Provider-specific OAuth callback (GET)

OAuth callback endpoint for provider-specific flows (most providers use GET).

Response varies based on the original OAuth initiation:

• With code_challenge (PKCE): Redirects with insforge_code for exchange endpoint
• Without code_challenge (web): Redirects with access_token and sets httpOnly cookie

GET /api/auth/oauth/{provider}/callback

Provider-specific OAuth callback (GET)

cURL

curl --request GET \
  --url https://api.example.com/api/auth/oauth/{provider}/callback

Path Parameters

provider · enum<string> · required

Available options: google, github, discord, linkedin, facebook, instagram, tiktok, apple, x, spotify, microsoft

Query Parameters

code · string

Authorization code from OAuth provider

state · string · required

JWT state with redirect URI and optional code_challenge

token · string

Direct ID token (for some providers)

Response

302

Redirect to application.

• PKCE flow: redirect_uri?insforge_code={code}&user_id={id}&email={email}&name={name}
• Web flow: redirect_uri?access_token={token}&user_id={id}&email={email}&name={name}&csrf_token={csrf}