Add a provider account by secure sign in (the console only)

Server URLloading...

POST

/provider-accounts:sign-in

Send

Authorization

Body

The console only. Starts the secure sign in that adds a provider account with no domain: the person signs in to the provider in a temporary browser, the agent makes a lasting API key on the provider's own key page, and CustomDomain™ checks the key by listing the domains it reaches. The key then waits in memory for the keep step, which makes the account only after the person confirmed which of those domains it may use (POST /browser-sessions/{sid}:keep, within ten minutes). Nothing is kept before that: no provider_accounts row exists, and a sign in that is abandoned or left to run out names the key it made so the person can delete it at the provider (left_key).

Only the console's own call starts one: an API key that carries the console's signed visitor forward, naming the person signed in to it. The X-CustomDomain-Client header and the Origin are labels any key holder can send, so neither counts alone, and a widget token, an end user's token, a delegated agent token and the operator's key are refused with 403 browser_account_unavailable. The caller must also hold a role that operates applications (an owner, an admin or a member; a viewer is 403 forbidden), and the request must carry an Origin on the server's return origin allowlist, as browser:start requires. A workspace an operator suspended starts none, as it starts no other cloud browser (403 workspace_suspended).

Only a provider whose key can be made at sign in and whose domains can be listed qualifies (account_ways of GET /providers names secure_sign_in for it); any other is 403 browser_provider_not_allowed or 409 browser_account_unavailable. One sign in at a time runs for a member and a provider (409 browser_session_active), and three start an hour.

Returns the address of the popup page, whose fragment carries a single use bootstrap code that no server sees; the popup trades it at POST /browser-sessions:redeem. The answers of every call about the session are Cache-Control: no-store.

Response Body

curl -X POST "https://example.com/provider-accounts:sign-in" \  -H "Content-Type: application/json" \  -d '{    "provider": "string",    "return_origin": "string",    "consent_version": "cb-1"  }'

{  "session_id": "string",  "popup_url": "http://example.com"}

{  "code": "string",  "title": "string",  "details": "string"}

{  "code": "string",  "title": "string",  "details": "string"}

{  "code": "string",  "title": "string",  "details": "string"}

{  "code": "string",  "title": "string",  "details": "string"}

{  "code": "string",  "title": "string",  "details": "string"}

{  "code": "string",  "title": "string",  "details": "string"}

{  "code": "string",  "title": "string",  "details": "string"}

{  "code": "string",  "title": "string",  "details": "string"}