This is correct. You do not need the nonce in the payload for the sync_sso route. The body of the POST request needs the following parameters: sso, sig, api_key, api_username.
To see how to create the sso and sig parameters, read the ‘Setup the SSO parameters’ section of this topic: Sync DiscourseConnect user data with the sync_sso route.
The return value of a successful call to /admin/users/sync_sso is a Discourse User object.