auth
workos

Discover

Changed on

Email-domain SSO routing.

Looks up whether the email's domain belongs to a WorkOS Organization that's wired to one of our Organization rows. Returns the org slug + the /start URL the caller should redirect to. Returns {org_slug: null, login_url: null} when no SSO is configured for the domain — the caller falls back to global Google login.

When the caller supplies frontend_origin, it must match ALLOWED_FRONTEND_ORIGINS and is round-tripped into login_url so hosted browser callers can redirect to /start without rebuilding the query string themselves.

WorkOS is the source of truth for OrganizationDomain; we keep no local copy. One WorkOS API call per discover, which is acceptable since users only click "Continue with SSO" at most once per login.

get/api/auth/workos/discover

Request

  • Base URL
    https://api.quadrillion.io (the document declares no server; this is the origin it was published from)
  • URL
    https://api.quadrillion.io/api/auth/workos/discover
  • Auth
    none declared

Query parameters

emailstring required
frontend_originstring nullable

Response

Successful Response

org_slugstring nullable required
login_urlstring nullable required

Changes

  • abf76937a751Revision changes
    • info

      added the optional property // to the response with the status

    • info

      added the optional property // to the response with the status