Receives the user back from JumpCloud and issues a one-time exchange code. Handled by us; documented for completeness. JumpCloud sends the browser here after JumpCloud: start sign-in. On success, the browser goes on to the dashboard's SSO callback page with ?code=, a one-time code (64 hex characters) that expires after 2 minutes by default; the dashboard redeems it with JumpCloud: exchange the code. On failure, it goes to the same page with ?error= and a reason.

Prerequisites: a sign-in started with JumpCloud: start sign-in, in the same browser.

Authentication: Public (no token). The user is identified by JumpCloud and matched by email address. The state must match the one stored in the browser's session, otherwise error=sso_failed. Only users with JumpCloud sign-in turned on, whose company is a partner, an account or a location, and who aren't locked or deactivated, get a code.

Rate limit: 10 requests per minute, counted per client IP address.