Authentication using an identity provider

Use this when your users already sign in — with Auth0, Amazon Cognito, Firebase, Okta, Google, or any OIDC provider. You don’t build a separate login for chat. Register your provider’s public keys with TalkLabs once, and from then on the token your users already carry is enough to join a room.

You don’t run an auth backend, store users, or write any token-minting code — TalkLabs validates the token your provider issued and starts the chat session.

What it takes: one configuration call (Step 1), then hand the token your provider already issues to the SDK (Step 2). That’s the whole integration.

How it works

sequenceDiagram
    actor U as User
    participant App as Your App
    participant IdP as Identity Provider
    participant ST as TalkLabs
    participant Keys as Provider public keys

    U->>App: Open app
    App->>IdP: Authenticate (existing login)
    IdP-->>App: Signed token
    App->>ST: Join room · Authorization: Bearer &lt;token&gt;
    ST->>Keys: Fetch public keys (cached)
    Keys-->>ST: Public keys
    ST->>ST: Verify signature, issuer & audience
    ST-->>App: Chat session + room subscription
    App->>ST: Listen for events
    ST-->>App: Messages, reactions, moderation events

Step 1 · Configure your provider (one time)

Before any user token will be accepted, tell TalkLabs how to validate tokens from your provider. Today this is a one-time setup call you run per application with your management key (not your public app key), or set in the Dashboard.

curl -X PUT \
  "https://api.sportstalk247.com/api/v3/manage/applications/application/$APP_ID/identityprovider" \
  -H "Authorization: Bearer $MANAGEMENT_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "external_jwks",
    "issuer": "https://your-tenant.us.auth0.com/",
    "audience": "https://chat.your-app.com",
    "jwksuri": "https://your-tenant.us.auth0.com/.well-known/jwks.json",
    "claimmappings": {
      "userid": "sub",
      "name": "name",
      "img": "picture"
    }
  }'

Field	What it is
`type`	Must be `external_jwks` for this flow (required).
`issuer`	The `iss` your provider stamps on every token. Must match exactly.
`audience`	The `aud` your tokens are issued for (your chat API identifier).
`jwksuri`	Where TalkLabs fetches your provider’s public keys. Cached and refreshed automatically.
`claimmappings`	Which token claims become the user’s id (`userid`), display name (`name`), and avatar (`img`).

You do this once (or when you rotate providers). After that, every user token from that issuer is accepted at runtime.

Step 2 · Use it in your app

Get the token your provider already issues, hand it to the SDK, and join a room. No secret in the browser.

SDK
REST

import { ChatClient } from 'sportstalk-sdk';

// Public app id only — no secret in the browser.
const client = ChatClient.init({ appId: APP_ID });

// The token your identity provider already issued for this user.
const jwt = await auth.getAccessToken();

// Hand it to TalkLabs. It's validated against the keys you configured in Step 1.
client.setUserToken(jwt);

// Your user — the same id your provider puts in the token (its 'sub'); we check they match.
client.setUser({ userid: 'u-8842' });

// Join a room — you're in as the user the token identifies.
await client.joinRoomByCustomId('live-event-chat');

The SDK is a thin wrapper over this call. Send the provider token as a Bearer token on the join request; TalkLabs validates it and returns a session plus the initial event cursor.

using System.Net.Http.Headers;
using System.Text;
using System.Text.Json;

var jwt = await auth.GetAccessTokenAsync(); // your provider's token

using var http = new HttpClient();
http.DefaultRequestHeaders.Authorization =
    new AuthenticationHeaderValue("Bearer", jwt);

// "userid" is your user — the same id your provider puts in the token (its 'sub'); we check they match.
var res = await http.PostAsync(
    $"https://api.sportstalk247.com/api/v3/{APP_ID}/chat/roomsbycustomid/live-event-chat/join",
    new StringContent("{ \"userid\": \"u-8842\" }", Encoding.UTF8, "application/json"));

res.EnsureSuccessStatusCode();
Console.WriteLine(await res.Content.ReadAsStringAsync());

const jwt = await auth.getAccessToken(); // your provider's token

const res = await fetch(
  `https://api.sportstalk247.com/api/v3/${APP_ID}/chat/roomsbycustomid/live-event-chat/join`,
  {
    method: 'POST',
    headers: {
      'Authorization': `Bearer ${jwt}`,
      'Content-Type': 'application/json',
    },
    // userid is your user — the same id your provider puts in the token (its 'sub'); we check they match.
    body: JSON.stringify({ userid: 'u-8842' }),
  },
);

if (!res.ok) throw new Error(`join failed: ${res.status}`);
console.log(await res.json());

jwt := getAccessToken() // your provider's token

url := fmt.Sprintf(
    "https://api.sportstalk247.com/api/v3/%s/chat/roomsbycustomid/live-event-chat/join",
    APP_ID)

// "userid" is your user — the same id your provider puts in the token (its 'sub'); we check they match.
req, _ := http.NewRequest("POST", url, strings.NewReader(`{"userid": "u-8842"}`))
req.Header.Set("Authorization", "Bearer "+jwt)
req.Header.Set("Content-Type", "application/json")

res, err := http.DefaultClient.Do(req)
if err != nil {
    panic(err)
}
defer res.Body.Close()
fmt.Println("status:", res.Status)

# "userid" is your user — the same id your provider puts in the token (its 'sub'); we check they match.
curl -X POST \
  "https://api.sportstalk247.com/api/v3/$APP_ID/chat/roomsbycustomid/live-event-chat/join" \
  -H "Authorization: Bearer $USER_JWT" \
  -H "Content-Type: application/json" \
  -d '{ "userid": "u-8842" }'

Listen for events → — stream new messages once the user has joined.
Authentication models → — compare this against the other two models.
POST /chat/roomsbycustomid/{customid}/join in the reference →