Mint a pid_code for the current session
Issues a one-time pid_code for the caller's existing session — no re-authentication. Powers consent screens on PeridotID-hosted pages: the user approves, the page redirects itself to returnTo with the code. Cookie-authenticated (same-site pages only). returnTo follows the same rules as login (loopback, registered app origins, global allowlist).
Issues a one-time pid_code for the caller's existing session — no re-authentication. Powers consent screens on PeridotID-hosted pages: the user approves, the page redirects itself to returnTo with the code. Cookie-authenticated (same-site pages only). returnTo follows the same rules as login (loopback, registered app origins, global allowlist).
Authorization
cookieAuth JWT access token set by /auth/google/callback or /auth/refresh
In: cookie
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
curl -X POST "https://example.com/auth/authorize" \ -H "Content-Type: application/json" \ -d '{ "returnTo": "http://example.com" }'{ "pidCode": "string"}Check PID handle availability GET
Returns whether `handle` is free (`<handle>@pid`). Used by the onboarding handle picker before starting Google sign-up. Handles are lowercase `^[a-z0-9_]{3,20}$`; the full PID is `<handle>@pid` — permanent, never changeable, reused, or reassigned.
Claim a pending credential under a fresh PID handle POST
One transaction creates the identity (`<handle>@pid`, permanent) + profile + credential and consumes the single-use claim ticket. Issues the session cookies. When the claim came from a relying-party login, the response also carries the SSO `pidCode` plus the validated `redirectTo` — the hosted page navigates there itself. Expired tickets answer `410` — sign in again.