Loopback authorization-code relay (RFC 8252 §7.3)
Registered redirect target for CIMD clients whose metadata documents list loopback callbacks. GoTrue validates redirect_uri by exact string match, so at authorize time the proxy forwards this FIXED URL upstream and stashes the client's validated ephemeral-port loopback target (single-use, 600 s TTL, keyed by state). GoTrue redirects the browser here after consent; this endpoint consumes the stash exactly once and 302s the untouched query string (code/state/iss or the OAuth error triple) to the loopback target. Never redirects anywhere except a loopback http URI validated against the client's metadata document at authorize time.
Request
- Base URL: https://api.apphandoff.com/api
- URL: https://api.apphandoff.com/api/oauth/loopback-callback
- Auth: none required
Query parameters
Opaque client state — the stash correlation key.
Authorization code issued by the authorization server.
RFC 9207 issuer identifier, forwarded verbatim.
OAuth error code, forwarded verbatim on the error path.
OAuth error description, forwarded verbatim.
Changes
No recorded changes to this operation across all 1 revision of this API.