Authentication

OIDC callback (foundation mode — disabled by default)

⚠️ Builds a session directly from the caller-supplied claims payload — no authorization-code exchange, no ID-token signature validation. This is a full authentication bypass if reachable with a real OIDC provider configured, so it is disabled unless AUTH_FOUNDATION_MODE=true is explicitly set (local development/demos only). Returns 501 otherwise.

get/api/auth/oidc/callback

Request

  • Base URL: https://api.cernion.de
  • URL: https://api.cernion.de/api/auth/oidc/callback
  • Auth: none declared

Query parameters

codestring
Example:oidc-code-abc
statestring
Example:state-123
claimsstring

Foundation mode claim payload as JSON string.

Example:{"sub":"user-1","groups":["cernion-approver"]}
tokenstring

Optional Cernion MCP token as URL query parameter. If provided, it overrides CERNION_TOKEN for this request. Prefer Authorization Bearer header in production to reduce token exposure in URLs/logs.

Response

Successful response

object required

Changes

No recorded changes to this operation across all 2 revisions of this API.