A Profile is an object that represents an authenticated user. The Profile object contains information relevant to a user in the form of normalized attributes.
After receiving the Profile for an authenticated user, use the Profile object attributes to persist relevant data to your application’s user model for the specific, authenticated user.
To surface additional attributes on the Profile, refer to the SSO custom attributes guide.
Get an access token along with the user Profile using the code passed to your Redirect URI.
curl --request POST \ --url "https://api.workos.com/sso/token" \ --header "Content-Type: application/json" \ -d @- <<'BODY' { "client_id": "client_01HZBC6N1EB1ZY7KG32X", "client_secret": "sk_example_123456789", "code": "authorization_code_value", "grant_type": "authorization_code" } BODY
{ "token_type": "Bearer", "access_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6InNzby...", "expires_in": 600, "profile": { "object": "profile", "id": "prof_01DMC79VCBZ0NY2099737PSVF1", "organization_id": "org_01EHQMYV6MBK39QC5PZXHY59C3", "connection_id": "conn_01E4ZCR3C56J083X43JQXF3JK5", "connection_type": "GoogleOAuth", "idp_id": "103456789012345678901", "email": "todd@example.com", "first_name": "Todd", "last_name": "Rundgren", "role": { "slug": "admin" }, "roles": [ { "slug": "admin" } ], "groups": [ "Engineering", "Admins" ], "custom_attributes": {}, "raw_attributes": {} }, "oauth_tokens": { "provider": "GoogleOAuth", "refresh_token": "1//04g...", "access_token": "ya29.a0ARrdaM...", "expires_at": 1735141800, "scopes": [ "profile", "email", "openid" ] } }
| curl --request POST \ | |
| --url "https://api.workos.com/sso/token" \ | |
| --header "Content-Type: application/json" \ | |
| -d @- <<'BODY' | |
| { | |
| "client_id": "client_01HZBC6N1EB1ZY7KG32X", | |
| "client_secret": "sk_example_123456789", | |
| "code": "authorization_code_value", | |
| "grant_type": "authorization_code" | |
| } | |
| BODY |
| import { WorkOS } from '@workos-inc/node'; | |
| const workos = new WorkOS('sk_example_123456789'); | |
| const { access_token, profile, oauth_tokens } = | |
| await workos.sso.getProfileAndToken({ | |
| code: '01DMEK0J53CVMC32CK5SE0KZ8Q', | |
| clientId: 'client_123456789', | |
| }); |
| require "workos" | |
| WorkOS.configure do |config| | |
| config.key = "sk_example_123456789" | |
| end | |
| profile_and_token = WorkOS::SSO.profile_and_token( | |
| client_id: "client_123456789", | |
| code: "01E2RJ4C05B52KKZ8FSRDAP23J" | |
| ) |
| from workos import WorkOSClient | |
| workos_client = WorkOSClient( | |
| api_key="sk_example_123456789", client_id="client_123456789" | |
| ) | |
| profile_and_token = workos_client.sso.get_profile_and_token( | |
| code="01DMEK0J53CVMC32CK5SE0KZ8Q" | |
| ) |
| package main | |
| import ( | |
| "context" | |
| "github.com/workos/workos-go/v3/pkg/sso" | |
| ) | |
| func main() { | |
| sso.Configure( | |
| "sk_example_123456789", | |
| "client_123456789", | |
| ) | |
| profileAndToken, err := sso.GetProfileAndToken( | |
| context.Background(), | |
| sso.GetProfileAndTokenOpts{ | |
| Code: "01DMEK0J53CVMC32CK5SE0KZ8Q", | |
| }, | |
| ) | |
| } |
| <?php | |
| WorkOS\WorkOS::setApiKey("sk_example_123456789"); | |
| WorkOS\WorkOS::setClientId("client_123456789"); | |
| $sso = new WorkOS\SSO(); | |
| $profileAndToken = $sso->getProfileAndToken("01E2RJ4C05B52KKZ8FSRDAP23J"); |
| import com.workos.WorkOS; | |
| import com.workos.sso.models.ProfileAndToken; | |
| WorkOS workos = new WorkOS("sk_example_123456789"); | |
| String code = "01E2RJ4C05B52KKZ8FSRDAP23J"; | |
| String clientId = "client_123456789"; | |
| ProfileAndToken profileAndToken = workos.sso.getProfileAndToken(code, clientId); |
| WorkOS.SetApiKey("sk_example_123456789"); | |
| var ssoService = new SSOService(); | |
| var options = new GetProfileAndTokenOptions { | |
| ClientId = "client_123456789", | |
| Code = "01E2RJ4C05B52KKZ8FSRDAP23J", | |
| }; | |
| var profileAndToken = await ssoService.GetProfileAndToken(options); |
| { | |
| "token_type": "Bearer", | |
| "access_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6InNzby...", | |
| "expires_in": 600, | |
| "profile": { | |
| "object": "profile", | |
| "id": "prof_01DMC79VCBZ0NY2099737PSVF1", | |
| "organization_id": "org_01EHQMYV6MBK39QC5PZXHY59C3", | |
| "connection_id": "conn_01E4ZCR3C56J083X43JQXF3JK5", | |
| "connection_type": "GoogleOAuth", | |
| "idp_id": "103456789012345678901", | |
| "email": "todd@example.com", | |
| "first_name": "Todd", | |
| "last_name": "Rundgren", | |
| "role": { | |
| "slug": "admin" | |
| }, | |
| "roles": [ | |
| { | |
| "slug": "admin" | |
| } | |
| ], | |
| "groups": [ | |
| "Engineering", | |
| "Admins" | |
| ], | |
| "custom_attributes": {}, | |
| "raw_attributes": {} | |
| }, | |
| "oauth_tokens": { | |
| "provider": "GoogleOAuth", | |
| "refresh_token": "1//04g...", | |
| "access_token": "ya29.a0ARrdaM...", | |
| "expires_at": 1735141800, | |
| "scopes": [ | |
| "profile", | |
| "email", | |
| "openid" | |
| ] | |
| } | |
| } |
POST/ssoParameters Returns Exchange an access token for a user’s Profile. Because this profile is returned in the Get a Profile and Token endpoint your application usually does not need to call this endpoint. It is available for any authentication flows that require an additional endpoint to retrieve a user’s profile.
curl "https://api.workos.com/sso/profile" \ --header "Authorization: Bearer 01DMEK0J53CVMC32CK5SE0KZ8Q"
{ "object": "profile", "id": "prof_01DMC79VCBZ0NY2099737PSVF1", "organization_id": "org_01EHQMYV6MBK39QC5PZXHY59C3", "connection_id": "conn_01E4ZCR3C56J083X43JQXF3JK5", "connection_type": "GoogleOAuth", "idp_id": "103456789012345678901", "email": "todd@example.com", "first_name": "Todd", "last_name": "Rundgren", "role": { "slug": "admin" }, "roles": [ { "slug": "admin" } ], "groups": [ "Engineering", "Admins" ], "custom_attributes": {}, "raw_attributes": {} }
| curl "https://api.workos.com/sso/profile" \ | |
| --header "Authorization: Bearer 01DMEK0J53CVMC32CK5SE0KZ8Q" |
| import { WorkOS } from '@workos-inc/node'; | |
| const workos = new WorkOS('sk_example_123456789'); | |
| const profile = await workos.sso.getProfile({ | |
| accessToken: '01DMEK0J53CVMC32CK5SE0KZ8Q', | |
| }); |
| require "workos" | |
| WorkOS.configure do |config| | |
| config.key = "sk_example_123456789" | |
| end | |
| WorkOS::SSO.get_profile( | |
| access_token: "01DMEK0J53CVMC32CK5SE0KZ8Q" | |
| ) |
| from workos import WorkOSClient | |
| workos_client = WorkOSClient( | |
| api_key="sk_example_123456789", client_id="client_123456789" | |
| ) | |
| profile = workos_client.sso.get_profile(access_token="01DMEK0J53CVMC32CK5SE0KZ8Q") |
| package main | |
| import ( | |
| "context" | |
| "github.com/workos/workos-go/v3/pkg/sso" | |
| ) | |
| func main() { | |
| sso.Configure( | |
| "sk_example_123456789", | |
| "client_123456789", | |
| ) | |
| profile, err := sso.GetProfile( | |
| context.Background(), | |
| sso.GetProfileOpts{ | |
| AccessToken: "01DMEK0J53CVMC32CK5SE0KZ8Q", | |
| }, | |
| ) | |
| } |
| <?php | |
| WorkOS\WorkOS::setApiKey("sk_example_123456789"); | |
| WorkOS\WorkOS::setClientId("client_123456789"); | |
| $sso = new WorkOS\SSO(); | |
| $profile = $sso->getProfile("01DMEK0J53CVMC32CK5SE0KZ8Q"); |
| import com.workos.WorkOS; | |
| import com.workos.sso.models.Profile; | |
| WorkOS workos = new WorkOS("sk_example_123456789"); | |
| String accessToken = "01DMEK0J53CVMC32CK5SE0KZ8Q"; | |
| Profile profile = workos.sso.getProfile(accessToken); |
| WorkOS.SetApiKey("sk_example_123456789"); | |
| var ssoService = new SSOService(); | |
| var options = new GetProfileOptions { AccessToken = "01DMEK0J53CVMC32CK5SE0KZ8Q" }; | |
| var profile = await ssoService.GetProfile(options); |
| { | |
| "object": "profile", | |
| "id": "prof_01DMC79VCBZ0NY2099737PSVF1", | |
| "organization_id": "org_01EHQMYV6MBK39QC5PZXHY59C3", | |
| "connection_id": "conn_01E4ZCR3C56J083X43JQXF3JK5", | |
| "connection_type": "GoogleOAuth", | |
| "idp_id": "103456789012345678901", | |
| "email": "todd@example.com", | |
| "first_name": "Todd", | |
| "last_name": "Rundgren", | |
| "role": { | |
| "slug": "admin" | |
| }, | |
| "roles": [ | |
| { | |
| "slug": "admin" | |
| } | |
| ], | |
| "groups": [ | |
| "Engineering", | |
| "Admins" | |
| ], | |
| "custom_attributes": {}, | |
| "raw_attributes": {} | |
| } |
GET/ssoReturns