Start an SSO login
Starts an SSO login. The Console’s login screen sends the browser here — not an API client — after POST /v1/sso/discover offered an SSO provider for the email typed. The tenant is resolved from the email server-side and is never accepted from the caller. The flow is stored server-side under a single-use state, and the browser is redirected (302, Location) to the identity provider’s authorize URL; no cookie is set. The identity provider then returns the browser to the Console with a code, which is redeemed with the sso_code grant of POST /v1/login/oauth/access_token, presenting the PKCE verifier of the code_challenge sent here.
Errors use the envelope and are not redirects. 400: email, provider or code_challenge missing, or a code_challenge that is not a well-formed S256 challenge (AUT-0022). 401: this server has no SSO callback configured (AUT-0026). 404: the provider named is not one the tenant offers (AUT-0024). When the authorization server cannot be reached, is too slow to answer, or is failing, the answer is 503 AUT-0033: nothing about the request was wrong, and it may be retried later.
Query Parameters
Email address of the person signing in. The tenant is derived from it server-side; it is never accepted from the caller.
"user@acme.com"
Name of the SSO provider to sign in with, as returned in provider.id by POST /v1/sso/discover.
"acme-oidc"
S256 PKCE challenge (base64url, 43 characters). The matching verifier must be presented on the sso_code grant of POST /v1/login/oauth/access_token.
"OgkYf8C0dZA55KwBPshQ5lPH4Fk3NCPRUkpnrJL8fgs"
Response
Found

