Start SSO login REST API
const url = 'http://127.0.0.1:25737/api/auth/sso/start';const options = { method: 'POST', headers: {'Content-Type': 'application/json'}, body: '{"email":"hello@example.com","invite_token":"example","remember_me":true,"return_url":"example"}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url http://127.0.0.1:25737/api/auth/sso/start \ --header 'Content-Type: application/json' \ --data '{ "email": "hello@example.com", "invite_token": "example", "remember_me": true, "return_url": "example" }'Resolves an enabled team OIDC provider from the submitted email or invitation, requires an existing membership, a pending invitation, or enabled trusted-domain auto-provisioning, and creates a short-lived state, nonce, and PKCE-protected authorization request. Existing password login remains available.
Request Bodyrequired
Section titled “Request Bodyrequired”object
Invitation token used instead of email when starting SSO from invitation acceptance.
Optional same-origin application path. Unsafe or authentication paths fall back to /.
object
Invitation token used instead of email when starting SSO from invitation acceptance.
Optional same-origin application path. Unsafe or authentication paths fall back to /.
Examplegenerated
{ "email": "hello@example.com", "invite_token": "example", "remember_me": true, "return_url": "example"}Responses
Section titled “Responses”OIDC authorization URL
object
Examplegenerated
{ "auth_url": "https://example.com"}Invalid email or no enabled SSO provider for the email domain
object
Examplegenerated
{ "message": "example"}The account has no team membership, pending invitation, or permitted JIT access, or a managed-cloud limit was reached
object
Examplegenerated
{ "message": "example"}Configured SSO provider is unavailable
object
Examplegenerated
{ "message": "example"}