Confirm an SSO-issued token and return the session. Called by the dashboard. Returns the session: the token you sent, echoed back, with the user, their company, theme and white-label branding.

Prerequisites: the bearer token to check, for example the one from JumpCloud: exchange the code.

Authentication: Partner or Account token. Describes the user the token belongs to; there is no id to pass. Any other token (for example a Location token) gets 403; a user whose account is inactive gets 400.

Rate limit: none.