Auth

Complete SSO login

Consumes one OIDC callback, validates the authorization state, PKCE exchange, signed ID token, issuer, audience, nonce, verified email, and allowed domain, then rechecks live team authorization. A scoped pending invitation retains its requested role; optional trusted-domain JIT provisioning creates a Member only after managed-cloud limits pass. Provider access, ID, and refresh tokens are never persisted.

get/api/auth/sso/callback

Request

  • Base URL: https://demo.hitkeep.com
  • URL: https://demo.hitkeep.com/api/auth/sso/callback
  • Auth: none declared

Query parameters

statestring required
codestring
errorstring

Changes

No recorded changes to this operation across all 1 revision of this API.