OAuth2 Callback

GET

/v1/oauth2/callback

Send

Query

Complete the PKCE flow: exchange the authorization code for tokens.

The identity provider redirects the end user's browser here after they authorize (or deny) access. The state parameter is matched against the pending OAuthSession to prevent CSRF/session-fixation; a missing or unknown state is rejected outright. On success, the access/refresh tokens are encrypted at rest and the one-time PKCE verifier and state are cleared from the session record so they cannot be replayed.

Args: session: Database session. code: Authorization code issued by the provider. state: Opaque value echoed back from initiate_oauth, used to look up the pending session and guard against CSRF. error: Provider-reported error code, if the user denied access or the request otherwise failed upstream. error_description: Human-readable detail accompanying error.

Returns: A redirect to the frontend's stored redirect_uri, with either oauth_success=1 or oauth_error=<message> appended.

Query Parameters

Response Body

curl -X GET "https://example.com/v1/oauth2/callback?code=string&state=string"

null

{  "detail": [    {      "loc": [        "string"      ],      "msg": "string",      "type": "string"    }  ]}