Discover

Email-domain SSO routing.

Looks up whether the email's domain belongs to a WorkOS Organization that's wired to one of our Organization rows. Returns the org slug + the /start URL the caller should redirect to. Returns {org_slug: null, login_url: null} when no SSO is configured for the domain — the caller falls back to global Google login.

When the caller supplies frontend_origin, it must match ALLOWED_FRONTEND_ORIGINS and is round-tripped into login_url so hosted browser callers can redirect to /start without rebuilding the query string themselves.

WorkOS is the source of truth for OrganizationDomain; we keep no local copy. One WorkOS API call per discover, which is acceptable since users only click "Continue with SSO" at most once per login.