Skip to main content
POST
auth.social.start

Authorizations

Authorization
string
header
required

API key: sk_live_…

Headers

Idempotency-Key
string

Optional. A retry with the same key returns the stored result.

Maximum string length: 255
Pramaan-Account
string

Optional. One of your account ids (GET /v1/accounts): run on that account, whatever your routing rules say. The response header X-Pramaan-Account names the account that ran.

Pramaan-End-User
string

Optional. Your own tag for your end user: a sticky: end_user rule keeps them on the account that first served them.

Maximum string length: 256
Pramaan-End-User-Group
string

Optional. Your end user's group, matched by rules with endUserGroup.

Maximum string length: 64

Body

application/json
providerKey
enum<string>
required

The connected sign-in product.

Available options:
google,
microsoft
redirectUri
string
required

Exact registered https callback of your app.

Maximum string length: 2048
state
string
required

Fresh random state saved in this visitor's server session; compare it on return.

Required string length: 22 - 512
Pattern: ^[A-Za-z0-9._~-]+$
nonce
string
required

Fresh random nonce saved in this visitor's server session.

Required string length: 22 - 512
Pattern: ^[A-Za-z0-9._~-]+$
codeChallenge
string
required

Base64url SHA-256 of the proof-key verifier kept in the visitor's session.

Pattern: ^[A-Za-z0-9_-]{43}$

Response

The result

startRef
string
required

Opaque reference to this one-time sign-in.

Pattern: ^(ref_[0-9A-HJKMNP-TV-Z]{26}|rh_[A-Za-z0-9_-]{24,1024})$
authorizationUrl
string
required

One-time hosted sign-in link.

Pattern: ^https:\/\/[^/?#]+\/connect\/link\/[A-Za-z0-9._~-]+$
state
string
required

The state supplied by your app; keep it in the same visitor's session.

expiresAt
string
required

When this sign-in expires, ISO 8601; at most ten minutes.