> ## Documentation Index > Fetch the complete documentation index at: https://docs.prelude.so/llms.txt > Use this file to discover all available pages before exploring further. # Initiate enterprise OAuth (OIDC SSO) authorization > Start an enterprise OIDC SSO flow. The connection is resolved either from the user's `email` domain (which must match exactly one enabled connection's `email_domain_allowlist`) or from an explicit `connection_id`; provide exactly one. The provider is derived from the connection, so no provider path segment is needed. Returns the authorization URL to redirect the user to. The IdP callback reuses the per-provider callback endpoint, disambiguated by the connection carried on the flow state. ## OpenAPI ````yaml post /v1/session/login/oauth/authorize openapi: 3.1.1 info: title: Prelude Auth Frontend API version: 0.0.1 description: The Prelude Frontend API for Authentication and Session Management contact: email: support@prelude.so servers: - url: https://{appId}.session.prelude.dev description: Production server variables: appId: default: changeme description: The appID security: [] tags: - name: Login OTP description: Login and step-up via OTP (phone or email) - name: Login Email Password description: Login via email and password - name: Login OAuth description: Login via OAuth providers - name: Login SAML description: Login via SAML 2.0 SSO connections (Okta, Google Workspace) - name: Login Finalize description: Finalize a login flow and create a session - name: Login Migration description: Migrate sessions from a legacy authentication system - name: Session description: Session refresh and revocation - name: Session Management description: Authenticated session and identifier management - name: Step-Up description: Step-up authentication flow - name: Well-Known description: Public key and authorization-server discovery endpoints - name: OAuth Server description: >- OAuth 2.0 authorization-server endpoints that let MCP clients and other third-party apps sign your users in - name: Password description: Password compliancy and change password - name: Passkey Login description: >- Primary-factor (passwordless) sign-in via WebAuthn discoverable credentials - name: Passkey Management description: >- Register / list / rename / delete the authenticated user's passkey credentials paths: /v1/session/login/oauth/authorize: post: tags: - Login OAuth summary: Initiate enterprise OAuth (OIDC SSO) authorization description: | Start an enterprise OIDC SSO flow. The connection is resolved either from the user's `email` domain (which must match exactly one enabled connection's `email_domain_allowlist`) or from an explicit `connection_id`; provide exactly one. The provider is derived from the connection, so no provider path segment is needed. Returns the authorization URL to redirect the user to. The IdP callback reuses the per-provider callback endpoint, disambiguated by the connection carried on the flow state. operationId: oauthEnterpriseAuthorize requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/EnterpriseOAuthAuthorizeRequest' responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/OAuthAuthorizeResponse' '400': description: Bad Request content: application/json: schema: oneOf: - $ref: '#/components/schemas/BadRequestError' - $ref: '#/components/schemas/OAuthProviderNotConfiguredError' - $ref: '#/components/schemas/OAuthProviderDisabledError' - $ref: '#/components/schemas/InvalidRedirectURIError' '404': description: Not Found content: application/json: schema: $ref: '#/components/schemas/OAuthNoConnectionForEmailError' '500': description: Internal Error content: application/json: schema: $ref: '#/components/schemas/InternalError' components: schemas: EnterpriseOAuthAuthorizeRequest: type: object description: Provide exactly one of `email` or `connection_id`. properties: email: type: string format: email description: The email whose domain resolves the enterprise connection. examples: - jane@acme.com connection_id: type: string description: >- Addresses an enterprise connection directly. Accepts a bare id (`ocon_…`) or an `oidc:`-prefixed form. examples: - ocon_01jqebhswje1ka1z7ahr9rfsgt redirect_uri: type: string description: >- URI to redirect to after authentication. Must be allowlisted for the app. Falls back to the connection's `default_redirect_uri` when omitted. examples: - https://app.acme.com/callback code_challenge: type: string description: PKCE code challenge (S256) bound to the eventual login finalize. examples: - E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM code_challenge_method: type: string enum: - S256 examples: - S256 dispatch_id: type: string description: The identifier of the dispatch from the front-end SDK. examples: - 123e4567-e89b-12d3-a456-426614174000 required: - code_challenge OAuthAuthorizeResponse: type: object properties: authorization_url: type: string description: The URL to redirect the user to for OAuth authorization. examples: - >- https://accounts.google.com/o/oauth2/v2/auth?client_id=...&redirect_uri=...&scope=openid+email&state=... required: - authorization_url BadRequestError: type: object properties: code: type: string enum: - bad_request type: type: string enum: - bad_request OAuthProviderNotConfiguredError: type: object properties: code: type: string enum: - oauth_provider_not_configured type: type: string enum: - bad_request OAuthProviderDisabledError: type: object properties: code: type: string enum: - oauth_provider_disabled type: type: string enum: - bad_request InvalidRedirectURIError: type: object properties: code: type: string enum: - invalid_redirect_uri type: type: string enum: - bad_request OAuthNoConnectionForEmailError: type: object description: >- The email domain is not in any enabled enterprise OAuth connection's allowlist. properties: code: type: string enum: - oauth_no_connection_for_email type: type: string enum: - not_found InternalError: type: object properties: code: type: string enum: - internal type: type: string enum: - internal ````