I would be very careful with this. Probably the first question is: Where do they want to create the link?
Will it be a static link for each user? - BAD IDEA
Or will there be a button on their portal with a back-end logic (connected to your back-end) that will create a limited one-time link with very short expiration (seconds) and automatically redirect? - THIS COULD WORK.
Yes, OAuth is a solution. I would use something like this:
- You will provide a secret key for PBO.
- Let's say PBO uses website partner-backoffice.org, there is a button "Go to YBO".
- User clicks to the button and goes to partner-backoffice.org/ybo-oauth (still PBO site)
- The script /ybo-oauth makes cURL request to YBO (your-backoffice.org/oauth-endpoint) - and sends user's email and other relevant data including secret key
- YBO validates secret key and other data (would be great to add PBO IP addresses to whitelist) and returns access token with very short expiration (seconds)
- The script /ybo-oauth redirects the user to your website your-backoffice.org/?access_token=...
- YBO validates acccess token (and checks expiration) and starts user session (or whatever you generally use)
This should work. If you will use HTTPS and IP whitelist, it could be enough for your purposes.
- PBO - partner's backoffice
- YBO - your backoffice