Generates a short-lived single-use SSO token for the authenticated user, protected by PKCE (RFC 7636).

How it works

1. Your client generates a high-entropy random code verifier (43-128 characters, base64url-encoded).
2. Derives a code challenge from the verifier:
   • S256 (recommended): base64url(SHA-256(verifier))
   • plain: the verifier itself, unchanged (not recommended except for legacy clients).
3. Calls this endpoint with codeChallenge and codeChallengeMethod as query parameters.
4. Receives back a short-lived token and its expiry (Unix epoch seconds).
5. Redeems the token together with the original code verifier at the SSO login endpoint — this proves your client originated the request and the token hasn't been intercepted.

Generating a code verifier + challenge (JS)

// 1. Generate a cryptographically random verifier
const verifier = btoa(String.fromCharCode(...crypto.getRandomValues(new Uint8Array(32))))
  .replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');

// 2. Derive the S256 challenge
const bytes = new TextEncoder().encode(verifier);
const digest = await crypto.subtle.digest('SHA-256', bytes);
const challenge = btoa(String.fromCharCode(...new Uint8Array(digest)))
  .replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');

// 3. Call this endpoint
const res = await fetch(
  `/api/v2/user/generate-pkce-sso-token?codeChallenge=${challenge}&codeChallengeMethod=S256`,
  { headers: { Authorization: `Bearer ${accessToken}` } }
);
const { token, expiry } = (await res.json()).data;

// 4. Store `verifier` in your client; you'll need it to redeem `token`.

Security notes

• Never log or transmit the code verifier — it is the secret half of the pair.
• Tokens are single-use and expire quickly; check expiry and regenerate as needed.
• Prefer S256 over plain. plain is only retained for clients on platforms without SHA-256.