> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # Start an SSO login > Starts an SSO login. The Console's login screen sends the browser here — not an API client — after POST /v1/sso/discover offered an SSO provider for the email typed. The tenant is resolved from the email server-side and is never accepted from the caller. The flow is stored server-side under a single-use state, and the browser is redirected (302, Location) to the identity provider's authorize URL; no cookie is set. The identity provider then returns the browser to the Console with a code, which is redeemed with the sso_code grant of POST /v1/login/oauth/access_token, presenting the PKCE verifier of the code_challenge sent here. Errors use the {code, title, message} envelope and are not redirects. 400: email, provider or code_challenge missing, or a code_challenge that is not a well-formed S256 challenge (AUT-0022). 401: this server has no SSO callback configured (AUT-0026). 404: the provider named is not one the tenant offers (AUT-0024). When the authorization server cannot be reached, is too slow to answer, or is failing, the answer is 503 AUT-0033: nothing about the request was wrong, and it may be retried later. ## OpenAPI ````yaml /pt/openapi/v3-current/AM-auth.yaml get /v1/sso/start openapi: 3.1.0 info: contact: name: Lerian Studio url: https://lerian.studio description: OpenAPI 3.1 surface for the Access Manager auth component. license: name: Lerian Studio General License title: Plugin Access Manager — Auth API version: v1 servers: - url: https://auth.sandbox.lerian.net security: [] tags: - description: >- OAuth2 token issuance: request an access token, refresh it, and log out. Public issuer endpoints. name: OAuth - description: >- Single sign-on through the tenant's identity provider: discover how an email signs in, then start the login. Public, called by the browser before login. name: SSO - description: >- Multi-factor authentication challenge and verification during the login flow. Public (identity is carried by the MFA token, not a Bearer token). name: MFA - description: >- Token-secured routes: enforce a permission, list the caller's permissions, and fetch OIDC user info. Require a Bearer token, validated in the use case. name: User Permission paths: /v1/sso/start: get: tags: - SSO summary: Start an SSO login description: >- Starts an SSO login. The Console's login screen sends the browser here — not an API client — after POST /v1/sso/discover offered an SSO provider for the email typed. The tenant is resolved from the email server-side and is never accepted from the caller. The flow is stored server-side under a single-use state, and the browser is redirected (302, Location) to the identity provider's authorize URL; no cookie is set. The identity provider then returns the browser to the Console with a code, which is redeemed with the sso_code grant of POST /v1/login/oauth/access_token, presenting the PKCE verifier of the code_challenge sent here. Errors use the {code, title, message} envelope and are not redirects. 400: email, provider or code_challenge missing, or a code_challenge that is not a well-formed S256 challenge (AUT-0022). 401: this server has no SSO callback configured (AUT-0026). 404: the provider named is not one the tenant offers (AUT-0024). When the authorization server cannot be reached, is too slow to answer, or is failing, the answer is 503 AUT-0033: nothing about the request was wrong, and it may be retried later. operationId: startSSO parameters: - description: >- Email address of the person signing in. The tenant is derived from it server-side; it is never accepted from the caller. explode: false in: query name: email schema: description: >- Email address of the person signing in. The tenant is derived from it server-side; it is never accepted from the caller. examples: - user@acme.com type: string required: true - description: >- Name of the SSO provider to sign in with, as returned in provider.id by POST /v1/sso/discover. explode: false in: query name: provider schema: description: >- Name of the SSO provider to sign in with, as returned in provider.id by POST /v1/sso/discover. examples: - acme-oidc type: string required: true - description: >- S256 PKCE challenge (base64url, 43 characters). The matching verifier must be presented on the sso_code grant of POST /v1/login/oauth/access_token. explode: false in: query name: code_challenge schema: description: >- S256 PKCE challenge (base64url, 43 characters). The matching verifier must be presented on the sso_code grant of POST /v1/login/oauth/access_token. examples: - OgkYf8C0dZA55KwBPshQ5lPH4Fk3NCPRUkpnrJL8fgs type: string required: true responses: '302': description: Found headers: Location: schema: description: >- Authorize URL of the upstream identity provider the browser is sent to. type: string '400': content: application/json: schema: $ref: '#/components/schemas/HTTPError' description: Bad Request '401': content: application/json: schema: $ref: '#/components/schemas/HTTPError' description: Unauthorized '404': content: application/json: schema: $ref: '#/components/schemas/HTTPError' description: Not Found '500': content: application/json: schema: $ref: '#/components/schemas/HTTPError' description: Internal Server Error '503': content: application/json: schema: $ref: '#/components/schemas/HTTPError' description: Service Unavailable components: schemas: HTTPError: additionalProperties: false properties: code: description: >- Stable, machine-readable error code (AUT-NNNN). Branch on this, not on the message. examples: - AUT-0009 type: string fields: additionalProperties: {} description: >- Present on body validation errors: each offending member mapped to what is wrong with it (AUT-0001 missing, AUT-0009 invalid) or, for AUT-0003, to the unexpected value that was sent. type: object message: description: Human-readable explanation of this occurrence. type: string title: description: Short, human-readable summary of the error class. examples: - Bad Request type: string type: object ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.