The sso.auth module covers URL construction, hosted auth metadata, login flows, MFA completion, password recovery, and device authorization.
Key methods
sso.auth.getLoginUrl(provider, params)
Builds the end-user OAuth login URL.
Use org, service, and redirect_uri for tenant-scoped hosted auth.
sso.auth.getAdminLoginUrl(provider, params?)
Builds the admin OAuth login URL for platform and organization operators.
sso.auth.getContext(params?)
Fetches public hosted-auth metadata before a user starts login.
const context = await sso.auth.getContext({
org: 'acme-corp',
service: 'main-app',
redirect_uri: 'https://app.acme.com/callback',
});
Returns:
- public organization branding and status
- public service metadata
- available providers
- enabled auth methods
- redirect URI validation state when supplied
sso.auth.login(payload)
Password login. When MFA is required, the call returns a short-lived pre-auth token and the final session is completed with verifyMfa(...).
sso.auth.register(payload)
Registers a new user. Include org_slug and service_slug when the identity should be attributed to a tenant service.
sso.auth.requestPasswordReset(payload) and resetPassword(payload)
Start and finish the password reset flow.
sso.auth.logout()
Revokes the session and clears stored tokens.
sso.auth.deviceCode.request(...), verify(...), exchangeToken(...)
Beta device-flow methods based on RFC 8628 for CLIs and headless clients. This description does not claim protocol conformance.
sso.auth.enterprise.requestIdJag(payload)
Exchanges an AuthOS service-scoped JWT for a short-lived ID-JAG for a registered resource URI.
const idJag = await sso.auth.enterprise.requestIdJag({
client_id: 'service-client-id',
audience: 'https://auth.example.com',
resource: 'https://api.example.com/mcp',
subject_token: serviceAccessToken,
});
Pass scope only when the subject token already carries those scopes.
sso.auth.enterprise.exchangeIdJag(payload)
Exchanges an ID-JAG for a resource-scoped AuthOS bearer token.
const token = await sso.auth.enterprise.exchangeIdJag({
client_id: 'service-client-id',
client_secret: process.env.AUTHOS_SERVICE_CLIENT_SECRET!,
assertion: idJag.access_token,
});