Skip to main content

Single Sign On (SSO)

This endpoint is used to authenticate the user using your own existing authentication system.


GET /sso_login/?sig=<hmac-signature>&sso=<payload>

To generate SSO URL, you need to generate

  1. Payload
  2. HMAC signature


The payload is a special string which is generated as follows

  • Concatenate the parameters in the following table with &
  • Encode the concatenated string with base64 encoding.
email/usernamestringEmail Address or username of the user respectively
timestringTime since epoch

Example with email

Example with username
import base64, time

epoch_time = int(time.time())
query_string = "{}".format(epoch_time)
payload = base64.b64encode(query_string)


The above snippet returns payload as shown below


HMAC Signature

HMAC (Hash-based message authentication code) is used to avoid tampering during the request flow. We use a time-based HMAC algorithm to limit the lifetime of the HMAC.

To generate the HMAC signature, the following are need

  • payload - Generate from the above step
  • secret_key - Obtained from Testpress Team
import hashlib, hmac, time

epoch_time = int(time.time())
query_string = "{}".format(epoch_time)
payload = base64.b64encode(query_string)

secret_key = "abcxyzqwerty"
hmac_signature =, payload, hashlib.sha256).hexdigest()


The above snippet returns HMAC signature as shown below



The SSO URL format is as shown below<hmac-signature>&sso=<payload>

In the above URL replace the {hmac-signature} and {payload} with your hmac signature and payload values generated using the above steps.


The epoch time limits the validity of the HMAC. We have a 30 minute delta to ensure the validity of the HMAC. For e.g. if the HMAC was generated at 10.30 AM, it will be valid only for the next 30 minutes and expires after 11.00 AM.