Brokerage Sign-In API

curl -X POST https://signworkpro.com/api/v1/sso/token \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"client_key": "swpk_…", "passcode": "swpp_…"}'

{
  "access_token": "Yk3w…",
  "token_type": "Bearer",
  "expires_in": 600
}

curl -X POST https://signworkpro.com/api/v1/sso/login \
  -H "Authorization: Bearer Yk3w…" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"email": "jane.doe@harbourrealty.com", "name": "Jane Doe"}'

{
  "url": "https://signworkpro.com/sso/login/Hq8v…",
  "expires_in": 60,
  "account_created": false
}

{
  "code": "seats_full",
  "message": "All 40 seats on Harbour Realty's Sign Work Pro license are in use, so we can't add you yet. Ask your broker to add more seats."
}

// routes/web.php — credentials live in .env (SWP_CLIENT_KEY, SWP_PASSCODE)
Route::get('/go/signworkpro', function (Request $request) {
    $base = 'https://signworkpro.com/api/v1/sso';

    $token = Cache::remember('swp_sso_token', 540, fn () => Http::acceptJson()
        ->post("$base/token", [
            'client_key' => config('services.swp.client_key'),
            'passcode' => config('services.swp.passcode'),
        ])->throw()->json('access_token'));

    $response = Http::acceptJson()->withToken($token)->post("$base/login", [
        'email' => $request->user()->email,
        'name' => $request->user()->name,
    ]);

    if ($response->status() === 401) {
        Cache::forget('swp_sso_token'); // expired: the next click gets a new token
    }
    if ($response->failed()) {
        return back()->with('error', $response->json('message', 'Sign Work Pro is unavailable. Try again.'));
    }

    return redirect()->away($response->json('url'));
})->middleware('auth');

// Credentials live in environment variables: SWP_CLIENT_KEY, SWP_PASSCODE
const BASE = 'https://signworkpro.com/api/v1/sso';
let cached = { token: null, expiresAt: 0 };

async function accessToken() {
  if (cached.token && Date.now() < cached.expiresAt) return cached.token;
  const res = await fetch(`${BASE}/token`, {
    method: 'POST',
    headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
    body: JSON.stringify({ client_key: process.env.SWP_CLIENT_KEY, passcode: process.env.SWP_PASSCODE }),
  });
  if (!res.ok) throw new Error((await res.json()).message);
  const body = await res.json();
  cached = { token: body.access_token, expiresAt: Date.now() + (body.expires_in - 60) * 1000 };
  return cached.token;
}

app.get('/go/signworkpro', requireLogin, async (req, res) => {
  const r = await fetch(`${BASE}/login`, {
    method: 'POST',
    headers: {
      Authorization: `Bearer ${await accessToken()}`,
      'Content-Type': 'application/json',
      Accept: 'application/json',
    },
    body: JSON.stringify({ email: req.user.email, name: req.user.name }),
  });
  const body = await r.json();
  if (r.status === 401) cached = { token: null, expiresAt: 0 };
  if (!r.ok) return res.status(r.status).render('error', { message: body.message });
  res.redirect(302, body.url);
});

# Credentials live in environment variables: SWP_CLIENT_KEY, SWP_PASSCODE
import os, time, requests
from flask import redirect, render_template
from flask_login import login_required, current_user

BASE = "https://signworkpro.com/api/v1/sso"
_cache = {"token": None, "expires_at": 0}

def access_token():
    if _cache["token"] and time.time() < _cache["expires_at"]:
        return _cache["token"]
    r = requests.post(f"{BASE}/token", timeout=10, headers={"Accept": "application/json"}, json={
        "client_key": os.environ["SWP_CLIENT_KEY"],
        "passcode": os.environ["SWP_PASSCODE"],
    })
    r.raise_for_status()
    body = r.json()
    _cache.update(token=body["access_token"], expires_at=time.time() + body["expires_in"] - 60)
    return _cache["token"]

@app.get("/go/signworkpro")
@login_required
def open_sign_work_pro():
    r = requests.post(f"{BASE}/login", timeout=10,
        headers={"Authorization": f"Bearer {access_token()}", "Accept": "application/json"},
        json={"email": current_user.email, "name": current_user.name})
    if r.status_code == 401:
        _cache["token"] = None
    if not r.ok:
        return render_template("error.html", message=r.json().get("message")), r.status_code
    return redirect(r.json()["url"], code=302)