Guest Login Flow

Guest Login lets users access your application without prior registration, while still using the standard cidaas OAuth2/OIDC authorization flow.

Use this flow when you want low-friction entry (for example browsing, trial usage, guest cart) and can defer full account creation.

---

At a Glance

Item	Value
Purpose	Authenticate a temporary guest identity and continue OAuth/OIDC flow
Entry API	Authorization Request
Guest API	Trigger guest login
Finalization API	Login using Username / Password
Required app setting	Apps -> App Settings -> Guest Login -> Enable -> Save

---

When to Use Guest Login

• Users need immediate access before registration
• Access scope is intentionally limited
• Business flow supports later account upgrade or identity linking

Do not use guest login as a substitute for stronger authentication where user-level assurance is required.

---

Prerequisites

Requirement	Details
Client configuration	Valid client_id, allowed redirect_uri, supported OAuth/OIDC flow
Guest login enabled	App-level Guest Login toggle must be enabled in cidaas Admin Dashboard
Redirect URI	Must exactly match a configured URI for the client
OAuth params	response_type, scope, and recommended state
OIDC nonce	Required only if response_type includes id_token

---

End-to-End Flow

Step	Action	API	Expected result
1	Start authorization transaction	GET /authz-srv/authz	302 redirect containing requestId in query param
2	Trigger guest identity login	POST /login-srv/login/guest/{requestId}	200 + auto-submit HTML form
3	Submit generated form payload	POST /login-srv/login	302 redirect to configured redirect_uri
4	Consume OAuth/OIDC response	Redirect URL parameters	code and/or tokens depending on flow

Step 1: Authorization Request

Call Authorization Request to start authentication.

Important:

• requestId is taken from the Location header of the 302 response (for example /identity/login?requestId=...).
• requestId is not returned as JSON.

Step 2: Trigger Guest Login

Call Trigger guest login:

POST /login-srv/login/guest/{requestId}

Behavior:

• No bearer token required
• No client secret required in this request
• Requires a valid, active requestId

Successful response:

• 200 with HTML form containing generated guest credentials
• Form posts to POST /login-srv/login

Method constraint:

• GET /login-srv/login/guest/{requestId} is not supported for execution and returns 404.

Step 3: Submit Returned Form

Submit the form fields to Login using Username / Password:

POST /login-srv/login

Hidden fields rendered by the auto-submitting form:

• username (generated guest key)
• password (generated guest key)
• username_type ("username")
• requestId (active authorization transaction ID)

Result:

• 302 redirect to your redirect_uri with OAuth/OIDC response parameters (code or tokens).

---

Response and Error Reference

Scenario	HTTP	Error code	Meaning	Action
Guest login successful	200	-	Guest form generated	Submit returned form to /login-srv/login
Malformed requestId	400	24008 / LOGIN10009	requestId is not a valid UUID	Check requestId passed in the URL path
Guest login disabled for app	400	LOGIN10075	App does not allow guest login	Enable Guest Login in App Settings in cidaas Admin Dashboard
Invalid or expired requestId	417	10001 / LOGIN10010	Auth request cannot be resolved	Start flow again with fresh GET /authz-srv/authz
Wrong method (GET)	404	-	Endpoint is POST-only for execution	Use POST /login-srv/login/guest/{requestId}

---

Token and Identity Semantics

Login type	sub maps to	Assurance level	Guidance
Normal login	Real user identity	Potentially higher (for example with AMR/MFA)	Use for user-bound operations
Guest login	Guest identity	Low	Treat similarly to anonymous access

Practical recommendation:

• Use guest sessions only for low-risk operations.
• Require stronger authentication before sensitive actions (payments, profile changes, personal data access, admin operations).

---

Security Considerations

• requestId is short-lived and transaction-scoped.
• Form fields returned in the guest form must be submitted unchanged.
• Redirect URI must be pre-configured and exact-match validated.
• Apply least-privilege scopes/permissions for guest access.
• Design explicit upgrade path from guest to registered identity.

---

Related APIs and Guides

• Authorization Request
• Trigger guest login
• Login using Username / Password
• Authentication and Token Generation Process
• Session Management

info

Need Support?

Contact cidaas support with requestId, timestamp, and reference number from the error response.