sso

← All modules

2 endpoints.

GET /api/v1/sso/consume

Consume

Redeem a token on the TARGET host and land inside, already signed in.

Sets the same cookies a normal login sets, in the same shape the SPA reads (auth-store.writeStored does JSON.stringify(token), so the value carries literal quotes — a bare value reads back as a malformed token and every call 401s while looking exactly like a bad password).

Parameters

Name	In	Required	Type	Description
token	query	yes	string	A one-time token from /sso/launch
next	query	no	string	Where to land once signed in
hop	query	no	integer	Set by a gateway redirect; blocks a second one

200 — Successful Response

{}

422 — Validation Error

{
  "properties": {
    "detail": {
      "items": {
        "properties": {
          "loc": {
            "items": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "integer"
                }
              ]
            },
            "type": "array",
            "title": "Location"
          },
          "msg": {
            "type": "string",
            "title": "Message"
          },
          "type": {
            "type": "string",
            "title": "Error Type"
          }
        },
        "type": "object",
        "required": [
          "loc",
          "msg",
          "type"
        ],
        "title": "ValidationError"
      },
      "type": "array",
      "title": "Detail"
    }
  },
  "type": "object",
  "title": "HTTPValidationError"
}

---

POST /api/v1/sso/launch

Launch

Mint one-time sign-in links for the OTHER systems, for the signed-in user.

Requires a live session on this ERP — that session is the proof of identity the whole scheme rests on.

Not fail-fast on the signing key any more: a box holding only the public half can still mint for the hosts it serves itself (see :func:_signing), and 503-ing the whole call on its behalf took those hops down with it.

Parameters

Name	In	Required	Type	Description
targets	query	no	array	Hosts to open

200 — Successful Response

{}

422 — Validation Error

{
  "properties": {
    "detail": {
      "items": {
        "properties": {
          "loc": {
            "items": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "integer"
                }
              ]
            },
            "type": "array",
            "title": "Location"
          },
          "msg": {
            "type": "string",
            "title": "Message"
          },
          "type": {
            "type": "string",
            "title": "Error Type"
          }
        },
        "type": "object",
        "required": [
          "loc",
          "msg",
          "type"
        ],
        "title": "ValidationError"
      },
      "type": "array",
      "title": "Detail"
    }
  },
  "type": "object",
  "title": "HTTPValidationError"
}