Central Auth APISso

Sign In With SSO

This endpoint is used to sign in with an SSO provider. It redirects to the provider's authorization URL

Authentication

AuthorizationBearer
Bearer token authentication

Request

This endpoint expects an object.
callbackURLstringRequired

The URL to redirect to after successful sign-in.

emailstringOptional

The email address to sign in with. Used to resolve the provider via the email domain; optional if providerId, domain, or organizationSlug is provided.

organizationSlugstringOptional
The slug of the organization to sign in with.
providerIdstringOptional
The ID of the provider to sign in with. Can be provided instead of email.
domainstringOptional
The email domain of the provider. Can be provided instead of email.
errorCallbackURLstringOptional

The URL to redirect to if the sign-in flow fails.

newUserCallbackURLstringOptional

The URL to redirect to after sign-in if the user is newly registered.

scopeslist of stringsOptional
Scopes to request from the provider.
loginHintstringOptional

Login hint to send to the identity provider (e.g., email or identifier). If supported, sent as ‘login_hint’.

additionalParamsmap from strings to stringsOptional

Extra query parameters to append to the OIDC provider authorization URL. RFC 6749 reserved keys (state, client_id, redirect_uri, response_type, code_challenge, code_challenge_method, scope) are rejected. Not supported for SAML providers.

requestSignUpbooleanOptional

Explicitly request sign-up. Useful when disableImplicitSignUp is true for this provider.

providerTypeenumOptional
The provider protocol to sign in with.
Allowed values:

Response

Authorization URL generated successfully for SSO sign-in

urlstringformat: "uri"

The authorization URL to redirect the user to for SSO sign-in

redirectboolean
Indicates that the client should redirect to the provided URL

Errors

400
Bad Request Error
401
Unauthorized Error
403
Forbidden Error
404
Not Found Error
429
Too Many Requests Error
500
Internal Server Error