OAuth clients
Admin-scoped Passport OAuth client registration (this app acting as an OAuth Identity Provider) plus the external JumpCloud OIDC SSO handoff.
Admin-scoped Passport OAuth client registration (this app acting as an OAuth Identity Provider) plus the external JumpCloud OIDC SSO handoff. Client-management endpoints (create / list / view / update / delete client, create password-grant client) require a bearer token and are owner-scoped. A client can only be managed by the user who created it. rs-login verifies a bearer token and returns the SSO session payload for partner/account users. auth/sso/jumpcloud/callback (browser 302) and auth/sso/exchange (one-time-code redemption) are the public JumpCloud OIDC leg — no token. They issue/redeem a single-use exchange code and hand back a Passport access token.
Prerequisites
- A bearer token in the
Authorizationheader. Any endpoint that needs no token says so on its own page. - The id of each record the call targets. Every endpoint page lists the ids it needs.
Errors
| Status | Meaning |
|---|---|
401 | The bearer token is missing, expired or invalid |
403 | The token is valid but the record sits outside your account |
422 | The request failed validation — the response names the fields |
500 | Unexpected server error |
Individual endpoints may return more; each page lists its own.
Endpoints
POST — Create a Passport authorization-code grant OAuth client (name + redirect URLs) owned by the authenticated user.
POST — Create a Passport password-grant client used to mint tokens via the password flow.
GET — SSO callback: verifies the presented bearer token and returns the login session payload (user, company, theme, white-label).
GET — JumpCloud redirects the browser here after sign-in.
GET — The SPA hits this to redeem the one-time SSO code issued by the JumpCloud callback.
Updated 15 days ago