---
title: "JWT authentication"
method: GET
path: "/api/sso/jwt"
tags: ["Embedding"]
---

# JWT authentication

`GET /api/sso/jwt`

## Request

- Base URL: `https://charts.basedash.com`
- URL: `https://charts.basedash.com/api/sso/jwt`
- Auth: none required

Validates a JWT signed by the embedding application and creates a Basedash session for the user specified in the JWT claims. On success, redirects to the organization dashboard.

## Query parameters

- `jwt` string, required: JWT token signed with your organization embed secret (HS256)
- `theme` 'light' | 'dark' | 'auto': Override the theme
- `hide_org_name` 'true' | 'false': Hide the organization name in the sidebar. Persists for the iframe session.
- `hide_chat` 'true' | 'false': Hide the Chat page and chat panel. Persists for the iframe session.
- `hide_dashboards` 'true' | 'false': Hide dashboards. Persists for the iframe session.
- `hide_insights` 'true' | 'false': Hide insights. Persists for the iframe session.
- `hide_automations` 'true' | 'false': Hide automations. Persists for the iframe session.
- `hide_models` 'true' | 'false': Hide models. Persists for the iframe session.
- `hide_suggested_prompts` 'true' | 'false': Hide suggested prompts in the chat input. Persists for the iframe session.
- `hide_sidebar` 'true' | 'false': Do not render the left sidebar, with no way to reopen it. Persists for the iframe session.
- `dashboard_id` string: Open the embed on this dashboard
- `tab` string: With dashboard_id, the dashboard tab to open
- `automation_id` string: Open the embed on this automation
- `insight_id` string: Open the embed on this insight
- `model_id` string: Open the embed on this model
- `chat_id` string: Open the embed on this chat

## Other responses

- `302`: Redirect to organization dashboard on successful authentication
- `400`: Bad request - Missing JWT, invalid format, or invalid claims
- `401`: Unauthorized - JWT signature verification failed or expired
- `403`: Forbidden - Embedding not enabled, request from disallowed origin, or the email is a Basedash staff address
- `404`: Not found - Organization not found
- `429`: Too many requests - per-IP rate limit exceeded
- `500`: Internal server error, including a failure to apply the groups claim

---

[API](https://skmtc.dev/basedash/apis/basedash-public-api.md) - [All operations](https://skmtc.dev/basedash/apis/basedash-public-api/llms.txt) - [OpenAPI document](https://skmtc.dev/basedash/apis/basedash-public-api/revisions/efb9d40bc6f7?raw)