v1/auth/onetap/idtoken/exchangeAuthorization
Descope Project ID Project ID as bearer token.
In: header
Request Body
application/json
1 <= length <= 2541 <= length <= 40961 <= length <= 254Exchanges one tap id token for a JWT
curl -X POST "https://api.descope.com/v1/auth/onetap/idtoken/exchange" \ -H "Content-Type: application/json" \ -d '{ "provider": "string", "idToken": "string", "nonce": "string" }'{ "sessionJwt": "string", "refreshJwt": "string", "cookieDomain": "string", "cookiePath": "string", "cookieMaxAge": 0, "cookieExpiration": 0, "user": { "loginIds": [ "string" ], "userId": "string", "name": "string", "email": "string", "phone": "string", "verifiedEmail": true, "verifiedPhone": true, "roleNames": [ "string" ], "userTenants": [ { "tenantId": "string", "roleNames": [ "string" ], "tenantName": "string", "permissions": [ "string" ], "roleIds": [ "string" ] } ], "status": "string", "externalIds": [ "string" ], "picture": "string", "test": false, "customAttributes": { "attribute-key": "attribute-value" }, "createdTime": 0, "TOTP": false, "SAML": false, "OAuth": { "property1": false, "property2": false }, "webauthn": true, "password": true, "ssoAppIds": [ "string" ], "givenName": "string", "middleName": "string", "familyName": "string", "editable": true, "SCIM": true, "push": true, "permissions": [ "string" ], "OIDC": true, "consentExpiration": 0, "recoveryEmail": "string", "verifiedRecoveryEmail": true, "recoveryPhone": "string", "verifiedRecoveryPhone": true, "modifiedTime": 0, "roleIds": [ "string" ], "recoveryCodes": true, "dependent": true, "userFamilies": [ { "familyId": "string", "roleNames": [ "string" ], "permissions": [ "string" ], "familyScopedAttributes": {} } ], "lockReason": "string", "tempLockExpiration": 0, "scimTenantId": "string", "samlTenantId": "string", "oidcTenantId": "string", "consentTenantId": "string", "lastLoginTime": 0 }, "firstSeen": true, "idpResponse": { "samlResponse": "string", "samlGeneratedUser": "string", "samlGeneratedRoles": "string", "oidcResponse": "string", "oidcGeneratedUser": "string", "oidcGeneratedRoles": "string", "idpGroups": [ "string" ], "idpSAMLAttributes": false, "idpOIDCClaims": {} }, "sessionExpiration": 0, "externalToken": "string", "claims": {}, "tenantSSOID": "string", "trustedDeviceJwt": "string", "nextRefreshSeconds": 0, "cookieName": "string", "sessionCookieName": "string", "sessionCookieDomain": "string", "unsavedSSO": true, "knownDeviceJwt": "string", "ssoAuthenticationOnly": true, "userCreationDeferred": true}/** * NOTE: if you add a new field to this message, also add it to the OptionalJWTResponse message */export interface Response {sessionJwt?: stringrefreshJwt?: stringcookieDomain?: stringcookiePath?: stringcookieMaxAge?: numbercookieExpiration?: numberuser?: ResponseUserfirstSeen?: booleanidpResponse?: IDPResponsesessionExpiration?: numberexternalToken?: stringclaims?: {}tenantSSOID?: stringtrustedDeviceJwt?: stringnextRefreshSeconds?: numbercookieName?: stringsessionCookieName?: stringsessionCookieDomain?: stringunsavedSSO?: booleanknownDeviceJwt?: string/** * Set only when the login went through an SSO configuration classified authentication only: the * person was verified, no user was created, updated or signed in, and no session was issued. * Lets a flow branch on what kind of login it just completed. Optional so it stays absent for * every ordinary auth response rather than adding a field nobody asked for. */ssoAuthenticationOnly?: booleanuserCreationDeferred?: boolean}export interface ResponseUser {loginIds?: string[]userId?: stringname?: stringemail?: stringphone?: stringverifiedEmail?: booleanverifiedPhone?: booleanroleNames?: string[]userTenants?: UserTenants[]status?: stringexternalIds?: string[]picture?: stringtest?: boolean/** * Custom attributes as key-value pairs. Keys must be strings; values can be strings, numbers, booleans, or arrays. */customAttributes?: {[k: string]: string}createdTime?: numberTOTP?: booleanSAML?: booleanOAuth?: {[k: string]: boolean}webauthn?: booleanpassword?: booleanssoAppIds?: string[]givenName?: stringmiddleName?: stringfamilyName?: stringeditable?: booleanSCIM?: booleanpush?: booleanpermissions?: string[]OIDC?: booleanconsentExpiration?: numberrecoveryEmail?: stringverifiedRecoveryEmail?: booleanrecoveryPhone?: stringverifiedRecoveryPhone?: booleanmodifiedTime?: number/** * roleIds holds the IDs of this entry's roles. Order is NOT guaranteed to match * roleNames — do not pair them by index. Use roleIds or roleNames independently. */roleIds?: string[]/** * whether the user has set up recovery codes */recoveryCodes?: booleandependent?: booleanuserFamilies?: UserFamilies[]lockReason?: stringtempLockExpiration?: number/** * scimTenantId is the tenant whose SCIM connection provisioned the user, empty when none or ambiguous. */scimTenantId?: string/** * samlTenantId is the tenant whose SAML SSO created the user or merged the user's login into it, empty when none or ambiguous. */samlTenantId?: string/** * oidcTenantId is the tenant whose OIDC SSO created the user or merged the user's login into it, empty when none or ambiguous. */oidcTenantId?: stringconsentTenantId?: string/** * lastLoginTime is the epoch time (in seconds) of the last time this user authenticated, 0 when the user has never logged in. * On a response that completes a sign-in - a flow, an OTP or password verification, an SSO exchange - this is the sign-in BEFORE * the current one, and it is 0 for a user signing in for the first time: the sign-in in progress is recorded after the response is * produced. Read the user again through Load User or My Details to get the sign-in that just completed. */lastLoginTime?: number}export interface UserTenants {tenantId?: stringroleNames?: string[]tenantName?: stringpermissions?: string[]/** * roleIds holds the IDs of this entry's roles. Order is NOT guaranteed to match * roleNames — do not pair them by index. Use roleIds or roleNames independently. */roleIds?: string[]}export interface UserFamilies {familyId?: stringroleNames?: string[]permissions?: string[]familyScopedAttributes?: {}}export interface IDPResponse {samlResponse?: stringsamlGeneratedUser?: stringsamlGeneratedRoles?: stringoidcResponse?: stringoidcGeneratedUser?: stringoidcGeneratedRoles?: stringidpGroups?: string[]idpSAMLAttributes?: booleanidpOIDCClaims?: {}}Create Redirect URI for Update User Request POST
### Link a social login (OAuth) identity to a signed-in user Links an OAuth identity to a user who is already signed in, such as when they connect a Google account from your app's settings. This is not a sign-in endpoint. The bearer token is `<Project ID>:<Refresh JWT>`, and the identity is linked to that user. By default, the provider's email must already be one of the user's login IDs, or the request fails. Set `allowAllMerge` to `true` to skip this check. ### When to use allowAllMerge Use it only when the user starts the linking themselves, for example to link a personal Google account to a work email. It doesn't check email verification and relies on the refresh JWT alone, so don't use it to merge identities at sign-in. See [Risks in Merging SSO and Non-SSO Identities](/sso/merging-sso-identities-risk). It is separate from the SSO `mergeUsers` and `allowMergeUsersWithMultipleTenants` settings, which merge SSO users at sign-in. ### Next Steps Call [Exchange Code](/api/oauth/exchange-code) from the page at `redirectUrl` to complete the linking. ### See Also - See [Social Login (OAuth) with Flows](/auth-methods/oauth#social-login-oauth-with-flows) for the **Update User / OAuth** flow action. Its **Merge without a common identifier (like email)** option is the flow equivalent of `allowAllMerge`. - See [The User Object](/api/overview#the-user-object) for further details on how to identify users and their contact information such as email addresses and phone number.
Verifies one tap id token for a code POST
Verifies one tap id token for a code