---
title: "OAuth2 provider redirect callback"
method: GET
path: "/integrations/oauth/callback"
tags: ["Integrations"]
---

# OAuth2 provider redirect callback

`GET /integrations/oauth/callback`

## Request

- Base URL: `https://api.atako.ai`
- URL: `https://api.atako.ai/integrations/oauth/callback`
- Auth: none required

Public / session-less — called by the OAuth provider's browser redirect. Authenticity comes from the signed `state` param (10-minute TTL), never from a bearer token. Always responds with an HTTP redirect to the web app's Settings > Integrations page (`?connected=<providerKey>` on success, `?error=oauth_denied|oauth_invalid_state|oauth_token_server_rejected|oauth_callback_param_missing|oauth_callback_param_invalid|oauth_exchange_failed` on failure) — never a JSON body. Multi-data-center providers (Zoho) also send the account's token server (`accounts-server`): it must be one of the connector's allow-listed origins, otherwise the connect is refused with `oauth_token_server_rejected` before any token call. Providers that name the connected tenant in the redirect (QuickBooks Online: `realmId`) must send it and it must match the connector's pattern, otherwise the connect is refused with `oauth_callback_param_missing` / `oauth_callback_param_invalid`, also before any token call.

## Query parameters

- `code` string
- `state` string
- `error` string
- `accounts-server` string

## Other responses

- `302`: Redirect to the web app; see description for the query params it carries.

---

[API](https://skmtc.dev/atako/apis/atako-api.md) · [All operations](https://skmtc.dev/atako/apis/atako-api/llms.txt) · [OpenAPI document](https://skmtc.dev/atako/apis/atako-api/revisions/aa555c56fbd7?raw)