Skip to main content
// Client-side in the user's browser
const response = await fetch('https://test.stytch.com/v1/b2b/public/oauth/microsoft/start?public_token=public-token-test-be835f9a-ac37-44cf-817d-f58ac2b3ae3d&organization_id=organization-test-07971b06-ac8b-4cdb-9c15-63b17e653931', {
  method: 'GET',
});

{
  "status_code": 302,
  "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
  "redirect_url": "https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?access_type=offline&client_id=example-client-id&redirect_uri=https%3A%2F%2Fstytch.com%2Fv1%2Foauth%2Foauth-callback-test-d868b16b-3ecd-49ac-7fc6-e3d1051c5d65&response_type=code&scope=openid+email+profile+User.Read&state=example-state",
}
GET
/
v1
/
b2b
/
public
/
oauth
/
microsoft
/
start
// Client-side in the user's browser
const response = await fetch('https://test.stytch.com/v1/b2b/public/oauth/microsoft/start?public_token=public-token-test-be835f9a-ac37-44cf-817d-f58ac2b3ae3d&organization_id=organization-test-07971b06-ac8b-4cdb-9c15-63b17e653931', {
  method: 'GET',
});

{
  "status_code": 302,
  "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
  "redirect_url": "https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?access_type=offline&client_id=example-client-id&redirect_uri=https%3A%2F%2Fstytch.com%2Fv1%2Foauth%2Foauth-callback-test-d868b16b-3ecd-49ac-7fc6-e3d1051c5d65&response_type=code&scope=openid+email+profile+User.Read&state=example-state",
}
A client-side endpoint (can only be queried from the browser) that starts the Microsoft flow. This endpoint generates a Microsoft OAuth URL with all required fields and redirects the user to that URL. The user authenticates with Microsoft before getting redirected back to Stytch. After verifying the request, Stytch redirects the user back to the login_redirect_url or signup_redirect_url provided. One of organization_id or slug is required to specify which organization the user is trying to access. If the organization that the user is trying to access is not yet known, use the Microsoft OAuth Discovery endpoint instead.

​
Scopes

By default our Microsoft OAuth integration requests the open_id, email, User.Read and profile scopes. You may add any additional Microsoft API scopes (see here for a complete list) as a space separated list in the custom_scopes query parameter.

​
Authenticating the OAuth Token

Once the user successfully authenticates with Microsoft, they’ll be redirected to the redirect URL that you provided at the start of the OAuth flow with a Stytch OAuth token. Collect the token from the URL query parameters, then call Authenticate OAuth Token to complete authentication. The OAuth 2.0 Access Token and ID token will also be made available via the Get Microsoft Access Token endpoint.

​
Path Parameters

​
public_token
string
required
The public token found in your Stytch Dashboard. Since this endpoint must be called client-side, the public token authenticates the request instead of the project ID and secret.
​
organization_id
string
The unique ID of the to authenticate the into.
​
slug
string
The unique URL slug of the to authenticate the into. The slug only accepts alphanumeric characters and the following reserved characters: - . _ ~. Must be between 2 and 128 characters in length. Wherever an organization_id is expected in a path or request parameter, you may instead use the organization_slug as a convenience.
​
login_redirect_url
string
The URL Stytch redirects to after the OAuth flow is completed for a Member that already exists. This URL should be a route in your application which will call OAuth Authenticate and finish the login.The URL must be configured as a Login URL in the Stytch Dashboard. If the field is not specified, the default Login URL will be used.
​
signup_redirect_url
string
The URL Stytch redirects to after the OAuth flow is completed for a Member that does not yet exist. This URL should be a route in your application which will call OAuth Authenticate and finish the login.The URL must be configured as a Login URL in the Stytch Dashboard. If the field is not specified, the default Login URL will be used.
​
custom_scopes
string
A space-separated list of custom scopes that you’d like to include. Note that this list must be URL encoded (e.g. the spaces must be expressed as %20).
​
provider_[parameter_name]
string
Any parameters that should be forwarded to the OAuth provider can be passed as query parameters with the provider_ prefix. For example, some OAuth providers support a login_hint parameter that allows you to pre-populate the OAuth login flow with a suggested email address. To specify the login_hint parameter in your OAuth request, include provider_login_hint=exampleHint as a query parameter.We recommend consulting each OAuth provider’s documentation for a list of supported parameters.
​
pkce_code_challenge
string
A base64url encoded SHA256 hash of a one time secret used to validate that the request starts and ends on the same device.

​
Response

​
redirect_url
string
The url to redirect to. This should be done automatically by the browser.
​
status_code
number
The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors.
​
request_id
string
Globally unique UUID that is returned with every API call. This value is important to log for debugging purposes; we may ask for this value to help identify a specific API call when helping you debug an issue.