Oauth Callback
GET
/auth/oauth/{provider_slug}/callback
const url = 'https://example.com/api/auth/oauth/example/callback';const options = {method: 'GET'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request GET \ --url https://example.com/api/auth/oauth/example/callbackHandle IdP callback: exchange code, find/create user, issue JWT, redirect to frontend.
Phase 268 H-27: the frontend redirect carries access tokens in the URL
fragment. Without explicit-config resolution, an attacker controlling
X-Forwarded-Host could steer the post-callback redirect to
attacker.com and capture the tokens. Force explicit-config resolution
by passing for_external_use=True.
Parameters
Section titled “ Parameters ”Path Parameters
Section titled “Path Parameters ” provider_slug
required
Provider Slug
string
Responses
Section titled “ Responses ”Successful Response
Bad request — invalid query parameters or payload
ProblemDetail
object
type
Type
string
title
required
Title
string
status
required
Status
integer
detail
required
Detail
string
Example
{ "type": "about:blank"}Unauthorized — missing or invalid credentials
ProblemDetail
object
type
Type
string
title
required
Title
string
status
required
Status
integer
detail
required
Detail
string
Example
{ "type": "about:blank"}Forbidden — caller lacks access to this resource
ProblemDetail
object
type
Type
string
title
required
Title
string
status
required
Status
integer
detail
required
Detail
string
Example
{ "type": "about:blank"}Not found
ProblemDetail
object
type
Type
string
title
required
Title
string
status
required
Status
integer
detail
required
Detail
string
Example
{ "type": "about:blank"}Validation error
ProblemDetail
object
type
Type
string
title
required
Title
string
status
required
Status
integer
detail
required
Detail
string
Example
{ "type": "about:blank"}Internal server error
ProblemDetail
object
type
Type
string
title
required
Title
string
status
required
Status
integer
detail
required
Detail
string
Example
{ "type": "about:blank"}