---
title: "Complete social login"
method: POST
path: "/api/auth/social/complete"
tags: ["Auth"]
---

# Complete social login

`POST /api/auth/social/complete`

## Request

- Base URL: `https://demo.hitkeep.com`
- URL: `https://demo.hitkeep.com/api/auth/social/complete`
- Auth: none declared

Consumes a short-lived completion token once, resolves or safely links the immutable identity, accepts a bound invitation when applicable, and returns the standard login or MFA-required shape. Microsoft first links require HitKeep email confirmation unless an authenticated session or valid invitation proves the account.

## Request body

- SocialCompleteRequest
  - `completion_token` string, required
  - `email` string, email: HitKeep target email required for a first unauthenticated Microsoft link.

## Response `200`

Social login result

- SocialCompleteResponse
  - `challenge_token` string
  - `factors` string[]
  - `passkey` object
  - `status` 'ok' | 'mfa_required' | 'signup_required' | 'verification_sent', required
  - `completion_token` string: Replacement one-time token returned only when signup details are required.
  - `redirect_url` string

## Other responses

- `400`: Invalid flow or target email
- `403`: Account unavailable
- `409`: Completion replay or identity conflict

---

[API](https://skmtc.dev/hitkeep/apis/hitkeep-rest-api.md) · [All operations](https://skmtc.dev/hitkeep/apis/hitkeep-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hitkeep/apis/hitkeep-rest-api/revisions/bb2df36ab2a4?raw)