Set up single sign-on for checkout

Steps

1. 1

   In the Foxy admin, set your store’s shared-authentication endpoint URL. This is the URL Foxy redirects customers to whenever a checkout request arrives without a valid fc_auth_token.

2. 2

   On your endpoint, check whether the current user is authenticated on your site, using your existing session or cookie data.

3. 3

   If the customer is authenticated, generate an fc_auth_token by hashing their Foxy customer ID, an expiration timestamp, and your store’s secret key with SHA-1, joined by |.

4. 4

   Redirect the customer to your Foxy checkout URL with fc_customer_id, timestamp, and fc_auth_token as query parameters, plus fcsid if Foxy provided one. See the SSO parameters reference for details on each value.

5. 5

   If the customer isn’t authenticated, either redirect them back to checkout without these parameters, or take another action, such as sending them to a login or registration page.

Example

const crypto = require('crypto');

function generateSsoUrl(customerId, timestamp, secret, storeDomain, sessionId) {
  if (!customerId || !timestamp || !secret) return false;
  const stringToSign = `${customerId}|${timestamp}|${secret}`;
  const token = crypto.createHash('sha1').update(stringToSign).digest('hex');
  let url = `https://${storeDomain}/checkout?fc_customer_id=${customerId}×tamp=${timestamp}&fc_auth_token=${token}`;
  if (sessionId) url += `&fcsid=${sessionId}`;
  return url;
}

Notes

• Use the Foxy SDK’s createSsoUrl function to generate this URL rather than building the hash yourself, where possible.

• The expiration timestamp you hash must exactly match the timestamp you send back to Foxy. Don’t reuse the timestamp Foxy sent to your endpoint — that value is already in the past by the time your endpoint responds.

• A customer using a saved credit card is still asked for the CSC, unless your store’s CSC settings are configured to only require it for new cards.

• To allow an unauthenticated customer through to checkout, set fc_customer_id to 0.

• For guidance on keeping customer records synced with Foxy so a customer ID is available, see Sync customer data for SSO.