Verify SSO JWT Token
Server-to-server endpoint. Partner backend calls this with a signed RS256 JWT; gateway looks up the issuer (iss claim), verifies the request comes from a whitelisted IP, and returns a 302 with the downstream LMS verification URL in the Location header. The partner backend forwards that 302 to the user’s browser. JWT signature verification happens on the LMS, not here.
Headers
Bearer <jwt> — alternative to passing the token via the query string.
Query Parameters
JWT token (RS256, signed by partner). Either this query param or the Authorization: Bearer … header must be present.
Response
Token routed successfully. Location header points to the downstream LMS /sso/verify?token=… endpoint; forward it to the user's browser.