Frequently Asked Questions

Ria's SSO token is not a traditional access, ID, session, or refresh token. Instead, it’s a secure, unique, encrypted block of user and device information used specifically for initializing a single sign-on session. It allows Ria to recognize and authenticate a returning user without requiring them to re-enter their credentials.

The SSO token is AES-encrypted and tightly linked to specific device and user information at the time of generation. When Ria receives the token, it decrypts and verifies the data — any mismatch triggers a block to prevent unauthorized access.

Ria ensures that only the partner’s application can access the experience by validating the app’s package name or domain and continuously checking that the SDK is running inside the approved environment. Additionally, all SSO tokens generated are tied to the partner’s configuration.

Although the SSO token is used to seamless log in, if a user logs in from a new device, our app detects it and requires an OTP verification, even if the token is valid. Only verified devices can continue.

Partners do not need to trigger different flows manually. The SDK reads the initialization parameters and automatically decides which experience to launch. If the partner provides an SSO token, the SDK starts the returning-user flow and logs the customer in. If no SSO token is provided, the SDK begins the new-user registration flow.

A customer is returning if the partner already has an SSO token for that user stored in their system. If no SSO token exists, the customer should be treated as new.