Verify users on my app with Amazon Account Linking

Question

How can I verify that a user that has logged in with Amazon or Google on a cloud service is the same user as the one I've on my application?

Scenario: I've a website were the user has an account. I want to allow an alexa skill from a third party to access my app api.

I've read about account linking, from this article: https://developer.amazon.com/es/blogs/post/Tx3CX1ETRZZ2NPC/Alexa-Account-Linking-5-Steps-to-Seamlessly-Link-Your-Alexa-Skill-with-Login-wit

There are many ways you can use account linking to enhance your Alexa skills. For example:

You can map this user profile to an existing user in your user database, using the email address as key. This would allow you to create a contextual skill that behaves according to your user's preferences and history.

The third party sends me some authentication token that I can use to get data from the user from Amazon AWS and verify that is the same email?

Answer 1

Lets assume your user has linked the account with your skill and the request contains the filed accessToken in alexaRequestBody['context']['System']['user']. For more information on the accessToken check this link out. Then the second thing you'll need to do is to make an GET request to the Amazon Profile API.

Request example: GET https://api.amazon.com/user/profile?access_token=${$alexaRequestBody['context']['System']['user']['accessToken']}

This way you can know what user Amazon Users are interacting with your API.

I hope that I have managed to help you. In case you are using WordPress you can check out our WordPress plugin Convoworks WP which enables you to create Alexa Skills directly from your WordPress site.