Patent ID: 11954671
Assignee: PAYPAL, INC.
Field: IT methods for management (Electrical engineering)
Classification: CPC G  H | IPC G

Claim 7:
8. A method, comprising:
receiving, by a unified login server of a payment provider server and from a first merchant application on a user device of a user, a first request to conduct a first transaction, the first request containing user authentication credentials;
authenticating, by the unified login server, the user for a first time based on the received user authentication credentials;
generating, by a secure token service of the payment provider server and in response to the authenticating, a first access token that grants access to one or more resources of the payment provider server to the first merchant application, the secure token service being different from the unified login server;
sending, by the secure token service, the first access token to the user device;
determining, by the unified login server, that the user has consented to a unified login option across a plurality of merchant applications including the first merchant application and a second merchant application different from the first merchant application;
generating, by the unified login server and in response to a determination that the user has consented to the unified login option, a refresh token that specifies a transaction authorization scope;
storing, by the unified login server, the refresh token in a database;
associating, by the unified login server, the first access token with the user authentication credentials;
sending, by the unified login server, the refresh token to the user device;
after the sending the refresh token, receiving, by the unified login server and from the user device, a second request to conduct a second transaction from the second merchant application on the user device, the second merchant application containing no user authentication credentials;
determining, by the unified login server, that the refresh token is not valid or determining that the refresh token is valid but the second transaction is not within the transaction authorization scope; and
in response to the determining that the refresh token is not valid or the determining that the refresh token is valid but the second transaction is not within the transaction authorization scope, sending, to the user device, a message indicating that the user is unauthorized to perform the second transaction.