> ## Documentation Index
> Fetch the complete documentation index at: https://docs.digitalseaservice.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Open DSS (YWC SSO)

> POST /v1/partners/sso/tickets — mint a one-time login URL so an already-Connected member opens the DSS app signed in.

<Note>
  **Yacht Workers Council only.** Other partners receive
  [`insufficient_scope` (403)](/errors/insufficient_scope). Auth is HTTP Basic,
  same as the rest of `/v1/partners/*`.
</Note>

```http theme={null}
POST /v1/partners/sso/tickets
Authorization: Basic <base64(client_id:client_secret)>
Content-Type: application/json
```

Use this when a member is **already Connected** and taps DSS in your app. Do
**not** put `user_id` on the public website URL. Your **server** mints a ticket,
then you 302 the browser to `login_url`.

The ticket is opaque, hashed at rest, **single use**, and valid for **60
seconds**. A new mint for the same member invalidates any unused previous
ticket. We only issue a ticket when that member has a **live YWC Connect
consent**.

## Request

| Field     | Type   | Required | Notes                                    |
| --------- | ------ | -------- | ---------------------------------------- |
| `user_id` | string | Yes      | DSS user id from Connect (Firebase uid). |

```json theme={null}
{ "user_id": "aQ0mtT8kRgVv7C3o1p2q3r4s5t6u" }
```

```bash theme={null}
curl -u "$DSS_CLIENT_ID:$DSS_CLIENT_SECRET" \
  -H "Content-Type: application/json" \
  -d '{"user_id":"<dss-uid>"}' \
  https://api.digitalseaservice.com/v1/partners/sso/tickets
```

## Response

`200 OK`

| Field        | Type    | Notes                                                                            |
| ------------ | ------- | -------------------------------------------------------------------------------- |
| `login_url`  | string  | Send the member's browser here immediately. Host is `app.digitalseaservice.com`. |
| `expires_in` | integer | Always `60`.                                                                     |

```json theme={null}
{
  "login_url": "https://app.digitalseaservice.com/auth/partner?ticket=…",
  "expires_in": 60
}
```

Sandbox login URLs use the sandbox app host from that environment's sign-in URL.

## Errors

| Status | `type`                                               | When                                                                   |
| ------ | ---------------------------------------------------- | ---------------------------------------------------------------------- |
| 400    | [`invalid_request`](/errors/invalid_request)         | Missing `user_id`.                                                     |
| 401    | [`invalid_token`](/errors/invalid_token)             | Missing or bad Basic credentials.                                      |
| 403    | [`insufficient_scope`](/errors/insufficient_scope)   | Not YWC, partner suspended, or the member has no live Connect consent. |
| 429    | [`rate_limit_exceeded`](/errors/rate_limit_exceeded) | Per-client budget exhausted.                                           |

## Related

* [Member left (YWC)](/sponsorships/member-left)
* [Authentication](/authentication)