---
title: "Loopback authorization-code relay (RFC 8252 §7.3)"
method: GET
path: "/oauth/loopback-callback"
tags: ["OAuth", "MCP"]
---

# Loopback authorization-code relay (RFC 8252 §7.3)

`GET /oauth/loopback-callback`

## Request

- Base URL: `https://api.apphandoff.com/api`
- URL: `https://api.apphandoff.com/api/oauth/loopback-callback`
- Auth: none required

Registered redirect target for CIMD clients whose metadata documents
list loopback callbacks. GoTrue validates `redirect_uri` by exact
string match, so at authorize time the proxy forwards this FIXED URL
upstream and stashes the client's validated ephemeral-port loopback
target (single-use, 600 s TTL, keyed by `state`). GoTrue redirects the
browser here after consent; this endpoint consumes the stash exactly
once and 302s the untouched query string (`code`/`state`/`iss` or the
OAuth error triple) to the loopback target. Never redirects anywhere
except a loopback `http` URI validated against the client's metadata
document at authorize time.

## Query parameters

- `state` string, required
- `code` string
- `iss` string, uri
- `error` string
- `error_description` string

## Other responses

- `302`: Redirect to the stashed loopback callback with the query string intact.
- `400`: `invalid_request` — `state` is missing, or no stash entry exists for it (unknown, expired, or already consumed). Deliberately uniform so the endpoint is not a probe for live authorization flows.

---

[API](https://skmtc.dev/apphandoff/apis/apphandoff-api.md) · [All operations](https://skmtc.dev/apphandoff/apis/apphandoff-api/llms.txt) · [OpenAPI document](https://skmtc.dev/apphandoff/apis/apphandoff-api/revisions/9f138fe46d56?raw)