---
title: "Dippr Redeem"
method: POST
path: "/auth/dippr/redeem"
tags: ["AUTH"]
---

# Dippr Redeem

`POST /auth/dippr/redeem`

## Request

- Base URL: `https://api.myaltimate.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.myaltimate.com/auth/dippr/redeem`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/myaltimate/apis/myaltimate-api/docs/auth/dippr/redeem/post.ts> (a function with typed inputs; its response is checked against the schema)

The Altimate IdP redeems a Dippr handoff ticket for who it names.

Returns identity claims only, never an auth_token or a session. Stateless:
the IdP, the only authenticated caller, consumes the ``jti``. Refusals are
generic so a caller cannot tell which check failed; the reason is logged,
the ticket never is. The current database role must still be exactly Owner.

## Headers

- `x-tenant` string

## Request body

- DipprRedeemIn: The Altimate IdP redeems a Dippr handoff ticket for identity claims.
  - `token` string, required

## Response `200`

Successful Response

- DipprIdentityOut: Who a redeemed Dippr handoff ticket names. Identity only: never an auth_token or any other SaaS credential.
  - `uid` string, required
  - `email` string, required
  - `first_name` string, nullable
  - `last_name` string, nullable
  - `company` string, required

## Other responses

- `400`: Invalid ticket
- `401`: Invalid client
- `403`: Access denied
- `404`: The IdP client is not configured.
- `422`: Validation Error

## Changes

- **2026-11-03** `868dfab8c7fe`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/myaltimate/apis/myaltimate-api/changes/auth/dippr/redeem/post.md)

---

[API](https://skmtc.dev/myaltimate/apis/myaltimate-api.md) - [All operations](https://skmtc.dev/myaltimate/apis/myaltimate-api/llms.txt) - [OpenAPI document](https://skmtc.dev/myaltimate/apis/myaltimate-api/revisions/01c038028180?raw)