Skip to content
getgeolens.com

Oauth Callback

GET
/auth/oauth/{provider_slug}/callback
curl --request GET \
--url https://example.com/api/auth/oauth/example/callback

Handle IdP callback: exchange code, find/create user, issue JWT, redirect to frontend.

Phase 268 H-27: the frontend redirect carries access tokens in the URL fragment. Without explicit-config resolution, an attacker controlling X-Forwarded-Host could steer the post-callback redirect to attacker.com and capture the tokens. Force explicit-config resolution by passing for_external_use=True.

provider_slug
required
Provider Slug
string

Successful Response

Bad request — invalid query parameters or payload

Unauthorized — missing or invalid credentials

Forbidden — caller lacks access to this resource

Not found

Validation error

Internal server error