---
title: "Start connecting SSO"
method: POST
path: "/users/@me/sso/link/start"
tags: ["Users"]
---

# Start connecting SSO

`POST /users/@me/sso/link/start`

## Request

- Base URL: `https://web.fluxer.app/api/v1`
- URL: `https://web.fluxer.app/api/v1/users/@me/sso/link/start`
- Auth: API key in header `Authorization`
- TypeScript: <https://skmtc.dev/fluxer/apis/fluxer-api/docs/users/@me/sso/link/start/post.ts> (a function with typed inputs; its response is checked against the schema)

Start connecting the instance SSO provider to the current account. Send the user to authorization_url, then finish with complete_sso, which returns linked and creates no new session. Works while SSO is required. Requires sudo mode verification.

## Request body

- SudoVerificationSchema
  - `password` string
  - `mfa_method` 'totp' | 'webauthn' | 'email_code': MFA method to use for verification
  - `mfa_code` string: MFA verification code from an authenticator app
  - `email_code_ticket` string: Ticket from POST /users/@me/sudo/email-code, sent with mfa_method email_code
  - `email_code` string: The 6-digit code from the email, sent with mfa_method email_code
  - `webauthn_response` WebAuthnAuthenticationResponse
    - `id` string, required
    - `rawId` string, required
    - `type` 'public-key', required
    - `authenticatorAttachment` 'cross-platform' | 'platform'
    - `clientExtensionResults` object, required
      - `appid` boolean
      - `credProps` object
        - `rk` boolean
      - `hmacCreateSecret` boolean
    - `response` object, required
      - `clientDataJSON` string, required
      - `authenticatorData` string, required
      - `signature` string, required
      - `userHandle` string
  - `webauthn_challenge` string: WebAuthn challenge string

## Response `200`

Success

- SsoStartResponse
  - `authorization_url` string, required: URL to redirect user to for SSO authentication
  - `state` string, required: State parameter for CSRF protection
  - `redirect_uri` string, required: OAuth redirect URI used for the SSO provider callback
  - `client_binding` string, required: Secret the client keeps and sends back with the code and state to complete this sign-in

## Other responses

- `400`: Bad Request - The request was malformed or contained invalid data
- `401`: Unauthorized - Authentication is required or the token is invalid
- `403`: Forbidden - You do not have permission to perform this action
- `429`: Too Many Requests - You are being rate limited
- `500`: Internal Server Error - An unexpected error occurred

## Changes

> 64 revisions in range; 2 not diffed.

- **2026-10-29** `f3be906d37fe`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/fluxer/apis/fluxer-api/changes/users/@me/sso/link/start/post.md)

---

[API](https://skmtc.dev/fluxer/apis/fluxer-api.md) - [All operations](https://skmtc.dev/fluxer/apis/fluxer-api/llms.txt) - [OpenAPI document](https://skmtc.dev/fluxer/apis/fluxer-api/revisions/2092bc8b2edf?raw)