> For the complete documentation index, see [llms.txt](https://docs.api.intratool.de/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.api.intratool.de/introduction/authorization/third-party-login.md).

# Third-Party Login

Some applications need to authenticate with intratool in a standard web environment — for example to implement single sign-on on a device.

The login mechanism described here uses a token associated with the user to perform a browser login. The response sets the same cookies that a manual login would set, so the user becomes logged in on the device where the route was called.

This feature is also referred to as "Auto Login URLs".

## Login By Token

There are currently two ways to perform a token-based login:

### Login By User Login Token

[UserLoginTokens](/api-reference/user-login-tokens.md) are short-lived, user-specific tokens that allow a one-time login. Use them like this:

<mark style="color:green;">`GET`</mark> `https://{tenant}.intratool.de/login/token/{userLoginToken}`

Calling this URL logs in the associated [User](/api-reference/users.md) and redirects to the configured default route.

A [UserLoginToken](/api-reference/user-login-tokens.md) can be used only once or until it expires, whichever comes first.

### Login By Access Token

The long-lived access tokens used for [API authorization](/introduction/authorization/authorize.md) can also be used as login tokens by calling the same route with the access token:

<mark style="color:green;">`GET`</mark> `https://{tenant}.intratool.de/login/token/{accessToken}`

This logs in the associated [User](/api-reference/users.md) and redirects to the configured default route.

An access token is **not** revoked when used for login; it remains valid until its normal expiration.