Verify SSO Domain Ownership

POST /v1/sso/config/{id}/verify-domain

Proves that your account controls the email_domain of a custom oidc or saml SSO configuration by checking a DNS TXT record. Until a config's domain is verified it will not apply at login, so a config cannot silently take over sign-in for a domain you don't own.

When you create an oidc/saml config (or later change its email_domain), the response returns domain_verify_record_name and domain_verify_record_value. Publish that TXT record, then call this endpoint to complete verification. The lookup host is _ngris-sso-verify.<email_domain> and the expected value is ngris-sso-verify=<token>; verification succeeds only on an exact match.

google and github configs are auto-verified — the provider asserts identity and their endpoints are locked, so they carry no verification token and do not need this call.

Authorization

Account-scoped. Requires the settings:update permission on the active account and the sso plan entitlement.

Path parameters

id int64 Req
SSO config ID. Must belong to your active account.

Request body

None — empty body or {}. The DNS TXT record is looked up from the config's stored token.

Response (200 OK)

verified boolean
true once the TXT record matches (and domain_verified is persisted on the config). true is also returned immediately if the config was already verified.
error string
Present only when verified: false — explains that the TXT record was not found or did not match yet, including the exact host and value to publish. DNS changes can take a few minutes to propagate; retry after publishing.

Errors

400 Bad Request
Invalid config ID, or the provider type does not require domain verification (e.g. google/github).
401 Unauthorized
Missing auth.
403 Forbidden
No active account, missing settings:update permission, or the account plan lacks the sso entitlement.
404 Not Found
Config doesn't exist or doesn't belong to your active account.
1. Publish the TXT record
; from the create/update response fields ; domain_verify_record_name -> _ngris-sso-verify.example.com ; domain_verify_record_value -> ngris-sso-verify=<token> _ngris-sso-verify.example.com. IN TXT "ngris-sso-verify=<token>"
Request
curl -X POST "https://api.ngris.com/v1/sso/config/1/verify-domain" \ -H "X-API-KEY: <your_api_key>"
Python
from ngris import Ngris client = Ngris(api_key="<your_api_key>") result = client.sso.verify_domain("1") if result["verified"]: print("Domain ownership verified") else: print("Not verified yet:", result.get("error"))
Response — 200 OK (verified)
{ "verified": true }
Response — 200 OK (not yet)
{ "verified": false, "error": "TXT record not found or does not match yet. Add a TXT record at _ngris-sso-verify.example.com with value ngris-sso-verify=<token>, then retry (DNS changes can take a few minutes to propagate)." }
Homepage Docs Dashboard Docs API Docs nvelox Dashboard
Iris