthenticated:" true
}

`processId`	The unique identifier for this instance of the Process.
`lastStep`	Boolean that indicates whether or not this was the last step in the Process.
`runtimeId`	Identifier of the Storefront Gateway Runtime entity currently associated to the Storefront Gateway User entity.About Runtime Entities:Upon user creation or authentication, Storefront Gateway looks for a JRUNTIMEID cookie in the user’s browser or application. If no cookie is found, Storefront Gateway creates a Runtime Entity with a unique ID and associates it to the user during the login phase. Storefront Gateway will generate and pass a corresponding JRUNTIMEID cookie for clients to store and return with subsequent requests.
`userId`	The unique identifier of the current user.
`userAuthenticated`	Boolean that indicates if the user was authenticated into Storefront Gateway.
The Process also authenticates the user (if they are not already authenticated). Going forward, the user can authenticate with this activated authN ID and their password.

Note: If the user supplies an incorrect OTP three times, then the Session Token API will fail and stop responding. The user would then need to request a verification message resend. They can do this through one of three methods:

Token Resend API — Resends the same new action token (i.e., the same link). Ideal for use cases where the user is anonymous. Requires the corresponding PKAT.
Send Verification Process — Issues and sends a new action token (i.e., a new link). Ideal for use cases where the user is authenticated.
Authenticate User Process — If an end user attempts to sign in with an unverified authN ID, Storefront Gateway will issue and send a new action token. The Process then ends without authenticating the user.

Once the user receives another verification message (regardless of whether it’s a new token or the same token) they are then free to supply the OTP again. Parent topic:Activate User (and User Attribute) Process

Home

Introduction

For Merchants

For Resellers

Partner Ecosystem Management

Commerce Engine

Storefront Experience

APIs

Request

Process Complete

​Request

​Process Complete

Request

Process Complete