---
title: "Exchange an external IdP access token for an Artalk JWT"
method: POST
path: "/sso/exchange"
tags: ["Auth"]
---

# Exchange an external IdP access token for an Artalk JWT

`POST /sso/exchange`

Validates a third-party OIDC access token by calling the issuer's /userinfo endpoint, requires a verified email claim, then mints an Artalk session JWT. Use when the surrounding application already runs OIDC and you want Artalk comments to inherit that session without showing Artalk's own login UI.

## Request body

- HandlerParamsAuthSSOExchange
  - `token` string, required — External IdP access token (e.g. an Auth0 access token)

## Response `200`

OK

- HandlerResponseUserLogin
  - `token` string, required
  - `user` EntityCookedUser, required
    - `badge_color` string, required
    - `badge_name` string, required
    - `email` string, required
    - `id` integer, required
    - `is_admin` boolean, required
    - `link` string, required
    - `name` string, required
    - `receive_email` boolean, required

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `404` — Not Found
- `500` — Internal Server Error
- `502` — Bad Gateway
- `503` — Service Unavailable

---

[API](https://skmtc.net/artalkjs/apis/artalk-api.md) · [All operations](https://skmtc.net/artalkjs/apis/artalk-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/artalkjs/artalk-api/versions/2f927b464019/schema)