---
title: "Native SSO Processing"
method: POST
path: "/api/{serviceId}/nativesso"
tags: ["Native SSO"]
---

# Native SSO Processing

`POST /api/{serviceId}/nativesso`

This API should be called by the implementation of a token endpoint to generate the ID token and
token response that comply with [OpenID Connect Native SSO for Mobile Apps 1.0](https://openid.net/specs/openid-connect-native-sso-1_0.html)
(Native SSO) when Authlete’s `/auth/token` response indicates `action = NATIVE_SSO` (after you validate
the session id and verify or generate the device secret as required by the flow). The token endpoint
implementation should retrieve the value of `action` from the response and take the following steps
according to the value.

## Path parameters

- `serviceId` string, required

## Request body

- NativeSsoRequest
  - `accessToken` string, required — The value of this parameter should be: (a) the value of the `jwtAccessToken` parameter in a response from the `/auth/token` API when the value is available, or (b) the value of the `accessToken` parameter in the response from the `/auth/token` API when the `jwtAccessToken` parameter is not available.
  - `refreshToken` string — The value of this parameter should be the value of the `refreshToken` parameter in a response from the `/auth/token` API.
  - `sub` string — The value that should be used as the value of the `sub` claim of the ID token. This parameter is optional. When omitted, the value of the subject associated with the access token is used.
  - `claims` string — Additional claims that should be embedded in the payload part of the ID token. The format is a JSON object. This parameter is optional.
  - `idtHeaderParams` string — Additional parameters that should be embedded in the JWS header of the ID token. The format is a JSON object. This parameter is optional.
  - `idTokenAudType` string — The type of the `aud` claim of the ID token being issued. Valid values of this parameter are as follows:
  - `deviceSecret` string, required — The device secret. The value of this parameter should be the value of the `deviceSecret` parameter in the response from the `/auth/token` API, if the parameter is present. Otherwise, the authorization server should generate a new device secret and specify it as the value of this parameter.
  - `deviceSecretHash` string — The device secret hash. The specified device secret hash is included as the value of the `ds_hash` claim in the ID token generated by the `/nativesso` API. If the `deviceSecretHash` request parameter is omitted, the value of the `deviceSecret` request parameter is used to compute the hash.

## Response `200`

Native SSO processing completed successfully

- NativeSsoResponse
  - `resultCode` string — The code which represents the result of the API call.
  - `resultMessage` string — A short message which explains the result of the API call.
  - `action` 'OK' | 'INTERNAL_SERVER_ERROR' | 'CALLER_ERROR' — The next action that the implementation of the token endpoint should take.
  - `responseContent` string — The response content that can be used as the message body of the token response that should be returned from the token endpoint.
  - `idToken` string — The issued ID token.

## Other responses

- `400`
- `401`
- `403`
- `429` — The request exceeded the request rate permitted for the endpoint.
- `500`

## Changes

- **2026-08-03** `7ad74ab64749` — 1 info
  - added the non-success response with the status `429`

[Change history](https://skmtc.dev/authlete/apis/authlete-api/changes/api/:serviceId/nativesso/post.md)

---

[API](https://skmtc.dev/authlete/apis/authlete-api.md) · [All operations](https://skmtc.dev/authlete/apis/authlete-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/authlete/authlete-api/revisions/7ad74ab64749/schema)