# Encrypt session ID

**URL:** <https://support.prodi.gy/t/encrypt-session-id/6914>\
**Category:** Uncategorized\
**Tags:** usage, custom\
**Created:** [November 22, 2023, 10:42am UTC](https://support.prodi.gy/t/encrypt-session-id/6914 "2023-11-22T10:42:41Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![SiteAssist](https://avatars.discourse-cdn.com/v4/letter/s/13edae/32.png) [@SiteAssist](https://support.prodi.gy/u/SiteAssist)\
**Post date:** [November 22, 2023, 10:42am UTC](https://support.prodi.gy/t/encrypt-session-id/6914/1 "2023-11-22T10:42:41Z")

</div>

Hi,

We would like to implement a bearer authentification mechanism between prodigy and our backend.

Question 1: **Can prodigy make a request to an API based on a session id?**

We would like to implement a secret key between the two and pass an encrypted session param.

For example the raw session param could be:

```python
{
  userId: 1234,
  organisations: [1,2,3],
  projects: [1,2,3,4,5]
}

```

Becoming `ASDL;FJO;IAWE932523NDLKF;AJ;DFIOS` once encrypted by our backend.

The encryption would be injected as a session id in prodigy url `https://prodigy.prod.com/?session=ASDL;FJO;IAWE932523NDLKF;AJ;DFIOS`

Prodigy can then decrypt it and get session context for the task router.

This will allow us to make the prodigy url public.

Question 2: **Would that be possible?**

---

<div class="post-metadata">

**Author:** ![ryanwesslen](https://sea2.discourse-cdn.com/flex020/user_avatar/support.prodi.gy/ryanwesslen/32/2969_2.png) [@ryanwesslen](https://support.prodi.gy/u/ryanwesslen)\
**Post date:** [November 22, 2023, 7:19pm UTC](https://support.prodi.gy/t/encrypt-session-id/6914/2 "2023-11-22T19:19:22Z")

</div>

hi @SiteAssist,

> [@SiteAssist](#):
>
> Can prodigy make a request to an API based on a session id?

Prodigy does not have built-in functionality to make requests to an API based on a session ID. However, you can implement this functionality in your backend and use Prodigy's [custom recipe](https://prodi.gy/docs/custom-recipes) to try it.

You can create a custom recipe in Prodigy that sends the session ID as a parameter in the request to your backend API. You can try [`get_session_name`](https://prodi.gy/docs/api-components#controller-get_session_name) to get the session ID.

> [@SiteAssist](#):
>
> Question 2: **Would that be possible?**

Yes, that seems possible. However, there may be tradeoffs or other alternatives.

One downside I see of this is you can't provide your session names in advance using `PRODIGY_ALLOWED_SESSIONS`. Without it, Prodigy will only become aware of a user session when it starts annotating which can lead to uneven task distribution. This effect is explained in the docs section on [session creation below](https://prodi.gy/docs/task-routing#routing-details).

One point that's worth noting is we're working on a plugin for Single-Sign-On following the OpenID Connect Authorization Code Flow standard. This will support any OIDC identity provider (e.g. Auth0, Microsoft Entra (formerly Active Directory). I don't have an exact date on when we'll release this but we've been testing. Also, this will likely only be provided as an add-in for company licenses, not personal licenses.

After the holidays (we have a few teammates out this week), I can ask a few teammates on their thoughts.