Can I get the session token from a URL?

Yes — Authava supports extracting a session token from the URL if your tenant has explicitly enabled it. This is useful in environments where cookies aren’t available (e.g. iframe embeds, mobile webviews).

🚨 Important Security Notice

We do not recommend using tokens in URLs unless absolutely necessary. URLs can:

• Be logged in browser history
• Be leaked via referrer headers
• Be visible to third-party analytics or logging tools
• Persist in shared links or screenshots

Use only in trusted environments where you control both the embedding app and the receiving iframe/page.

✅ How to Enable It

1. Go to your domain settings via the Authava Dashboard
2. Enable the append_token_to_redirect_url feature
3. Save your settings — it will take effect immediately

🔄 Example

If enabled, you can redirect users like this:

https://yourapp.com/?token=eyJhbGciOiJI...

The @authava/client library will detect the token parameter automatically and store it in localStorage for future session restoration.

This is especially useful when:

• Embedding Authava-protected apps in an iframe
• Working in environments where cookies are blocked or stripped
• Bootstrapping sessions without login flow