We’ve migrated our documentation to a new site, which means some URLs have changed. If you hit a broken link, submit a support ticket.
Subscriptions
Subscriptions
Breadcrumbs

Common Login or Logout Issues and How to Avoid Them

When implementing Identity Management, small misconfigurations can lead to persistent login/logout issues for end users. Below is a guide to the most common mistakes and how to resolve or prevent them.

LOGOUT ISSUES

Using the Wrong Logout Endpoint

Problem:
Some implementations use an outdated logout endpoint that requires an API token, instead of the recommended OAuth-based endpoint.

How to Avoid:
Use the OAuth-compatible logout endpoint:

https://sandbox.tinypass.com/id/api/v1/identity/logout?client_id=<AID>&token=<user_token>

This endpoint is triggered automatically by tp.pianoId.logout() in the JS SDK.

Outdated JS SDK

Problem:
Running multiple or outdated versions of the JS SDK can cause duplicate cookies and inconsistent token behavior.

How to Avoid:

  • Use the latest version of the Piano JS SDK.

  • If loading Piano on multiple domains/subdomains, make sure the PDL cookies and consents are configured correctly.

  • Always use tp.pianoId.logout() to handle logouts via SDK logic.

Problem:
Modern browsers (Safari’s ITP, Firefox’s ETP) aggressively block or expire third-party cookies, causing unexpected logouts.

How to Avoid:

  • Set cookies using server-side logic, not client-side JavaScript. For example as described here.

  • Configure cookies as first-party with proper attributes (SameSite, Secure, etc.).

  • Consider whitelabeling your domain to improve persistence.

Custom Endpoint Misconfigurations

Problem:
Improper endpoint setup (e.g., cookie path, domain mismatch) or incomplete social login configurations can break logout behavior.

How to Avoid:

  • Audit your endpoint configuration, particularly around cookie attributes.

  • Validate your social login setup to avoid issues with hidden emails.

Forced Re-Authentication on Every Visit

Problem:
If cookies aren’t persisting properly, users may be forced to log in again every time they return.

How to Avoid:

  • Make sure all cookies (like __pid, __tbc, etc.) are set as first-party cookies.

  • Use server-side endpoints to set these cookies securely. For example as described here.

LOGIN ISSUES

Token Refresh or Exchange Failures

Problem:
In OAuth flows, login may fail during the token exchange or refresh phase. This is often due to incorrect integration of /id/api/v1/identity/login/code.

How to Avoid:

  • Verify that you're following the correct OAuth flow.

  • Confirm that refresh tokens are being handled correctly.

  • Review our social login guide here.

  • Remember: Refresh tokens expire 30 days after the associated JWT expires.

Social Login Email Mismatches

Problem:
When a user logs in with a social account and the email doesn’t match their existing Identity Management (or is a hidden email from Apple or Google), additional confirmation may be required.

How to Avoid:

  • Handle cases where social login emails differ from stored Identity Management emails.

  • Use the “Don’t accept hidden email” setting if you prefer not to allow hidden emails.

JS SDK Login Misconfigurations

Problem:
Improper configuration of the JS SDK can interfere with login flows, especially token exchange and session detection.

How to Avoid:

  • Always use the latest JS SDK.

  • Properly configure the PDL cookies and consents.

  • Use SDK methods like tp.pianoId.loginByToken() instead of building custom logic.

Cookies Not Persisting on Login

Problem:
On privacy-focused browsers, login cookies may be blocked or cleared, breaking session persistence.

How to Avoid:

  • Set cookies server-side, not through JavaScript. For example as described here.

  • Issue cookies with attributes like Secure, HttpOnly, and appropriate SameSite settings.

  • Use domain whitelabeling when applicable.

"Remember Me" Not Working

Problem:
Even when users check “Remember Me”, they are asked to log in again. This is usually due to incorrectly set or short-lived cookies (__idr, etc.).

How to Avoid:

  • Review and correct your cookie and token configuration. Also take a look at the recommendations here.

  • Ensure cookies are issued server-side with extended expiration where appropriate.

Password Manager and Apple Intelligence Compatibility

Problem: Password managers (including Apple Intelligence's upcoming password management features) may experience confusion when managing credentials across multiple Piano ID implementations that share the same domain structure.

Background. Piano ID uses a shared domain infrastructure across different client applications. When users have accounts across several Piano ID clients, password managers may have difficulty distinguishing between different applications, potentially causing:

  • Incorrect password autofill suggestions

  • Password sync conflicts

  • Confusion during password updates

Current status. Apple Intelligence password management features (announced at WWDC 2026) are not currently supported by Piano ID. Support for these features, including passkey authentication, is not on the current roadmap.

How to Avoid: If you experience issues with password managers:

  • Manually manage Piano ID credentials for different applications.

  • Use unique passwords for each Piano ID-enabled site.

  • Contact your Piano representative if this impacts your users significantly.

Deferred Double Opt-In (DDOI) Token Expiration on Mobile

If you're using Deferred Double Opt-In and experience token refresh failures on mobile devices (Android/iOS), this may be expected behavior when a pre-confirmed user's account exceeds the configured DDOI retention period (e.g., 24 hours).

Expected behavior:

  • The token refresh endpoint returns an OAuth invalid_grant error

  • The mobile app should display the login or email confirmation screen

  • Once the user confirms their email, the session resumes automatically

This is not a bug - it's the intended DDOI enforcement mechanism to ensure pre-confirmed users complete email verification within the retention window.

Last updated: