How does Help Center Authentication work?

sequenceDiagram
  participant HelpCenter as Help Center
  participant CustomerPlatform as Customer Platform
  participant User as User

  HelpCenter->>CustomerPlatform: Request with Forwarded Cookie
  activate CustomerPlatform
  Note over CustomerPlatform: Verifies the forwarded cookie

  CustomerPlatform->>CustomerPlatform: Create Signed JWT Token
  activate CustomerPlatform
  Note over CustomerPlatform: Uses the secret to create a signed JWT token with user information (name, email, externalId, metadata)

  alt User Logged In
    CustomerPlatform-->>HelpCenter: Signed JWT Token
    activate HelpCenter
    Note over HelpCenter: Authenticates the user using the signed JWT token with user information
  else User Not Logged In
    CustomerPlatform-->>HelpCenter: 401 Unauthorized Error
    activate HelpCenter
    Note over HelpCenter: Receives a 401 error indicating the user is not logged in on the Customer Platform

    HelpCenter->>User: Redirect URL
    activate User
    Note over User: User is redirected to the configured\nredirect URL for authentication
  end

Here's a step-by-step breakdown of the scenario:

1. The Help Center platform sends a request to the Customer Platform, including a forwarded cookie, to initiate the authentication process.

2. The Customer Platform receives the request and begins the verification process for the forwarded cookie to ensure its validity and integrity.

3. If the forwarded cookie is successfully verified, the Customer Platform generates a signed JSON Web Token (JWT) using a shared secret. This JWT token includes user information such as the user's name, email, external ID, and metadata.

4. If the user is logged in on the Customer Platform, the Customer Platform sends the signed JWT token back to the Help Center.

5. The Help Center receives the signed JWT token from the Customer Platform.

6. The Help Center platform validates and authenticates the user by verifying the signed JWT token. This authentication step allows the Help Center to identify the user and authenticate.

7. However, if the user is not logged in on the Customer Platform, the Customer Platform responds to the Help Center with a 401 error, indicating that the user is not authenticated.

8. The Help Center, upon receiving the 401 Unauthorised error, redirects the url to the configured redirect URL within Brainfish platform.