---
title: "Start SSO login"
method: POST
path: "/api/auth/sso/start"
tags: ["Auth"]
---

# Start SSO login

`POST /api/auth/sso/start`

## Request

- Base URL: `https://demo.hitkeep.com`
- URL: `https://demo.hitkeep.com/api/auth/sso/start`
- Auth: none declared

Resolves an enabled team OIDC provider from the submitted email or invitation, requires an existing membership, a pending invitation, or enabled trusted-domain auto-provisioning, and creates a short-lived state, nonce, and PKCE-protected authorization request. Existing password login remains available.

## Request body

- union
  - object
    - `email` string, email, required
    - `invite_token` string: Invitation token used instead of email when starting SSO from invitation acceptance.
    - `remember_me` boolean
    - `return_url` string: Optional same-origin application path. Unsafe or authentication paths fall back to /.
  - object
    - `email` string, email
    - `invite_token` string, required: Invitation token used instead of email when starting SSO from invitation acceptance.
    - `remember_me` boolean
    - `return_url` string: Optional same-origin application path. Unsafe or authentication paths fall back to /.

## Response `200`

OIDC authorization URL

- SSOStartResponse
  - `auth_url` string, uri, required

## Other responses

- `400`: Invalid email or no enabled SSO provider for the email domain
- `403`: The account has no team membership, pending invitation, or permitted JIT access, or a managed-cloud limit was reached
- `503`: Configured SSO provider is unavailable

---

[API](https://skmtc.dev/hitkeep/apis/hitkeep-rest-api.md) · [All operations](https://skmtc.dev/hitkeep/apis/hitkeep-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hitkeep/apis/hitkeep-rest-api/revisions/bb2df36ab2a4?raw)