Auth
Finish signing in through an identity provider
Where the provider sends the browser back.
GET
/auth/sso/callbackTL;DR
| Question | Answer |
|---|---|
| What does it do? | Finish signing in through an identity provider. |
| What does it take? | code, state, iss, error, error_description in the query string. |
| What does it return? | Status 200 with no body. |
| What can go wrong? | 302 to the return address, or to the portal's sign-in page with sso_error; 429 too many requests; 503 the portal's address is not set on this server. Every failure uses the one error envelope. |
What it does
Where the provider sends the browser back. The flow is spent once and needs the browser's flow cookie; the code is traded with the PKCE verifier; the ID token's signature, issuer, audience, times and nonce are checked; the address must be on a verified domain. Opens a new session and redirects, or redirects to the portal's sign-in page with sso_error.
Query parameters
| Field | Type | Required | Description |
|---|---|---|---|
code | string | no | |
state | string | no | |
iss | string | no | |
error | string | no | |
error_description | string | no |
Responses
| Status | Meaning | Body |
|---|---|---|
| 302 | To the return address, or to the portal's sign-in page with sso_error. | none |
| 429 | Too many requests. | ErrorResponse |
| 503 | The portal's address is not set on this server. | ErrorResponse |
See also
| Doc | Why |
|---|---|
| API reference | Every endpoint, and the error envelope |
| Schemas | Every request and response type |
| Tool reference | The operations as callable tools |