JWT Web Login
GET /account/tokenLogin.do
Opens the web drive as an identified user in a private deployment with JWT login enabled. It establishes a web session, not a business API access_token.
URL Query Parameters
| Parameter | Requirement and meaning |
|---|---|
userToken |
Required signed JWT from a trusted server |
fileId |
Optional target file/folder; otherwise opens the user's root |
closeTitleBar |
1 hides the title bar; default 0 |
disableEntMark |
1 hides the enterprise mark; default 0 |
disableUserMark |
1 hides the user settings entry; default 0 |
defaultLang |
cn, en or zh-HK; default cn |
defaultClrTheme |
normal or dark; default normal |
/account/tokenLogin.do?userToken=<JWT_TOKEN>&defaultLang=en&defaultClrTheme=darkIdentity and Security
The source login payload uses payload.email for an agreed email, phone or employee identifier, with the issue time. Match the claims and validity to server configuration; see the JWT example.
Signing authenticates the JWT but does not encrypt its payload. Generate short-lived credentials only on a trusted server, use HTTPS and control URL logging. Validate the caller's authority to act for the target user.
Hiding UI elements does not grant permissions and does not replace access control.