# US 12,762,540 B2 · Unified login across applications

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,762,540 B2
- Document ID: US12762540B2
- Status: Granted
- Kind: B2
- Application number: 18/603,873
- Filed: 2024-03-13
- Published: 2024-10-17
- Granted: 2026-10-13
- Earliest claimed: 2015-04-27
- Assignees: Paypal, Inc.
- Applicants: Paypal, Inc.
- Inventors: Velayutham Subramanian; Narendra Kamesh; Arpan Nanavati; Brent Walter; Aravindan Ranganathan; Bill Scott
- Web page: https://patentgrep.com/patent/US12762540B2

## CPC

- G06Q 20/3674: {involving authentication}
- G06F 21/335: {for accessing specific resources, e.g. using Kerberos tickets}
- G06Q 20/326: {Payment applications installed on the mobile devices}
- G06Q 20/36: using electronic wallets or electronic money safes
- G06Q 20/3821: {Electronic credentials}
- G06Q 20/4014: {Identity check for transactions}
- G06F 2221/2139: Recurrent verification
- G06Q 2220/00: Business processing using cryptography
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A system and/or method may be provided to silently authenticate a user. An example method of silently authenticating a user includes receiving a request to complete a transaction associated with a merchant application. The request includes a data file including an identifier from the user device. The request is from a user device. The method also includes determining whether the data file includes a refresh token and determining whether the refresh token is valid if the data file includes the refresh token. The method further includes receiving an access token from the user device if the refresh token is valid. The access token includes an authorization scope. The method also includes determining whether the transaction is within the authorization scope. The method further includes authenticating a user if the transaction is within the authorization scope.

## Claims

### Claim 1

A method for authenticating a user across a plurality of different applications on a user device, the method comprising:
responsive to determining that the user is authenticated for accessing a first application on the user device, generating, by a payment provider, an access token for accessing one or more resources of the payment provider by the first application;
sending, by the payment provider, the access token to the user device;
responsive to determining that the user has consented to a unified login across the plurality of different applications, generating, by the payment provider after the access token has been sent to the user device, a refresh token that is associated with user authentication credentials of the user and defines an authorization scope of transactions;
sending, by the payment provider and to the user device, the refresh token generated by the payment provider;
receiving, by the payment provider from the user device, a request for a subsequent transaction, the request comprising a refresh token received via the request;
determining, by the payment provider, whether the refresh token received via the request matches the refresh token generated by the payment provider and whether the subsequent transaction is within the authorization scope; and
automatically authenticating, by the payment provider, the user for the subsequent transaction based on a determination that the refresh token received via the request matches the refresh token generated by the payment provider and that the subsequent transaction is within the authorization scope.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
receiving, by the payment provider and from the user device, another request to complete the subsequent transaction associated with a second application different from the first application, the request including a refresh token received via the another request and an identifier from the user device;
determining, by the payment provider, that the refresh token received via the another request is valid and that the subsequent transaction is a first type of transaction based on the authorization scope; and
authenticating, by the payment provider, the user in response to a determination that the refresh token received via the another request is valid and that the subsequent transaction is the first type of transaction.

### Claim 3 (depends on 1)

The method of claim 1, wherein the user authentication credentials are received, by the payment provider, from a first merchant application of the plurality of different applications on the user device of the user.

### Claim 4 (depends on 1)

The method of claim 1, wherein the sending the refresh token generated by the payment provider to the user device comprises sending a cookie that contains the refresh token generated by the payment provider.

### Claim 5 (depends on 1)

The method of claim 1, further comprising:
causing a user interface of the user device to display authentication fields that are configured to receive the user authentication credentials; and
causing the user interface to display an option to select the unified login separately from the authentication fields.

### Claim 6 (depends on 1)

The method of claim 1, further comprising:
causing a user interface of the user device to present an option to consent to the unified login prior to the user being authenticated for accessing the first application.

### Claim 7 (depends on 1)

The method of claim 1, wherein the access token is valid for a certain duration.

### Claim 8 (depends on 1)

The method of claim 1, wherein the unified login is for authenticating the user for accessing the one or more resources of the payment provider from the plurality of different applications without requiring the user to provide the user authentication credentials.

### Claim 9 (depends on 1)

The method of claim 1, wherein the unified login allows an automatic authentication of the user for initiating, from the plurality of different applications, transactions via the payment provider.

### Claim 10

A payment provider system comprising:
a non-transitory memory storing instructions; and
a processor configured to execute the instructions to cause the payment provider system to:
determine that a user is authenticated, based on user credentials of the user, for accessing a first application on a user device,
provide an access token to the user device, wherein the access token is generated based on the user being authenticated for accessing the first application, wherein the access token allows access of one or more resources of the payment provider system by the first application;
determine that the user has consented to a unified login across a plurality of applications on the user device;
based on a determination that the user has consented to the unified login across the plurality of applications on the user device and after the access token has been sent to the user device, generate a refresh token that is different from the access token, wherein the refresh token is associated with user authentication credentials of the user and defines an authorization scope of subsequent transactions;
provide the refresh token to the user device; and
based on a request from a second application of the plurality of applications to access the one or more resources of the payment provider system, authenticate the user for accessing the one or more resources of the payment provider system by the second application based on the request comprising the refresh token and being within the authorization scope associated with the refresh token.

### Claim 11 (depends on 10)

The payment provider system of claim 10, wherein executing the instructions further causes the system to,
determine that the refresh token is valid and that the second application that is different from the first application is authorized based on the authorization scope.

### Claim 12 (depends on 10)

The payment provider system of claim 10, wherein the user authentication credentials are received, by the payment provider system, from the first application on the user device of the user.

### Claim 13 (depends on 10)

The payment provider system of claim 10, wherein the refresh token is provided to the user in a cookie.

### Claim 14 (depends on 10)

The payment provider system of claim 10, wherein executing the instructions further causes the system to,
cause a user interface of the user device to display authentication fields that are configured to receive the user authentication credentials; and
cause the user interface to display an option to select the unified login separately from the authentication fields.

### Claim 15 (depends on 10)

The payment provider system of claim 10, wherein the unified login enables authenticating the user to the resources of the payment provider system from the plurality of applications without requiring the user to provide the user authentication credentials.

### Claim 16

A non-transitory machine-readable medium having instructions stored thereon, the instructions executable to cause performance of operations comprising:
determining that a user is authenticated, based on user credentials of the user, for accessing a merchant application on a user device;
providing an access token to the user device, wherein the access token is generated based on the user being authenticated for accessing the merchant application, wherein the access token facilitates processing of transactions by a payment provider system for the transactions initiated by the merchant application;
determining that the user has consented to a unified login across a plurality of merchant applications, including the merchant application, on the user device;
providing a refresh token to the user device after the access token has been provided to the user device, wherein the refresh token is generated after the access token was generated and is based on the user consenting to the unified login, wherein the refresh token is associated with user authentication credentials of the user and defines an authorization scope of subsequent transactions;
receiving a request for a subsequent transaction, the request comprising the refresh token; and
based on a determination that the subsequent transaction is within the authorization scope associated with the refresh token, authenticating the user for the subsequent transaction.

### Claim 17 (depends on 16)

The non-transitory machine-readable medium of claim 16, wherein the user authentication credentials are received, by the payment provider system, from the merchant application on the user device of the user.

### Claim 18 (depends on 16)

The non-transitory machine-readable medium of claim 16, wherein the access token is valid for a certain duration.

### Claim 19 (depends on 16)

The non-transitory machine-readable medium of claim 16, wherein the operations further comprise:
causing a user interface of the user device to present an option to consent to the unified login prior to the user being authenticated for accessing the merchant application.

### Claim 20 (depends on 16)

The non-transitory machine-readable medium of claim 16, wherein the unified login enables automatic authentication of the user to initiate, from the plurality of merchant applications, transactions via the payment provider system.