---
title: "Complete SSO login REST API | HitKeep"
description: "Reference for the HitKeep REST API operation Complete SSO login, including request parameters, responses, and authentication notes."
canonical: "https://hitkeep.com/api/operations/apiauthssocallback/"
---

# Complete SSO login REST API

GET

/api/auth/sso/callback

FetchcURL

```
const url = 'http://127.0.0.1:25737/api/auth/sso/callback?state=example';
const options = {method: 'GET'};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```
curl --request GET \
  --url 'http://127.0.0.1:25737/api/auth/sso/callback?state=example'
```

-

Consumes one OIDC callback, validates the authorization state, PKCE exchange, signed ID token, issuer, audience, nonce, verified email, and allowed domain, then rechecks live team authorization. A scoped pending invitation retains its requested role; optional trusted-domain JIT provisioning creates a Member only after managed-cloud limits pass. Provider access, ID, and refresh tokens are never persisted.

## Parameters

### Query Parameters

**state**

required

string

**code**

string

**error**

string

## Responses

### 303

Redirects to the requested safe return path on success. Failed invitation flows return to invitation acceptance with the unconsumed token and a stable error code; other failures return to login.

[Previous Get SSO availability](https://hitkeep.com/api/operations/apiauthsso/)[Next Get invitation SSO availability](https://hitkeep.com/api/operations/apiauthssoinvite/)