User Authentication
When integrating a business system with the workflow engine, unified login allows users to access workflow features without signing in again after logging into the business system.
See Integration with Business Systems for the full integration path.
Overview
The workflow engine uses JWT Token (accessToken) for API authentication. Token lifetime is 5 days. Two common integration patterns:
| Approach | Use case |
|---|---|
| Login API | Backend calls workflow APIs on behalf of the user |
| SSO / unified auth | User opens workflow pages or menus after logging into the business system |
For request/response details, see Get Token.
Unified login
Login adapter
Implement a login authentication adapter to bridge the business system session with the workflow engine. The adapter should:
- Validate the current user session in the business system
- Map the business user to a workflow engine user
- Generate or pass
accessTokenfor subsequent API calls
Passwordless page access
Most workflow pages support browser access via hzToken in the URL. See Authentication — "Using Token".
Related documentation
- Get Token — Login REST API
- Authentication — Token usage in pages and permission management
- Organization Structure — Organization sync (complete before or in parallel)
Best practices
- Token security: Do not store tokens in browser local storage
- Refresh: Refresh tokens before they expire
- HTTPS: Use HTTPS in production when transmitting tokens