> For the complete documentation index, see [llms.txt](https://docs.api.intratool.de/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.api.intratool.de/introduction/authorization/third-party-login.md).

# Third-Party Login

Third-party applications can authenticate a [User](/api-reference/users.md) in a browser environment, for example to provide single sign-on on a shared device.

The login mechanism described here uses a token associated with the user to perform a browser login. The response sets the same cookies that a manual login would set, so the user becomes logged in on the device where the route was called.

This mechanism is also referred to as an auto-login URL.

## User Login Token

[UserLoginTokens](/api-reference/user-login-tokens.md) are short-lived, user-specific tokens for a one-time browser login.

<mark style="color:green;">`GET`</mark> `https://{tenant}.intratool.de/login/token/{userLoginToken}`

Calling this URL signs in the associated user and redirects the browser to the configured default route.

A `UserLoginToken` remains valid until it is used once or expires, whichever occurs first.

## Access Token

The long-lived access tokens used for [API authorization](/introduction/authorization/authorize.md) can be passed to the same login route:

<mark style="color:green;">`GET`</mark> `https://{tenant}.intratool.de/login/token/{accessToken}`

Calling this URL signs in the associated user and redirects the browser to the configured default route.

Using an access token for browser login does not revoke it. The token remains valid until its normal expiration.