Request SSO Access for Your Mini-App

Subject: SSO Access Request - [Your Mini-App Name] Hi RegardingWork Hub Team, I am requesting SSO integration access for a new mini-app in the RegardingWork ecosystem. 📋 Application Details: • Mini-App Name: [e.g., "Easy Pro Design CMS"] • Domain: [e.g., "client.easyprodesign.com"] • Purpose: [Brief description of what the app does] • Target Users: [Who will use this app] 🔧 Technical Requirements: • SSO Domain: [Your full domain: https://yourapp.com] • CORS Origin: [Same as SSO domain for API calls] • Callback URL: [Your callback endpoint: https://yourapp.com/auth/callback] • Service Identifier: [Short name: e.g., "epd-cms"] 🛡️ Security Confirmation: • I confirm this domain is owned and controlled by our organization • I will implement proper token validation using /api/auth/validate • I understand SSO tokens are sensitive and will be handled securely • I will not share or expose Hub authentication tokens 👤 Contact Information: • Developer Name: [Your name] • Email: [Your email] • Organization: [Your company/team] 📚 Implementation Status: • [ ] I have read the SSO Integration Guide: https://hub.regardingwork.com/docs/integration-guide • [ ] I understand the difference between SSO and OAuth • [ ] I have a callback endpoint ready for testing • [ ] I have implemented token validation logic Please add my domain to the SSO allowlist and CORS origins. Thank you! [Your Signature]

When a request is received, admins should follow this procedure:

🔍 Step 1: Verify Request

• ✅ Confirm domain ownership
• ✅ Validate legitimate use case
• ✅ Check domain isn't already added
• ✅ Verify callback URL format

🛠️ Step 2: Add to Systems

1. Add SSO Domain:
   • Go to Admin Panel → SSO Domains
   • Add domain (without https://)
   • Set description and activate
2. Add CORS Origin:
   • Go to Admin Panel → CORS Domains
   • Add full URL (with https://)
   • Set description and activate

🧪 Step 3: Test Integration

• ✅ Verify SSO URL redirects correctly
• ✅ Test callback receives token
• ✅ Confirm token validation works
• ✅ Check CORS allows API calls

📝 Step 4: Deploy & Document

• ✅ Deploy changes to production
• ✅ Notify requester of completion
• ✅ Update internal domain registry
• ✅ Monitor for any issues

---

🔒 Mandatory Security Requirements

• HTTPS Only: All production domains must use SSL/TLS
• Token Validation: Must validate every token with Hub's /api/auth/validate endpoint
• Secure Storage: Never log or expose authentication tokens
• Domain Control: Must prove ownership of requested domain
• Error Handling: Graceful handling of authentication failures