> ## Documentation Index > Fetch the complete documentation index at: https://developer.demand-iq.com/llms.txt > Use this file to discover all available pages before exploring further. # Portal SSO token-bearer exchange > Token-bearer variant of the SSO flow for cross-origin clients (for example, the portal calling AI Presentations APIs from the browser). Differs from `GET /api/auth/sso` in four ways: - Accepts the SSO code in a JSON body, not a query parameter - Returns the session token in the response body instead of setting a cookie - Emits CORS headers so the portal origin can read the response - Does not set the embedded or theme cookies (those are iframe-only concerns) The returned `token` is the same opaque session ID that backs the cookie flow. Clients send it as `Authorization: Bearer ` on subsequent requests. Unlike the GET SSO flow, this endpoint does not revoke prior sessions for the user. ## OpenAPI ````yaml /openapi.json post /api/auth/sso/exchange openapi: 3.0.0 info: title: AI Presentations API version: 1.0.0 description: >- REST API for AI Presentations — an AI-powered presentation platform with narrated slides, live Q&A, and deck management. **Authentication**: Most endpoints require a session cookie obtained from `POST /api/auth/login`. Presentation playback endpoints (`/api/qa`, `/api/narration/*`) also accept a `presentationId` for unauthenticated viewer access. contact: name: Demand IQ url: https://demand-iq.com servers: - url: https://app.demand-iq.com description: Production - url: http://localhost:3000 description: Local development security: [] tags: - name: Decks description: Manage presentation decks - name: Slides description: Manage slides within a deck - name: FAQs description: Manage pre-built Q&A pairs - name: Branding description: Colors, logo, and call-to-action configuration - name: Q&A description: Live question answering and Q&A settings - name: Narration description: Text-to-speech synthesis - name: Presentations description: Create and manage personalized presentation instances - name: Generation description: AI-powered content generation from slide images - name: Images description: Image upload and management - name: Voices description: Available TTS voices - name: Utility description: Health check and diagnostics - name: Authentication description: Session-based login, logout, and identity - name: Company description: Organization contact info and knowledge base - name: Notifications description: Event subscriptions and delivery log - name: Contracts description: Contract template import and e-signature - name: Fonts description: Available Google Fonts for branding - name: Roof Measurements description: Request and track automated roof measurements - name: Actions description: Voice/text command detection for presentation control - name: Appointments description: Appointment scheduling for presentation viewers - name: Activity description: Recent presentation activity feed - name: Onboarding description: >- Per-user product onboarding milestones (ENG-641). Milestone endpoints are idempotent and are called by the app UI — they should not be treated as tenant-integration surface. paths: /api/auth/sso/exchange: post: tags: - Authentication summary: Portal SSO token-bearer exchange description: >- Token-bearer variant of the SSO flow for cross-origin clients (for example, the portal calling AI Presentations APIs from the browser). Differs from `GET /api/auth/sso` in four ways: - Accepts the SSO code in a JSON body, not a query parameter - Returns the session token in the response body instead of setting a cookie - Emits CORS headers so the portal origin can read the response - Does not set the embedded or theme cookies (those are iframe-only concerns) The returned `token` is the same opaque session ID that backs the cookie flow. Clients send it as `Authorization: Bearer ` on subsequent requests. Unlike the GET SSO flow, this endpoint does not revoke prior sessions for the user. requestBody: required: true content: application/json: schema: type: object required: - code properties: code: type: string description: Short-lived authorization code issued by the portal responses: '200': description: >- Session minted. The `token` is the bearer session ID; send it as `Authorization: Bearer ` on subsequent requests. content: application/json: schema: type: object required: - token - expiresAt - idleTimeoutSeconds - absoluteMaxAgeSeconds - user - organization properties: token: type: string description: Opaque session ID expiresAt: type: string format: date-time description: >- Session deadline at mint time. Rolling: it moves forward on every successful renewal (`POST /api/auth/session/renew`), so a live client's real expiry drifts past this value. Never a hard cap. idleTimeoutSeconds: type: integer description: >- Sliding idle window measured against the session's last activity. Default `25200` (7h). Independent of `absoluteMaxAgeSeconds` — either can force re-auth first. absoluteMaxAgeSeconds: type: integer description: >- Rolling session lifetime in seconds (`SESSION_LIFETIME`, default `86400`). Re-set at creation and on every renewal, so this is the size of the rolling window, not an absolute cap. The wire key stays `absoluteMaxAgeSeconds` for portal compatibility. user: type: object required: - id - email properties: id: type: string email: type: string name: type: string nullable: true organization: type: object description: Organization associated with the session. required: - id - name properties: id: type: string name: type: string '400': description: >- Missing or invalid `code`, or non-JSON body. Error codes: `invalid_body`, `invalid_request`. content: application/json: schema: $ref: '#/components/schemas/Error' '401': description: 'SSO code expired or invalid. Error code: `invalid_code`.' content: application/json: schema: $ref: '#/components/schemas/Error' '403': description: >- Request origin not allowed or authenticating user has no associated company (`invalid_user`). content: application/json: schema: $ref: '#/components/schemas/Error' '500': description: 'Unexpected server error. Error code: `internal_error`.' content: application/json: schema: $ref: '#/components/schemas/Error' '503': description: >- Core authentication service unavailable. Error code: `core_api_unavailable`. content: application/json: schema: $ref: '#/components/schemas/Error' components: schemas: Error: type: object properties: error: type: string required: - error ````