---
title: "Initiate a Single-Sign On flow."
method: POST
path: "/sso"
tags: ["sso"]
---

# Initiate a Single-Sign On flow.

`POST /sso`

## Request body

- object
  - `domain` string, hostname — Email address domain used to identify the SSO provider.
  - `provider_id` string, uuid
  - `redirect_to` string, uri
  - `skip_http_redirect` boolean — Set to `true` if the response to this request should not be a HTTP 303 redirect -- useful for browser-based applications.
  - `code_challenge` string
  - `code_challenge_method` 'plain' | 's256'
  - `gotrue_meta_security` GoTrueSecurity — Use this property to pass a CAPTCHA token only if you have enabled CAPTCHA protection.
    - `captcha_token` string

## Response `200`

Returned only when `skip_http_redirect` is `true` and the SSO provider could be identified from the `provider_id` or `domain`. Client libraries should use the returned URL to redirect or open a browser.

- object
  - `url` string, uri

## Other responses

- `303` — Returned only when `skip_http_redirect` is `false` or not present and the SSO provider could be identified from the `provider_id` or `domain`. Client libraries should follow the redirect. 303 is used instead of 302 because the request should be executed with a `GET` verb.
- `400` — HTTP Bad Request response. Can occur if the passed in JSON cannot be unmarshalled properly or when CAPTCHA verification was not successful. In certain cases can also occur when features are disabled on the server (e.g. sign ups). It may also mean that the operation failed due to some constraint not being met (such a user already exists for example).
- `404` — Returned when the SSO provider could not be identified.

## Changes

- **2025-02-07** `4d0f1a6c1ad9` — 2 info
  - added the optional property `error_code` to the response with the `400` status
  - added the optional property `error_code` to the response with the `404` status
- **2023-12-13** `77f9aeb9339a` — 2 info
  - added the optional property `weak_password` to the response with the `400` status
  - added the optional property `weak_password` to the response with the `404` status
- **2023-08-23** `ffb4de94b0fb` — 2 info
  - added the new optional request property `code_challenge`
  - added the new optional request property `code_challenge_method`
- **2023-02-01** `144a34ca6d74` — 6 warning
  - removed the request property `code_challenge`
  - removed the request property `code_challenge_method`
  - removed the optional property `error_code` from the response with the `400` status
  - removed the optional property `error_code` from the response with the `404` status
  - …2 more

[Change history](https://skmtc.dev/supabase/apis/supabase-auth-rest-api/changes/sso/post.md)

---

[API](https://skmtc.dev/supabase/apis/supabase-auth-rest-api.md) · [All operations](https://skmtc.dev/supabase/apis/supabase-auth-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/supabase/supabase-auth-rest-api/revisions/2e2a74a7459f/schema)