# Single sign-on

There are two stages in order to run SSO via the partner API:

1. Create a user in our system; if a login has not been created for the corresponding user, we will return an invitation token that will need to be passed alongside the SSO request
2. Redirect user to `/oauth/{provider}/sso?invite_token=` to initiate SSO.


Please reach out if you would like to use a common SSO provider, or if you would like to be added as a provider yourself.

## User Creation

Partners should call `GetOrCreateUser` ([gRPC](/grpc/partnersharedingressservice#getorcreateuser) | [REST](/openapi/partnersharedingressservice/getorcreateuser)) to fetch the invite token.

## Initiate SSO

Once the user has been created in Basic Capital, partners can redirect to the SSO endpoint. If an invitation token was returned, it should be included in the `invite_token` query param. Otherwise this can be left blank.

The URLs in order to initiate SSO are as follows:

| Environment | Admin | Employee |
|  --- | --- | --- |
| Production | `https://employer.basiccapital.com/oauth/{provider}/sso?invite_token={token}` | `https://app.basiccapital.com/oauth/{provider}/sso?invite_token={token}` |
| Development | `https://employer.basiccapital.dev/oauth/{provider}/sso?invite_token={token}` | `https://app.basiccapital.dev/oauth/{provider}/sso?invite_token={token}` |


## Redirect URIs

The SSO app will need to support the following redirect URIs:

| Environment | Admin | Employee |
|  --- | --- | --- |
| Production | `https://employer.basiccapital.com/oauth/{provider}/sso/callback` | `https://app.basiccapital.com/oauth/{provider}/sso/callback` |
| Development | `https://employer.basiccapital.dev/oauth/{provider}/sso/callback` | `https://app.basiccapital.dev/oauth/{provider}/sso/callback` |