SSO login

Standard OAuth Authorization Code grant. Use this option when your app needs the access token server-side. The token never leaves your backend except for the one-shot handoff URL.

All callable requests below use the the base URL Postman variable so the same collection works against dev, staging, and production environments. Set the base URL to your target environment's …/api/v1 URL in your Postman environment.

What you need before you start

Flow

1. Send the user to Review Management — top-level browser redirect to the base URL/./oauth/authorize with the params shown in the sub-request below. state is a random string you generate and persist in session (CSRF protection).
2. Receive the code — Review Management bounces the user back to your registered redirect_uri with ?code=…&state=…. Verify state matches what you stored.
3. Exchange the code for a token — call the "Step 3" sub-request.
4. Use the token — either call RM APIs with Authorization: Bearer <access_token>, or hand off to the frontend at <frontend_url>/rs-sso-login/?token=<access_token>. The frontend picks up the token and starts the user's session.

Token revocation

See the "Revoke token" sub-request.

Token expiry & refresh

The endpoint returns the token-response expires_in in seconds (default ~1 year). Use the refresh_token against POST /oauth/token with grant_type=refresh_token to get a new access token before expiry.

A note on the base URL/./oauth/.

Passport's OAuth endpoints sit at the host root (not under /api/v1). The . in the path is a relative segment that Postman normalizes before sending — <host>/api/v1/./oauth/token becomes <host>/oauth/token. This keeps the collection environment-portable.

Pre-go-live checklist

• You have client_id and client_secret.
• Your redirect_uri is registered and exactly matches what you send.
• You verify state on the OAuth callback (CSRF protection).
• You store the access token server-side. The only legitimate URL use is the one-shot handoff to rs-sso-login.
• You never log or expose client_secret.

Prerequisites

• A bearer token in the Authorization header. Any endpoint that needs no token says so on its own page.
• The id of each record the call targets. Every endpoint page lists the ids it needs.

Errors

Individual endpoints may return more; each page lists its own.

Endpoints