Error

A valid request URL is required to generate request examples

{
  "authorization_url": "<string>",
  "state": "<string>",
  "expires_at": "2023-11-07T05:31:56Z"
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

Hosted auth

Start a social sign-in

Hosted mode only. Stores the in-flight authorization and answers with the URL to send the browser to.

The state comes back to the caller because nothing on this surface rides a cookie: hold it (session storage is the usual place) and present it at the callback — that is what proves the two halves are one flow. PKCE is applied on every flow; the verifier never leaves the API.

The OAuth application belongs to the organization: register it in your provider’s console and store the credentials with PUT /v1/organization/environments/{id}/oauth/{provider}, so the consent screen carries your name. A test environment with nothing configured may fall back to a shared UserKit application; live never does.

redirect_uri must be an absolute http(s) URL, and its origin must be in the publishable key’s allowed-origins list when that list is set.

Rate limited to 30 requests per hour per IP.

POST

contact-auth

oauth

{provider}

start

Error

A valid request URL is required to generate request examples

{
  "authorization_url": "<string>",
  "state": "<string>",
  "expires_at": "2023-11-07T05:31:56Z"
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

Parâmetros de caminho

provider

enum<string>

obrigatório

The social provider. google today; adding one is a row and an implementation, never a migration.

Opções disponíveis:

google

Corpo

application/json

publishable_key

string

obrigatório

redirect_uri

string<uri>

obrigatório

Where the provider sends the browser back. Must match byte for byte at the callback.

anonymous_id

string

The visitor whose history this sign-in should inherit.

attribution

object

First touch, captured on the visitor at first load and preserved through a merge. All fields optional; empty means unknown.

Show child attributes

Resposta

The flow is open.

authorization_url

string<uri>

Send the browser here.

state

string

uk_os_…. Hold it and present it at the callback.

expires_at

string<date-time>

Reset a contact's password Finish a social sign-in

⌘I

Visão geral

Endpoints

Start a social sign-in

Parâmetros de caminho

Corpo

Resposta