---
title: "Reserves a nonce for a native SSO sign-in attempt."
method: POST
path: "/v1/external/{identityProviderId}/sso/native/nonce"
---

# Reserves a nonce for a native SSO sign-in attempt.

`POST /v1/external/{identityProviderId}/sso/native/nonce`

The web flow gets its nonce from M:Roblox.Authentication.Api.Controllers.V1.ExternalIdentitiesGatewayController.OAuthInit(System.Int64,System.Threading.CancellationToken), which native clients never call
because they have no authorization redirect. They call this instead, pass the nonce to the
provider SDK, and post the resulting id_token to /access.
            
The client must pass this value to the SDK verbatim. Both providers treat the nonce as an
opaque string and echo it into the id_token unchanged, and redemption looks the value up as
issued. The SHA256(nonce) convention seen in Apple examples belongs to Firebase, which hashes
on its own side before comparing; hashing here would make the lookup miss.

## Path parameters

- `identityProviderId` integer, required

## Response `200`

OK

- RobloxAuthenticationApiModelsResponseExternalIdentityGatewayExternalIdentityNonceResponse
  - `nonce` string

## Changes

- **2026-09-03** `d9b4ae8b3380` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/roblox/apis/roblox-api/changes/v1/external/:identityProviderId/sso/native/nonce/post.md)

---

[API](https://skmtc.dev/roblox/apis/roblox-api.md) · [All operations](https://skmtc.dev/roblox/apis/roblox-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/roblox/roblox-api/revisions/ce82f06a4ba6/schema)