Reseller API — Delegated Login (SSO)
Delegated login lets you put a "Manage CDN" button in your own panel that drops your customer straight into their CDNShark portal, already signed in. You never need to know or reset their password.
Minting a link
curl -X POST "https://cdnshark.com/api/reseller/customers/4210/sso" \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{"redirect_path": "/cp/storage"}'redirect_path is optional and defaults to /cp/dashboard. It must be a relative path beginning with /.
{
"url": "https://cdnshark.com/sso/nT8xK2...",
"expires_at": "2026-08-01T09:41:22+00:00",
"expires_in": 300,
"customer_id": 4210,
"single_use": true
}How to use it
Mint the link in response to the customer clicking, then redirect them to it immediately. Do not mint links in advance.
- The link is single-use — the first visit consumes it.
- It expires in 5 minutes.
- Issuing a new link for a customer invalidates any earlier unused one.
- Ownership is re-checked at redemption, so a stale link cannot be used after a customer moves.
Anyone holding the URL within its lifetime can log in as that customer. Treat it exactly like a password: never email it, log it, put it in a redirect chain that a third party can observe, or store it.
Failure cases
| Response | Cause |
|---|---|
404 | The customer is not yours |
409 | The customer account is inactive and cannot be signed in |
422 | redirect_path is not a relative path |
An expired, consumed or invalid link sends the visitor to the normal login page with an explanatory message rather than an error — so a customer who bookmarks one simply sees a prompt to sign in.
Every delegated login is recorded in the activity log, attributed to the reseller that issued it.