---
title: "Complete SSO login"
method: GET
path: "/api/auth/sso/callback"
tags: ["Auth"]
---

# Complete SSO login

`GET /api/auth/sso/callback`

## Request

- Base URL: `https://demo.hitkeep.com`
- URL: `https://demo.hitkeep.com/api/auth/sso/callback`
- Auth: none declared

Consumes one OIDC callback, validates the authorization state, PKCE exchange, signed ID token, issuer, audience, nonce, verified email, and allowed domain, then rechecks live team authorization. A scoped pending invitation retains its requested role; optional trusted-domain JIT provisioning creates a Member only after managed-cloud limits pass. Provider access, ID, and refresh tokens are never persisted.

## Query parameters

- `state` string, required
- `code` string
- `error` string

## Other responses

- `303`: Redirects to the requested safe return path on success. Failed invitation flows return to invitation acceptance with the unconsumed token and a stable error code; other failures return to login.

---

[API](https://skmtc.dev/hitkeep/apis/hitkeep-rest-api.md) · [All operations](https://skmtc.dev/hitkeep/apis/hitkeep-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hitkeep/apis/hitkeep-rest-api/revisions/bb2df36ab2a4?raw)