A processor-implemented method of authenticating a user of a web application to allow access to a second application, comprising: receiving , by a first application hosting the web application, a request to access the second application, wherein the second application is remote from the first application; when access to the second application is not authorized for the web application based on a user identifier for the first application, displaying , by the first application, a link to the second application, wherein the link is operable to receive user access credentials for the second application; wherein the second application receives the user access credentials and verifies the user access credentials for an account of the user; wherein upon verifying the user access credentials, the second application sends an access token to a web service associated with the web application; receiving , by the first application, a nonce from the web service associated with the web application, wherein the web service generates the nonce in response to receiving the access token from the second application; sending , by the first application, the nonce to the web application via a secure message, the secure message being at least one of not visible to the user, not manually implemented by the user; determining , by the web application, whether the sent nonce matches a stored nonce of a collection of stored nonces, wherein if there is a match between the sent nonce and a stored nonce of a collection of stored nonces, the web application is authenticated to access the second application; and opening a window within the first application for accessing the second application via the web application. receiving , by a first application hosting the web application, a request to access the second application, wherein the second application is remote from the first application; when access to the second application is not authorized for the web application based on a user identifier for the first application, displaying , by the first application, a link to the second application, wherein the link is operable to receive user access credentials for the second application; wherein the second application receives the user access credentials and verifies the user access credentials for an account of the user; wherein upon verifying the user access credentials, the second application sends an access token to a web service associated with the web application; receiving , by the first application, a nonce from the web service associated with the web application, wherein the web service generates the nonce in response to receiving the access token from the second application; sending , by the first application, the nonce to the web application via a secure message, the secure message being at least one of not visible to the user, not manually implemented by the user; determining , by the web application, whether the sent nonce matches a stored nonce of a collection of stored nonces, wherein if there is a match between the sent nonce and a stored nonce of a collection of stored nonces, the web application is authenticated to access the second application; and opening a window within the first application for accessing the second application via the web application. <EOS>