JumpCloud SSO

Handoff flow: you redirect the user, Review Management handles the JumpCloud round-trip, and the user lands signed-in on the frontend. Your app does NOT receive the token or the OIDC code. Use this option when your users sign in via JumpCloud and your app's only role is launching the login.

All callable requests below use the the base URL Postman variable so the same collection works against dev, staging, and production environments. Set the base URL to your target environment's …/api/v1 URL in your Postman environment.

JumpCloud SSO does not require a client_id or client_secret from your side — the JumpCloud OIDC client is configured on the backend.

Flow

1. You send the user to the JumpCloud entrypoint (sub-request "Begin SSO redirect").
2. Review Management issues a Socialite redirect to JumpCloud; the user signs in there.
3. JumpCloud returns to Review Management with an OIDC code.
4. Review Management validates the user, mints a single-use exchange code, and redirects the browser to the globally-configured landing URL (JUMPCLOUD_FRONTEND_CALLBACK_URL on the backend — not per-client).
5. The frontend redeems the code against the base URL/auth/sso/exchange and starts the user's session.

Your app's role ends at step 1. There is no callback, token exchange, or credential handling on your side.

Pre-conditions for a test user

• Account exists with the same email as their JumpCloud account.
• User belongs to a partner or account (bundle_id >= 1 — super-admins are hard-blocked from SSO).
• The user's auth_methods includes jumpcloud.
• Account is not locked or inactive.

Error codes

If SSO fails, the user lands on the FE callback URL with ?error=<code>. The frontend renders the message — your app does not need to handle these.

FAQ

Can I receive the JumpCloud token in my own callback?

No. JumpCloud SSO lands on a single globally-configured frontend URL. Use Option 1 (Review Management login) if you need full client control.

Can I switch to Review Management login if JumpCloud isn't enabled for a user?

Yes — the flows are independent. Show both buttons, or call the "Discover auth methods" sub-request with the user's email to see what is supported for that specific user.

Do JumpCloud-issued sessions expire?

Yes. The frontend receives a Passport access token from the exchange step — the same token shape as Option 1, with the same expires_in (default ~1 year).

Prerequisites

• A bearer token in the Authorization header. Any endpoint that needs no token says so on its own page.
• The id of each record the call targets. Every endpoint page lists the ids it needs.

Errors

Individual endpoints may return more; each page lists its own.

Endpoints