Skip to main content
When you already know who the user is (for example, they’re logged into your own app), you can send them straight into their partner portal dashboard without them entering an email, password, or one-time code. Your backend asks Partnero for a single-use sign-in link, then redirects the partner to it — Partnero consumes the link, signs them in, and lands them on their dashboard. This is the fully login-free experience referenced in Prefill the login email: instead of pre-filling the login form, it skips the login step entirely.
Works for both affiliate and refer-a-friend portals. The link is minted through the API, so it requires your secret API key and must be generated server-side.

​
How it works

1

Your backend requests a sign-in link

When a signed-in user on your site clicks “Open partner portal”, your server calls the create sign-in URL endpoint, identifying the partner by id, key, or email.
2

Partnero returns a single-use URL

The response contains a url on your portal’s domain (for example https://partners.yourdomain.com/sso/<token>) and an expires_at timestamp.
3

Redirect the partner to the URL

Redirect the browser to the returned url (or open it). Partnero validates the token, logs the partner in, and redirects them to their dashboard.
4

The link is consumed

The token is single-use and short-lived. Once used (or once it expires) it can’t be used again, and visiting it lands the user on the normal login screen instead.
Call the endpoint from your backend, identifying the partner and (optionally) how long the link stays valid:
cURL
Response
You can also target the partner by ID in the path — POST /v1/partners/{id}/sign-in-url — instead of passing an identifier in the body. See the API reference for all parameters.
Generate the link on demand, right before you redirect — not ahead of time. Because it’s single-use and short-lived, a link minted in advance will usually be expired or already consumed by the time it’s needed.
The token’s validity is controlled by expires_in (in seconds): Values outside the range are clamped to the nearest allowed value. Keep it short: the link only needs to survive the redirect from your app to the portal.

​
Security

Server-side only

Minting a link requires your secret API key. Never expose it in client-side code — call the endpoint from your backend.

Single-use

Each link works exactly once. Concurrent attempts to use the same link are safely rejected — only the first wins.

Short-lived

Links expire quickly (2 minutes by default, 15 minutes max), limiting the window if one leaks.

Respects portal access

Partners who are archived or otherwise blocked from portal login can’t be signed in, even with a valid link.
Treat the returned url as a credential. Anyone who obtains it before it’s used can sign in as that partner. Only deliver it to the intended user (e.g. via a server-side redirect) and don’t log it.
The create-link endpoint is rate limited to 60 requests per minute per API key (falling back to IP). This is generous for on-demand, per-user generation.

​
When to use which

Auto-login (this guide)

You know the user (they’re authenticated in your app) and want a zero-click hand-off into the portal.

Prefill the login email

You want to reduce login friction but still have the partner verify with a one-time code or password.