Complete an SSO login: exchange the `token` Stytch appended to the login redirect (`stytch_token_type=sso`) for a session.

PUT

/login/sso

curl --request PUT \
  --url https://api.siteqwality.com/login/sso \
  --header 'Content-Type: application/json' \
  --data '{ "token": "example" }'

• Production

Stytch runs the whole IdP dance, so there is no SAML parsing here. The local user mirror must already exist (created at invite time or by the SCIM webhook); a member without one is refused rather than auto-created, which keeps seat accounting and the account linkage in one place.

Request Body ^required

Media type application/json

Body for POST /login/sso, which completes the SSO redirect.

object

token

required

The token query param Stytch appends to the login redirect URL when stytch_token_type=sso.

string

Example ^generated

{
  "token": "example"
}

Responses

200

Authenticated

Media type application/json

Unified authentication response returned by login, signup, and refresh endpoints.

object

session_token

required

string

session_jwt

required

string

member

required

Full member info returned on every authentication response.

object

name

string | null

email

required

string

organization_id

required

string

roles

required

Array<string>

Example ^generated

{
  "session_token": "example",
  "session_jwt": "example",
  "member": {
    "name": "example",
    "email": "example",
    "organization_id": "example",
    "roles": [
      "example"
    ]
  }
}

401

Invalid SSO token, or no local user for this member

500

Internal server error