Account linking helps Alexa skill to understand the user who is invoking the service. This information is important for the skill to provide authorization to certain resources, execute APIs on behalf of the user and also to reach the customer via SMS or email. Below is the flowchart of the account linking process and the explanation.
When a customer opens Alexa skill for the first time, it will respond by saying the requested skill wants the user to link the account, to begin with, and it sends an Account Setup card. Users will have to click on this card to get an oAuth login page of the service provider. Below is the reference image of the Account Setup card from OLA skill.
Clicking on the above account setup card, Alexa will open the oAuth Login page of the client. In this example of OLA being the client, the customer is asked to enter his mobile number and in the subsequent screen, he is asked to enter the OTP. Please see the reference images of the OLA below.
When the Customer (both a new and existing) authenticates himself successfully, the authentication information will be sent to Amazon redirect endpoint. This endpoint will be provided in the Alexa developer console and the same will have to be conveyed to the backend team by the skills developer.
Once the Amazon redirect endpoint receives the information, it will fire Auth token API to the Client server. Client-server may choose to store this token against the user.
After completing step 4, the user will see the success message indicating that his account has been linked successfully. Next time if the user invokes the Alexa Skill, it will respond without prompting the user for account linking as it will start receiving the access token (which was exchanged between Amazon and Client’s server in step 4)
Using the access token, Alexa skill can fire API’s to get User details.