The provider's return

GET

/sso/callback

Public; the provider sends the browser here. The code is exchanged
(client secret and PKCE verifier both presented), the person is read
from the userinfo endpoint (the address must be one the provider says
is verified), and turned into an account (made if unknown, at a
domain the team has verified), a membership (made or activated) and a
session. A link started with POST /sso/link binds the provider's
subject to that account, and to nothing else; a new link is mailed to
the account and audited (sso-linked). Ends on the console at
#/handoff?token=…&next=…; any failure ends on its sign-in page with
#/signin?sso_error=…. Audited (sso-signin).

Request

Query Params

Responses

🔵302

To the console, signed in — or to its sign-in page with the reason

This response does not have a body.

Request Example

Shell

JavaScript

Java

Swift

curl --location 'https://api.prod-orm.io/sso/callback?code=&state=&error=&error_description='

Modified at 2026-10-05 04:04:32

Begin a single sign-on

Link the signed-in account to a team's provider