Appearance
Sign-in options
Your customers sign in to your product one of two ways. You pick per product, and you can use both.
| Bring your own login | Use Vabu ID | |
|---|---|---|
| Who runs the login | You | Vabu |
| What your customers see | Your sign-in screens | Your screens, calling Vabu ID's login routes |
| How Vabu learns who they are | Your server signs a short customer token | Vabu issues the access token |
| Good for | An app that already has users | A new product, or a phone-first audience that signs in with WhatsApp or Google |
Bring your own login
You keep your users, your sign-in screens and your user ids. When a customer needs something from Vabu, your server says who they are.
- From your server. Use a secret key and name the customer in the request with your own id. Send
external_idon objects you create so you can find them again. See metadata and external_id. - From a browser or an app. Your server signs a short token for the signed-in customer. The browser sends it with a publishable key. Vabu checks the signature and acts for that customer. See customer tokens. This is how a viewer opens a stream session without a second login.
Customer tokens cover Streams and Access today: opening and keeping alive a viewing session. For the other products, signing in with tokens from your own identity provider is on What's coming.
Use Vabu ID
Vabu ID is Vabu's login service. Your app calls its routes to sign a person in, and gets back an access token and a refresh token.
Ways to sign in:
| Method | How it works |
|---|---|
| WhatsApp or SMS code | The person enters a phone number and a six-digit code. WhatsApp first, SMS as a fallback. |
| Email link | The person asks for a link and opens it. |
| Google, Apple or Facebook | A redirect to the provider and back to your page. |
| Login with Payd | For people who already have a Payd account. |
A person who signs in through your tenant becomes a customer of your tenant. Their token carries your tenant's id and the customer's id, so your API calls know who they are. Tokens are signed with ES256 and last 15 minutes. Check them on your server against the public keys at /.well-known/jwks.json. Refresh them with the refresh token. The routes, the token claims and the rules are on the Vabu ID page.
Vabu ID and streaming
A Vabu ID token does not open a stream session by itself. Playback sessions take a customer token from your server. So with Vabu ID the flow is:
- The customer signs in with Vabu ID. Your app sends the access token to your server.
- Your server verifies it and reads the customer's id from the token (
cus, orsubfor the person). - After a payment, your server grants an entitlement to that id.
- Your server signs a customer token with the same id as
sub, and your page uses it to open a session.
Using the same id in steps 3 and 4 is what ties the viewer to the access you granted.
Which to pick
If you already have accounts, keep them and add customer tokens. If you do not, use Vabu ID, so you do not build OTP, magic links and social sign-in yourself.