How we identify partners

For domain-based integrations, Owlflow identifies your organization from the request hostname. Before launch, ScholarshipOwl registers that hostname in whitelabel_domains and links it to your organization's domain ID.

Owlflow reads the Host header on each GraphQL request and looks for a matching hostname. If it finds one, Owlflow uses the row's domain_id to identify your organization. Requests from an unregistered hostname use the default ScholarshipOwl domain.

Integrations without their own domain require a partner ID. Owlflow doesn't support that partner ID yet.

The student's JWT identifies their account after registration or sign-in. The account already contains the domain_id, so later requests don't need to identify the partner again. Domain scoping lets the same email address appear once under each partner.

Where Owlflow uses the domain ID

During auth.createUser and auth.login, Owlflow sends X-Owlflow-Trusted-Domain-Id: <domain_id> to Core:

Call	What the domain ID does
auth.createUser	Core saves the new account with that domain_id.
auth.login	Core signs in the account that has this email on that domain.

Core accepts X-Owlflow-Trusted-Domain-Id only on POST /account/register and POST /auth/session.

For a registered partner hostname, Owlflow always uses /auth/session to sign students in. Owlflow doesn't use the older login route. That route ignores the domain ID and could sign the student in to a ScholarshipOwl account instead.

Every other request

The client sends Owlflow's JWT with viewer.updateUser, scholarships.list, scholarships.byId, status mutations, and application mutations. The client doesn't resend the domain ID. Core reads it from the authenticated account.

If registration or sign-in comes from an unregistered hostname, Owlflow creates or finds the account on the default ScholarshipOwl domain. All later requests then run as that ScholarshipOwl account.

scholarships.net today

scholarships.net calls Owlflow from its own server. The Host header contains the Owlflow address because scholarships.net sends requests to that address. scholarships.net also sends X-Forwarded-Host: scholarships.net, but Owlflow doesn't use X-Forwarded-Host to select a partner. Until Host contains the registered hostname, Owlflow assigns these requests to the default ScholarshipOwl domain.