Skip to main content
POST
Start Browser Login

Body

application/json
cli_verifier_sha256
string
required

SHA-256 hex digest of the CLI's verifier random value.

localhost_redirect_uri
string
required

CLI's localhost callback URI. Must match http://127.0.0.1:<port>/callback with a non-privileged port and no query, fragment, or credentials.

Example:

"http://127.0.0.1:54321/callback"

localhost_state_sha256
string
required

SHA-256 hex digest of the CLI's localhost-state random value.

customer_slug
string | null
Example:

"acme"

tenant_slug
string | null

Optional tenant slug to scope the eventual session to a specific tenant. When omitted the human session is account-scoped.

Only valid alongside customer_slug — the no-slug consumer flow cannot pre-bind a tenant because the customer is unresolved until callback. The resolved session in the consumer flow is always account-scoped.

Example:

"acme-prod"

Response

SSO authorization started

Response body for POST /v1/admin/login-requests.

authorization_url
string
required
Example:

"https://api.workos.com/sso/authorize?..."

login_request_id
string<uuid>
required

Stable Mount Thor identifier for this login attempt.

state_expires_in_seconds
integer<int64>
required
Example:

1800