There are two stages in order to run SSO via the partner API:
- Create a user in our system; if a login has not been created for the corresponding user, we will return an invitation token that will need to be passed alongside the SSO request
- Redirect user to
/oauth/{provider}/sso?invite_token=to initiate SSO.
Please reach out if you would like to use a common SSO provider, or if you would like to be added as a provider yourself.
Partners should call GetOrCreateUser (gRPC) to fetch the invite token.
Once the user has been created in Basic Capital, partners can redirect to the SSO endpoint. If an invitation token was returned, it should be included in the invite_token query param. Otherwise this can be left blank.
The URLs in order to initiate SSO are as follows:
| Environment | Admin | Employee |
|---|---|---|
| Production | https://employer.basiccapital.com/oauth/{provider}/sso?invite_token={token} | https://app.basiccapital.com/oauth/{provider}/sso?invite_token={token} |
| Development | https://employer.basiccapital.dev/oauth/{provider}/sso?invite_token={token} | https://app.basiccapital.dev/oauth/{provider}/sso?invite_token={token} |
The SSO app will need to support the following redirect URIs:
| Environment | Admin | Employee |
|---|---|---|
| Production | https://employer.basiccapital.com/oauth/{provider}/sso/callback | https://app.basiccapital.com/oauth/{provider}/sso/callback |
| Development | https://employer.basiccapital.dev/oauth/{provider}/sso/callback | https://app.basiccapital.dev/oauth/{provider}/sso/callback |