---
title: "Sign-in and session"
description: "The sign-in and session endpoints of the HTTP API."
---

> Documentation Index
> Fetch the complete documentation index at: https://slashobserve.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Sign-in and session

## GET /auth/login

Start the OIDC sign-in and redirect to the identity provider.

No authentication.

### Parameters

| Name | In | Type | Description |
| --- | --- | --- | --- |
| `return_to` | query | `string` | Local path to return to after sign-in; anything else is replaced by `/`. |

### Responses

| Status | Description | Body |
| --- | --- | --- |
| `302` | Redirect to the identity provider, or to `/login?error=<code>` when sign-in cannot start. |   |

## GET /auth/callback

Complete the OIDC sign-in and redirect to the local return path.

No authentication.

### Parameters

| Name | In | Type | Description |
| --- | --- | --- | --- |
| `code` | query | `string` |   |
| `state` | query | `string` |   |
| `error` | query | `string` |   |
| `error_description` | query | `string` |   |

### Responses

| Status | Description | Body |
| --- | --- | --- |
| `302` | Redirect to the return path with a session cookie, or to `/login?error=<code>` on refusal. |   |

## POST /auth/logout

End the current session and clear its cookie.

No authentication.

### Responses

| Status | Description | Body |
| --- | --- | --- |
| `204` | The session cookie is cleared; nothing is returned. |   |
| `403` | The caller is not allowed to perform the request; a role that is too low is code `forbidden_role`. | [`Error`](/docs/reference/api/schemas/#error) |
| `500` | The server failed to handle the request. | [`Error`](/docs/reference/api/schemas/#error) |

## GET /auth/session

Report whether the request carries a valid session.

No authentication.

### Responses

| Status | Description | Body |
| --- | --- | --- |
| `200` | The session state. | [`SessionState`](/docs/reference/api/schemas/#sessionstate) |
| `500` | The server failed to handle the request. | [`Error`](/docs/reference/api/schemas/#error) |

## GET /me

Return the authenticated caller.

### Responses

| Status | Description | Body |
| --- | --- | --- |
| `200` | The caller. | [`Principal`](/docs/reference/api/schemas/#principal) |
| `401` | Authentication is missing or invalid. | [`Error`](/docs/reference/api/schemas/#error) |
| `500` | The server failed to handle the request. | [`Error`](/docs/reference/api/schemas/#error) |

## GET /instance

Return the server's public and MCP URLs and its sign-in settings; never a secret.

### Responses

| Status | Description | Body |
| --- | --- | --- |
| `200` | The URLs clients use to reach this server and who may sign in. | [`Instance`](/docs/reference/api/schemas/#instance) |
| `401` | Authentication is missing or invalid. | [`Error`](/docs/reference/api/schemas/#error) |
| `500` | The server failed to handle the request. | [`Error`](/docs/reference/api/schemas/#error) |

Generated from [`api/openapi.yaml`](https://github.com/slashobserve/slashobserve/blob/bac0fe39/api/openapi.yaml) at `bac0fe39`. [Report a problem](https://github.com/slashobserve/slashobserve/issues/new).