SSO is in the browser, and is for Gluu Server use only. An OpenID Connect access tokens are client specific. One client would never share a token with another client. All modern federated authentication protocols are accomplished via redirect to the IDP. There are both front channel (browser) and back channel (API) calls involved in this flow. Please read this article: [http://www.gluu.co/know-your-audience](http://www.gluu.co/know-your-audience) And read up on how OAuth 2 and OpenID Connect work, and repose a more specific question.