Start Google login
Returns the URL a client should navigate to in order to begin Google OAuth. The URL points to `GET /auth/google`, which redirects the browser to Google's consent screen. After the user consents, the browser is redirected back through `/auth/google/callback` and session cookies are set. For cross-origin SSO, pass `returnTo` (must be allowlisted, or registered to your app via `clientId`) — the callback then redirects to `returnTo?pid_code=...` with a one-time exchange code instead of the wallet. First-time users always land on the PID picker after authenticating (`POST /v1/auth/claim` creates the permanent `<handle>@pid` identity) — handles are only ever chosen there, never up front. Returning logins continue straight to a session.
Returns the URL a client should navigate to in order to begin Google OAuth.
The URL points to GET /auth/google, which redirects the browser to Google's
consent screen. After the user consents, the browser is redirected back through
/auth/google/callback and session cookies are set.
For cross-origin SSO, pass returnTo (must be allowlisted, or registered to
your app via clientId) — the callback then redirects to
returnTo?pid_code=... with a one-time exchange code instead of the wallet.
First-time users always land on the PID picker after authenticating
(POST /v1/auth/claim creates the permanent <handle>@pid identity) —
handles are only ever chosen there, never up front. Returning logins
continue straight to a session.
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
curl -X POST "https://example.com/auth/login" \ -H "Content-Type: application/json" \ -d '{ "returnTo": "https://mygame.dev/callback", "clientId": "pidapp_0123456789abcdef0123456789abcdef" }'{ "url": "http://localhost:3301/v1/auth/google"}Exchange a one-time SSO code for the identity POST
Consumes a `pid_code` issued by a Google or passkey login with `returnTo` (optionally bound to a `clientId`) and returns the PeridotID identity. Codes are single-use and expire after ~5 minutes. Call server-to-server; when the code is bound to an app, the same `clientId` must be presented.
Log out POST
Revokes the current refresh token and clears both session cookies. Idempotent — safe to call when already logged out.