POST/auth/login-sso

Sign in with single sign-on

Exchanges an identity provider's ID token for a SQRL access token, creating the account on first use if no account matches the identity.

AccessNo sign-in required

Use this route when your organisation signs members in through a federated identity provider. Obtain an ID token from the provider in your own client, then pass it through unchanged. If no SQRL account matches the identity in the token, the call registers one, so the same request covers both a first sign-in and every later one.

The response carries the access token directly. It has no requires_2FA field, so there is no second step on this route. As with POST /auth/login, a secure refresh cookie is set through Set-Cookie; keep it, along with uid and sid, for POST /auth/refresh. The user_info object is the User shape described in Shared objects.

Body parameters

idTokenstringrequired

The ID token issued by your identity provider, passed through exactly as it was received.

bash

curl -X POST "$SQRL_API/auth/login-sso" \
  -H "content-type: application/json" \
  -c sqrl-cookies.txt \
  -d '{
        "idToken": "<provider-id-token>"
      }'

const res = await fetch(`${process.env.SQRL_API}/auth/login-sso`, {
  method: "POST",
  headers: { "content-type": "application/json" },
  credentials: "include",
  body: JSON.stringify({
    idToken: "<provider-id-token>",
  }),
});
const { uid, sid, token, user_info } = await res.json();

rust

let res = client
    .post(format!("{}/auth/login-sso", api_base))
    .json(&serde_json::json!({
        "idToken": "<provider-id-token>",
    }))
    .send()
    .await?;

Response200 OK

{
"uid": 4021,
"sid": "sid_01HZXD5N8V",
"token": "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiI0MDIxIn0.7Qk1x…f3d",
"user_info": {
  "UUID": 4021,
  "Email": "operator@example.com",
  "FirstName": { "String": "Ada", "Valid": true },
  "Surname": { "String": "Okafor", "Valid": true },
  "LastLogin": { "Time": "2026-08-03T09:14:22Z", "Valid": true },
  "PhoneNumber": { "String": "+441632960431", "Valid": true },
  "DefaultOrg": 118,
  "DefaultWorkspace": 342,
  "OrganisationsInfo": {
    "Organisations": [
      {
        "OrgID": 118,
        "OrgName": "Northgate Treasury",
        "Workspaces": {
          "Workspaces": [
            {
              "WorkspaceInfo": {
                "uid": 342,
                "name": "Treasury Operations",
                "description": "Live issuance and settlement",
                "net": "mainnet"
              },
              "Role": {
                "RoleId": 77,
                "Name": "Approver",
                "Description": "Reviews and signs pending movements",
                "Perm": [
                  { "UID": 6, "RuleName": "PAYMENT_APPROVE" },
                  { "UID": 8, "RuleName": "VIEW_BALANCES" }
                ]
              }
            }
          ]
        }
      }
    ]
  }
}
}

#What happens next

Send token as a bearer token on every later call, and refresh it with POST /auth/refresh before it expires. Where this call registered the account rather than matching an existing one, check OrganisationsInfo: an account that belongs to no organisation yet either waits for a workspace invitation or submits POST /api/v1/request-organisation.

Was this page helpful?