Admin-scoped Passport OAuth client registration (this app acting as an OAuth Identity Provider) plus the external JumpCloud OIDC SSO handoff.
Admin-scoped Passport OAuth client registration (this app acting as an OAuth Identity Provider) plus the external JumpCloud OIDC SSO handoff. Client-management endpoints (create / list / view / update / delete client, create password-grant client) require a bearer token and are owner-scoped. A client can only be managed by the user who created it. rs-login verifies a bearer token and returns the SSO session payload for partner/account users. auth/sso/jumpcloud/callback (browser 302) and auth/sso/exchange (one-time-code redemption) are the public JumpCloud OIDC leg — no token. They issue/redeem a single-use exchange code and hand back a Passport access token.
Prerequisites
- A bearer token in the
Authorizationheader. Any endpoint that needs no token says so on its own page. - The id of each record the call targets. Every endpoint page lists the ids it needs.
Errors
| Status | Meaning |
|---|---|
401 | The bearer token is missing, expired or invalid |
403 | The token is valid but the record sits outside your account |
422 | The request failed validation — the response names the fields |
500 | Unexpected server error |
Individual endpoints may return more; each page lists its own.
Endpoints
| Method | Endpoint | Description |
|---|---|---|
POST | Create OAuth client (authorization code grant) | Create a Passport authorization-code grant OAuth client (name + redirect URLs) owned by the authenticated user. |
POST | Create password-grant client | Create a Passport password-grant client used to mint tokens via the password flow. |
GET | List OAuth clients | List the OAuth clients owned by the caller, ordered by name. |
POST | View OAuth client | Returns the details of a single OAuth client owned by the caller. |
POST | Update OAuth client | Update the name and redirect URLs of an existing OAuth client. |
POST | Delete OAuth client | Revoke every token issued for the client and deletes it. |
GET | SSO login (verify token, return session) | SSO callback: verifies the presented bearer token and returns the login session payload (user, company, theme, white-label). |
GET | JumpCloud OIDC callback (issue exchange code) | JumpCloud redirects the browser here after sign-in. |
GET | Exchange SSO code for access token | The SPA hits this to redeem the one-time SSO code issued by the JumpCloud callback. |