Skip to main content
Flatpeak may redirect customers into your application using the deeplink_url configured in the Flatpeak Dashboard. This commonly occurs when a customer starts a Tariff Connect or VPP enrolment flow from their energy provider’s application. In these scenarios, the customer’s intent is typically to select a device and grant consent for the provider to access tariff, telemetry or other energy-related information. Depending on the programme, the customer may also grant consent for the provider to send operating schedules to the device. The deep link includes a connect_token that can be used to retrieve and validate the Connect Session. Your application should always validate the Connect Session and verify the customer’s authentication state before displaying any protected information. Example deep link: When deeplink_url is configured as myapp://nova/flatpeak/connect/deeplinks, the deep link will look like this: 
myapp://nova/flatpeak/connect/deeplinks?fp_cot=cot_6587fa4362341be5b524de3

​
Security Flow

A deep link should be treated as a navigation mechanism only. It should never be taken as proof that a customer is authenticated or authorised to access protected content. When a customer accesses a secure area of your application, your application should:
  1. Receive the deep link.
  2. Retrieve and validate the Connect Session using the connect_token.
  3. Verify whether the customer is authenticated.
  4. Prompt the customer to sign in if required.
  5. Display the appropriate content.
A valid Connect Session does not replace your application’s authentication or authorisation controls.

​
Operational Flow

When a customer arrives via a deep link, your application must first determine which device they intend to connect. We recommend presenting the customer with a list of eligible devices and letting them select the appropriate one. Once a device has been selected:
  1. Check whether the selected device is already registered with Flatpeak.
  2. If not, create the device and store the returned device_id in your database.
  3. You may also need to create a Location for the device if your application supports multiple locations.
  4. Update the Connect Session with device_id and location_id.
  5. Start the Connect Session, setting the flow parameter to AUTO.