> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.itential.com/adapters/authentication/patterns/different-host/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.itential.com/_mcp/server.

# Authentication to a different host

> How to configure a two-step token flow where the token request is sent to a different host than the one used for subsequent API calls.

This system uses two-step authentication, but the token request is sent to a different host than the system the adapter integrates with — for example, a standalone single sign-on (SSO) service that returns a token valid for multiple downstream systems.

## Configuration

This scenario requires only a change to `action.json` in the endpoint configuration at `/adapter-home-dir/entities/.system`.

### action.json

Add an `sso` object to the `getToken` action. The `sso` object overrides the host, protocol, and port for the token request only, replacing the values from the service instance configuration or `callProperties`. The `protocol` and `port` can be omitted if they are the same as the adapter's configured values.

```json
{
  "name": "getToken",
  "protocol": "REST",
  "method": "POST",
  "entitypath": "{base_path}/{version}/authentication/login",
  "requestSchema": "tokenReqSchema.json",
  "responseSchema": "tokenRespSchema.json",
  "timeout": 0,
  "sendEmpty": false,
  "requestDatatype": "JSON",
  "responseDatatype": "PLAIN",
  "headers": {},
  "sso": {
    "protocol": "https",
    "host": "tokenhost",
    "port": 443
  },
  "responseObjects": [
    {
      "type": "default",
      "key": "",
      "mockFile": "mockdatafiles/getToken-default.json"
    }
  ]
}
```

> How to configure a two-step token flow where the token request is sent to a different host than the one used for subsequent API calls.