<form id="launch" method="POST" action="https://sandbox.etherfuse.com/auth/launch">
  <input type="hidden" name="grant_type" value="urn:ietf:params:oauth:grant-type:jwt-bearer" />
  <input type="hidden" name="assertion" value="<your_signed_jwt>" />
  <input type="hidden" name="target" value="/kyb" />
</form>
<script>document.getElementById("launch").submit()</script>

<iframe name="etherfuse"></iframe>

<!-- target the iframe so the launch loads inside it -->
<form method="POST" action="https://sandbox.etherfuse.com/auth/launch" target="etherfuse">
  <input type="hidden" name="grant_type" value="urn:ietf:params:oauth:grant-type:jwt-bearer" />
  <input type="hidden" name="assertion" value="<your_signed_jwt>" />
  <input type="hidden" name="target" value="/kyb" />
</form>
<script>document.forms[0].submit()</script>

User Authentication

Launch a user into the app

⚠️ Different host. Unlike every other endpoint in this reference, /auth/launch lives on the app host (app.etherfuse.com / sandbox.etherfuse.com), not the API host (api.etherfuse.com). It is a browser-facing page, not a JSON API.

Drops one of your users into the Etherfuse app with an authenticated session. Use it for browser flows, such as sending a user into KYB. Your server POSTs an HTML form (or redirects the browser) to this URL; the app establishes the session and redirects the user to target. To embed the flow in an iframe or popup instead, use the postMessage variant.

Targets

The target and scope for every flow you can launch a user into (and what to know about each) are documented in User Launch Flows. A target must be one of those allowed paths (optionally with a query string such as ?org=<org_id>); any other path is rejected with invalid_target.

The JWT’s sub is strongly recommended to be a UUID identifying the person signing in (see Sign a user JWT for how sub relates to the Ramp API customerId for individuals vs businesses), and its scope follows the same rules as /auth/token. The endpoint is unauthenticated: the JWT or refresh token is the credential.

POST

auth

launch

<form id="launch" method="POST" action="https://sandbox.etherfuse.com/auth/launch">
  <input type="hidden" name="grant_type" value="urn:ietf:params:oauth:grant-type:jwt-bearer" />
  <input type="hidden" name="assertion" value="<your_signed_jwt>" />
  <input type="hidden" name="target" value="/kyb" />
</form>
<script>document.getElementById("launch").submit()</script>

<iframe name="etherfuse"></iframe>

<!-- target the iframe so the launch loads inside it -->
<form method="POST" action="https://sandbox.etherfuse.com/auth/launch" target="etherfuse">
  <input type="hidden" name="grant_type" value="urn:ietf:params:oauth:grant-type:jwt-bearer" />
  <input type="hidden" name="assertion" value="<your_signed_jwt>" />
  <input type="hidden" name="target" value="/kyb" />
</form>
<script>document.forms[0].submit()</script>

<form id="launch" method="POST" action="https://sandbox.etherfuse.com/auth/launch">
  <input type="hidden" name="grant_type" value="urn:ietf:params:oauth:grant-type:jwt-bearer" />
  <input type="hidden" name="assertion" value="<your_signed_jwt>" />
  <input type="hidden" name="target" value="/kyb" />
</form>
<script>document.getElementById("launch").submit()</script>

<iframe name="etherfuse"></iframe>

<!-- target the iframe so the launch loads inside it -->
<form method="POST" action="https://sandbox.etherfuse.com/auth/launch" target="etherfuse">
  <input type="hidden" name="grant_type" value="urn:ietf:params:oauth:grant-type:jwt-bearer" />
  <input type="hidden" name="assertion" value="<your_signed_jwt>" />
  <input type="hidden" name="target" value="/kyb" />
</form>
<script>document.forms[0].submit()</script>

Body

grant_type

enum<string>

required

Available options:

urn:ietf:params:oauth:grant-type:jwt-bearer,

refresh_token

target

string

required

App path to land the user on after sign-in. Must be an allowed target. See User Launch Flows. Any other path is rejected.

Example:

"/kyb"

assertion

string

The partner-signed JWT. Required when grant_type is urn:ietf:params:oauth:grant-type:jwt-bearer.

refresh_token

string

A refresh_token from a prior POST /auth/token exchange. Required when grant_type is refresh_token.

return_url

string

Optional URL to return the user to when they leave the app.

Response

200

An HTML page that establishes the session and redirects the browser to target.

Idempotency Launch a user via postMessage

⌘I