SSO callback (code exchange)
Exchanges the authorization code from the Identity Provider for tokens, validates the ID token, and performs JIT user provisioning if needed. Returns Supabase JWT tokens for the authenticated session.
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Request to complete SSO login (callback from IdP).
Response Body
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/v1/auth/sso/callback" \ -H "Content-Type: application/json" \ -d '{ "code": "string", "state": "string" }'{ "accessToken": "string", "refreshToken": "string", "expiresIn": 0, "expiresAt": "string", "isNewUser": true}{ "code": "string", "message": "string", "request_id": "string", "details": [ { "field": "string", "message": "string" } ]}{ "code": "string", "message": "string", "request_id": "string", "details": [ { "field": "string", "message": "string" } ]}{ "code": "string", "message": "string", "request_id": "string", "details": [ { "field": "string", "message": "string" } ]}{ "code": "string", "message": "string", "request_id": "string", "details": [ { "field": "string", "message": "string" } ]}{ "code": "string", "message": "string", "request_id": "string", "details": [ { "field": "string", "message": "string" } ]}{ "code": "string", "message": "string", "request_id": "string", "details": [ { "field": "string", "message": "string" } ]}{ "code": "string", "message": "string", "request_id": "string", "details": [ { "field": "string", "message": "string" } ]}{ "code": "string", "message": "string", "request_id": "string", "details": [ { "field": "string", "message": "string" } ]}{ "code": "string", "message": "string", "request_id": "string", "details": [ { "field": "string", "message": "string" } ]}Initiate SSO login
Previous Page
OAuth provider redirect callback.
Called by the IdP (Azure AAD, Google) after the user consents at their authorize URL. Consumes the one-time `state`, exchanges the `code` for tokens (persisting the refresh token to the vault + cache), then upserts `user_provider_identity_linking` with the IdP subject claim. Response body depends on whether the state row had a `return_to`: - Set: 302 to that URL with `?status=success` (used by CLI static page). - Unset: 200 with HTML that `postMessage`s the popup opener and closes.