---
title: "Complete SSO Authentication"
method: POST
path: "/v1/auth/sso-complete"
tags: ["Auth: SSO"]
---

# Complete SSO Authentication

`POST /v1/auth/sso-complete`

## Request

- Base URL: `https://api.robosystems.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.robosystems.ai/v1/auth/sso-complete`
- Auth: none declared

Step 3 of 3. Exchanges the session ID for a full JWT token. Called by the target app after redirect.

## Request body

- SSOCompleteRequest: SSO completion request model.
  - `session_id` string, required: Temporary session ID from secure handoff

## Response `200`

Successful Response

- AuthResponse: Authentication response model.
  - `user` object, required: User information
  - `org` object, nullable: Organization information (personal org created automatically on registration)
  - `message` string, required: Success message
  - `status` 'authenticated' | 'mfa_required' | 'mfa_enrollment_required': Login flow state: authenticated (token present), or a passkey MFA step is required before a session is issued (mfa_token present)
  - `mfa_token` string, nullable: Short-lived token authorizing the MFA second step or forced enrollment; present only when status is not 'authenticated'
  - `token` string, nullable: JWT authentication token (optional for cookie-based auth)
  - `expires_in` integer, nullable: Token expiry time in seconds from now
  - `refresh_threshold` integer, nullable: Recommended refresh threshold in seconds before expiry

## Other responses

- `400`: Invalid request
- `422`: Validation Error
- `429`: Rate limit exceeded
- `500`: Internal server error

---

[API](https://skmtc.dev/robosystems/apis/robosystems-api.md) · [All operations](https://skmtc.dev/robosystems/apis/robosystems-api/llms.txt) · [OpenAPI document](https://skmtc.dev/robosystems/apis/robosystems-api/revisions/e661e2d5ca6a?raw)