Exchange SSO code for access token

Overview

The SPA hits this to redeem the one-time SSO code issued by the JumpCloud callback. It validates and single-use-redeems the code under a DB lock, re-checks eligibility, and issues a Passport access token. It then fires UserLoggedIn and 302-redirects to {FRONTEND_URL}/rs-sso-login/?token=<accessToken>. An invalid / expired / already-redeemed code returns a 400 JSON error. Emits audit SSO_EXCHANGE_CODE_REDEEMED + AUTH_LOGIN on success, SSO_EXCHANGE_CODE_INVALID on failure.

Prerequisites

• No authentication — this endpoint is public.
• Values for the required query parameter code — see the table below.

Base URL

Endpoint

GET /api/v1/auth/sso/exchange

Authentication

• No bearer token required.

• Public. The one-time code is the credential.

Rate limit

• 10 requests/min per IP; public.

Query parameters

How it works

• On success: 302 to the frontend with ?token=<accessToken> (the token is delivered via the redirect URL, not a JSON body). On failure: 400 JSON Invalid or expired SSO code.

Response

302 Redirect (success) · 302

(empty body)

400 Invalid or expired code · 400

{
  "message": "Invalid or expired SSO code.",
  "status": "error",
  "errors": []
}

Errors

Example request

curl --request GET \
  --url "https://production-api.shoutaboutus.com/api/v1/auth/sso/exchange?code=<one_time_code>" \
  --header 'Accept: application/json'