Skip to main content

Sso Start

GET 
/api/v1/auth/sso/start

Initiate SAML SSO from mobile app.

Validates the return deeplink URL against an allowlist to prevent open-redirect abuse (D-06), then delegates to the existing SP-initiated SAML flow for the given workspace slug.

Secure mode (SEC-10 / SAML-01): when the client supplies code_challenge (PKCE S256) and state, they are stashed server-side so the ACS handler can bind them into a one-time code and redirect back with ?code=&state= (NO tokens). When absent, the ACS handler falls back to the legacy token-deeplink (gated by SSO_LEGACY_TOKEN_DEEPLINK_ENABLED) for current-mobile compat.

The spatialflowdev:// dev scheme is only allowed when SSO_ALLOW_DEV_SCHEME is True (False in production); spatialflow:// is always allowed.

Returns: 302: Redirect to IdP login page. 400: Invalid return URL or SAML configuration error.

Request​

Responses​

Found