> ## Documentation Index
> Fetch the complete documentation index at: https://docs.terang.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Verify SSO JWT Token

> Server-to-server endpoint. Partner backend calls this with a signed RS256 JWT; gateway looks up the issuer (`iss` claim), verifies the request comes from a whitelisted IP, and returns a 302 with the downstream LMS verification URL in the `Location` header. The partner backend forwards that 302 to the user's browser. JWT signature verification happens on the LMS, not here.



## OpenAPI

````yaml api-reference/openapi.json GET /sso/verify
openapi: 3.1.0
info:
  description: Centralized API Gateway for Terang AI services
  title: Terang AI Core API
  version: 1.0.0
servers:
  - description: Production
    url: https://api.terang.ai
  - description: Development
    url: https://api.dev.terang.ai
security: []
paths:
  /sso/verify:
    get:
      tags:
        - SSO
      summary: Verify SSO JWT Token
      description: >-
        Server-to-server endpoint. Partner backend calls this with a signed
        RS256 JWT; gateway looks up the issuer (`iss` claim), verifies the
        request comes from a whitelisted IP, and returns a 302 with the
        downstream LMS verification URL in the `Location` header. The partner
        backend forwards that 302 to the user's browser. JWT signature
        verification happens on the LMS, not here.
      operationId: verifySSOToken
      parameters:
        - description: >-
            JWT token (RS256, signed by partner). Either this query param or the
            `Authorization: Bearer …` header must be present.
          in: query
          name: token
          required: false
          schema:
            type: string
        - description: >-
            `Bearer <jwt>` — alternative to passing the token via the query
            string.
          in: header
          name: Authorization
          required: false
          schema:
            type: string
      responses:
        '302':
          description: >-
            Token routed successfully. `Location` header points to the
            downstream LMS `/sso/verify?token=…` endpoint; forward it to the
            user's browser.
          headers:
            Location:
              description: >-
                Downstream LMS verification URL (per-partner, based on the `iss`
                claim).
              schema:
                type: string
        '400':
          description: Missing token, malformed JWT, or missing `iss` claim.
        '401':
          description: >-
            Unknown issuer — the `iss` claim does not match any registered
            partner.
        '403':
          description: >-
            Caller's IP is not in the partner's allowlist. Must call from the
            registered backend server.

````