Patent ID: 11954671
Assignee: PAYPAL, INC.
Field: IT methods for management (Electrical engineering)
Classification: CPC G  H | IPC G

Claim 15:
16. A system for authenticating a user across a plurality of different merchant applications running on a user device, the system comprising:
a secure token service component that is configured to:
generate a first access token that grants access to one or more resources of the system to a first merchant application of the plurality of different merchant applications;
generate a second access token that grants access to the one or more resources of the system to a second merchant application of the plurality of different merchant applications; and
send the first access token and the second access token to the user device; and

a unified login server that is different from the secure token service and that is configured to perform the following steps sequentially:
receive user authentication credentials from the first merchant application;
authenticate the user for a first time based on the received user authentication credentials;
determine that the user has consented to a unified login option across the plurality of merchant applications;
generate, in response a determination that the user has consented to the unified login option, a refresh token that specifies an authorization scope;
store the refresh token in a database;
associate the refresh token with the user authentication credentials;
send the refresh token to the user device;
receive, from the user device, a first request to complete a transaction associated with the second merchant application, wherein the first request includes the refresh token and an identifier from the user device;
determine that the refresh token is valid and that the transaction is an authorized transaction based on the authorization scope;
authenticate the user in response to a determination that the refresh token is valid and that the transaction is the authorized transaction;
send a message to the secure token service that indicates the user has been authenticated; and
authenticate, based on the second access token and without requiring the user authentication credentials, the user for a second time without notifying the user that the user is being authenticated.