How to convince client that homebrew SSO and URL tokens is the wrong way to go.

tl;dr: how can I convince the client that a homebrew SSO with URL tokens is a bad idea? Can you point me to material?

Our tiny company just went into business with this huge American corporation (S&P 400), and we need to integrate their tool into our Auth system, effectively turning their own login into an identity provider from our app's perspective.

Even though we are able to integrate via a proper SAML 2.0 flow, they insist on having a …

client cybersecurity go homebrew sso tokens url