> ## Documentation Index
> Fetch the complete documentation index at: https://developer.demand-iq.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Portal SSO via auth code exchange

> Exchanges a short-lived authorization code for an access token via the Core API, creates a new session, and redirects to the requested path. Used by the portal to embed AI Presentations in an iframe.

Flow:
1. Exchange `code` via Core API `POST /auth/code/exchange` (Basic auth with SSO client credentials)
2. Validate the returned access token via `/user/me` to get user/org info
3. Create a new session (always — never reuses an existing one)
4. Set session cookie (plus embedded cookie if `embedded=1`)
5. Revoke any prior session (best-effort)
6. Redirect to a clean URL (no `code` param in the final location)

Redirect URLs use the `APP_URL` environment variable as the canonical base origin when set. This is required for production deployments behind a load balancer where the internal hostname differs from the public URL.



## OpenAPI

````yaml /openapi.json get /api/auth/sso
openapi: 3.0.0
info:
  title: AI Presentations API
  version: 1.0.0
  description: >-
    REST API for AI Presentations — an AI-powered presentation platform with
    narrated slides, live Q&A, and deck management.


    **Authentication**: Most endpoints require a session cookie obtained from
    `POST /api/auth/login`. Presentation playback endpoints (`/api/qa`,
    `/api/narration/*`) also accept a `presentationId` for unauthenticated
    viewer access.
  contact:
    name: Demand IQ
    url: https://demand-iq.com
servers:
  - url: https://app.demand-iq.com
    description: Production
  - url: http://localhost:3000
    description: Local development
security: []
tags:
  - name: Decks
    description: Manage presentation decks
  - name: Slides
    description: Manage slides within a deck
  - name: FAQs
    description: Manage pre-built Q&A pairs
  - name: Branding
    description: Colors, logo, and call-to-action configuration
  - name: Q&A
    description: Live question answering and Q&A settings
  - name: Narration
    description: Text-to-speech synthesis
  - name: Presentations
    description: Create and manage personalized presentation instances
  - name: Generation
    description: AI-powered content generation from slide images
  - name: Images
    description: Image upload and management
  - name: Voices
    description: Available TTS voices
  - name: Utility
    description: Health check and diagnostics
  - name: Authentication
    description: Session-based login, logout, and identity
  - name: Company
    description: Organization contact info and knowledge base
  - name: Notifications
    description: Event subscriptions and delivery log
  - name: Contracts
    description: Contract template import and e-signature
  - name: Fonts
    description: Available Google Fonts for branding
  - name: Roof Measurements
    description: Request and track automated roof measurements
  - name: Actions
    description: Voice/text command detection for presentation control
  - name: Appointments
    description: Appointment scheduling for presentation viewers
  - name: Activity
    description: Recent presentation activity feed
  - name: Onboarding
    description: >-
      Per-user product onboarding milestones (ENG-641). Milestone endpoints are
      idempotent and are called by the app UI — they should not be treated as
      tenant-integration surface.
paths:
  /api/auth/sso:
    get:
      tags:
        - Authentication
      summary: Portal SSO via auth code exchange
      description: >-
        Exchanges a short-lived authorization code for an access token via the
        Core API, creates a new session, and redirects to the requested path.
        Used by the portal to embed AI Presentations in an iframe.


        Flow:

        1. Exchange `code` via Core API `POST /auth/code/exchange` (Basic auth
        with SSO client credentials)

        2. Validate the returned access token via `/user/me` to get user/org
        info

        3. Create a new session (always — never reuses an existing one)

        4. Set session cookie (plus embedded cookie if `embedded=1`)

        5. Revoke any prior session (best-effort)

        6. Redirect to a clean URL (no `code` param in the final location)


        Redirect URLs use the `APP_URL` environment variable as the canonical
        base origin when set. This is required for production deployments behind
        a load balancer where the internal hostname differs from the public URL.
      parameters:
        - in: query
          name: code
          required: true
          schema:
            type: string
          description: Short-lived authorization code issued by the portal
        - in: query
          name: redirect
          required: false
          schema:
            type: string
            default: /decks
          description: Internal path to redirect to after successful authentication
        - in: query
          name: embedded
          required: false
          schema:
            type: string
            enum:
              - '0'
              - '1'
            default: '0'
          description: >-
            Set to `1` when running inside a portal iframe. Enables embedded
            mode cookies and error handling.
        - in: query
          name: theme
          required: false
          schema:
            type: string
            enum:
              - light
              - dark
          description: >-
            Portal theme preference. When set, a theme cookie is stored so the
            initial render matches the portal appearance without a flash.
      responses:
        '302':
          description: >-
            Redirects to the `redirect` path on success, or to
            `/login?error=sso_failed` (standalone) / `/embedded-auth-error`
            (embedded) on failure. Returns a redirect on missing or invalid
            code, or Core API rejection.

````