Skip to main content
POST
Exchange a one-time SSO code for the identity

Body

application/json
code
string
required

One-time pid_code from the redirect URL

clientId
string

Must match the client_id the code was issued for

clientSecret
string

Required only when the bound app has a secret set (backend-only, never ship in frontend code)

Response

The PeridotID identity behind the code

pid
string
required

Permanent PID of the signed-in user (treat as opaque)

Pattern: ^[a-z0-9_]{3,20}@pid$
Example:

"ifal@pid"

identityId
string
required
deprecated

Shim — identical to pid, removed next release

Example:

"ifal@pid"

profile
object
required
credentials
object[]
required