Single Sign-On (SSO)

Process Between external applications and the MTT Platform

The SSO mechanism is designed for the external application → MTT platform login flow, not the other way around.

This endpoint was added to the CRM-API to support external integrations that do not store or manage user passwords.

It allows generating a One-Time Token (OTT), which lets a user log in to the platform without needing their password. This enables seamless redirection of an authenticated user from an external application (e.g. a Client Office or other third-party tool) to the platform without re-entering their trading credentials.

Security Requirements

Access to this endpoint is protected on two levels:

• Your API Key must have the rights enabled to call this endpoint (API ACCESS → Create One Time Token for Login).
• The IP address used for the request must be whitelisted by our Support Team.

Endpoint Details

Method: POST Path: /v1/one-time-token

Parameters:

1. email - the user’s email address (the account you want to generate the token for)
2. validityTime - token expiration time in seconds

Example cURL

 
curl --location '{baseURL}/v1/one-time-token' \
--header 'Content-Type: application/json' \
--header 'Authorization: {APIKey}' \
--data-raw '{
  "email": "test@match-trade.com",
  "validityTime": 30
}'

Demo environment details:

• baseURL: {baseURL}
• APIKey: xxx

Demo platform test credentials

• Link: https://mtr-demo-prod.match-trader.com/

How to Test the One-Time Token

After generating a token, open this link in your browser: {platformURL}/?auth={oneTimeToken} Example: https://mtr-demo-prod.match-trader.com/?auth={oneTimeToken}

This will automatically log in the user associated with the given email.

Example Scenarios

• Valid login: You generate a token valid for 30 seconds and log in within that time → login works.
• Expired token: You generate a token valid for 30 seconds but try after it expires → token is invalid. Generate a new token and repeat.
• Regenerated token: You generate a token valid for 1 hour, but then issue a new token valid for 15 minutes → the first token becomes invalid, and only the latest one works.