Complete SSO login REST API

GET

/api/auth/sso/callback

const url = 'http://127.0.0.1:25737/api/auth/sso/callback?state=example';
const options = {method: 'GET'};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url 'http://127.0.0.1:25737/api/auth/sso/callback?state=example'

Consumes one OIDC callback, validates the authorization state, PKCE exchange, signed ID token, issuer, audience, nonce, verified email, and allowed domain, then rechecks live team authorization. A scoped pending invitation retains its requested role; optional trusted-domain JIT provisioning creates a Member only after managed-cloud limits pass. Provider access, ID, and refresh tokens are never persisted.

Parameters

Query Parameters

state

required

string

code

string

error

string

Responses

303

Redirects to the requested safe return path on success. Failed invitation flows return to invitation acceptance with the unconsumed token and a stable error code; other failures return to login.