---
title: "Start SSO login REST API | HitKeep"
description: "Reference for the HitKeep REST API operation Start SSO login, including request parameters, responses, and authentication notes."
canonical: "https://hitkeep.com/api/operations/apiauthssostart/"
---

# Start SSO login REST API

POST

/api/auth/sso/start

FetchcURL

```
const url = 'http://127.0.0.1:25737/api/auth/sso/start';
const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: '{"email":"hello@example.com","invite_token":"example","remember_me":true,"return_url":"example"}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```
curl --request POST \
  --url http://127.0.0.1:25737/api/auth/sso/start \
  --header 'Content-Type: application/json' \
  --data '{ "email": "hello@example.com", "invite_token": "example", "remember_me": true, "return_url": "example" }'
```

-

Resolves an enabled team OIDC provider from the submitted email or invitation, requires an existing membership, a pending invitation, or enabled trusted-domain auto-provisioning, and creates a short-lived state, nonce, and PKCE-protected authorization request. Existing password login remains available.

## Request Bodyrequired

application/json

One of:

- object
- object

object

**email**

required

string format: email

**invite_token**

Invitation token used instead of email when starting SSO from invitation acceptance.

string

**remember_me**

boolean

**return_url**

Optional same-origin application path. Unsafe or authentication paths fall back to /.

string

object

**email**

string format: email

**invite_token**

required

Invitation token used instead of email when starting SSO from invitation acceptance.

string

**remember_me**

boolean

**return_url**

Optional same-origin application path. Unsafe or authentication paths fall back to /.

string

##### Examplegenerated

```
{
  "email": "hello@example.com",
  "invite_token": "example",
  "remember_me": true,
  "return_url": "example"
}
```

## Responses

### 200

OIDC authorization URL

application/json

object

**auth_url**

required

string format: uri

##### Examplegenerated

```
{
  "auth_url": "https://example.com"
}
```

### 400

Invalid email or no enabled SSO provider for the email domain

application/json

object

**message**

string

##### Examplegenerated

```
{
  "message": "example"
}
```

### 403

The account has no team membership, pending invitation, or permitted JIT access, or a managed-cloud limit was reached

application/json

object

**message**

string

##### Examplegenerated

```
{
  "message": "example"
}
```

### 503

Configured SSO provider is unavailable

application/json

object

**message**

string

##### Examplegenerated

```
{
  "message": "example"
}
```

[Previous Get invitation SSO availability](https://hitkeep.com/api/operations/apiauthssoinvite/)[Next Create initial admin](https://hitkeep.com/api/operations/apiinitial-user/)