OAuth2 provider callback endpoint
GET /signin/provider/{provider}/callback
Handles the callback from OAuth2 providers after user authorization. Processes the authorization code and creates a user session.
This endpoint is where the signin-vs-signup decision (from the signed flow state claim) and the AUTH_DISABLE_AUTO_SIGNUP gate are actually enforced: on a flow=signin state with an unknown user and the flag enabled, the user is redirected with error=invalid-email-password; on a flow=signup state with an existing user, the user is redirected with error=user-already-exists.
Parameters
Section titled “ Parameters ”Path Parameters
Section titled “Path Parameters ”The name of the social provider
Query Parameters
Section titled “Query Parameters ”Authorization code provided by the authentication provider
ID token provided by the authentication provider
State parameter to avoid CSRF attacks
OAuth token for the provider (e.g., X)
OAuth verifier for the provider (e.g., X)
Error message if authentication failed
Detailed error description if authentication failed
URI with more information about the error
Responses
Section titled “ Responses ”Redirect to client application after successful authentication
Headers
Section titled “Headers ”URL to redirect to
default
Section titled “default ”An error occurred while processing the request
Standardized error response
object
HTTP status error code
Example
400Human-friendly error message
Example
Invalid email formatError code identifying the specific application error