Portal SSO via auth code exchange

Exchanges a short-lived authorization code for an access token via the Core API, creates a new session, and redirects to the requested path. Used by the portal to embed Sales CoPilot in an iframe.

Flow:

1. Exchange code via Core API POST /auth/code/exchange (Basic auth with SSO client credentials)
2. Validate the returned access token via /user/me to get user/org info
3. Create a new session (always — never reuses an existing one)
4. Set session cookie (plus embedded cookie if embedded=1)
5. Revoke any prior session (best-effort)
6. Redirect to a clean URL (no code param in the final location)

GET /api/auth/sso

Portal SSO via auth code exchange

cURL

curl --request GET \
  --url https://app.demand-iq.com/api/auth/sso

Query Parameters

code · string · required

Short-lived authorization code issued by the portal

redirect · string · default: /decks

Internal path to redirect to after successful authentication

embedded · enum<string> · default: 0

Set to 1 when running inside a portal iframe. Enables embedded mode cookies and error handling.

Available options: 0, 1

theme · enum<string>

Portal theme preference. When set, a theme cookie is stored so the initial render matches the portal appearance without a flash.

Available options: light, dark

Response

302

Redirects to the redirect path on success, or to /login?error=sso_failed (standalone) / /embedded-auth-error (embedded) on failure. Returns a redirect on missing or invalid code, or Core API rejection.