---
title: "Handle social login callback"
method: POST
path: "/api/auth/callback/{provider}"
tags: ["auth"]
---

# Handle social login callback

`POST /api/auth/callback/{provider}`

Handle callback from social provider after authentication

## Path parameters

- `provider` string, required

## Request body

- SocialCallbackRequest — Social login callback request model.
  - `code` string, nullable — Authorization code from OAuth provider
  - `state` string, nullable — State parameter for CSRF protection
  - `redirect_uri` string, nullable — Redirect URI used in the authorization request (must match)
  - `access_token` string, nullable — Access token (if provided directly in fragment)
  - `refresh_token` string, nullable — Refresh token (if provided directly in fragment)
  - `expires_in` integer, nullable — Token expiration time in seconds
  - `refresh_expires_in` integer, nullable — Refresh token expiration time in seconds

## Response `200`

Successful Response

- SocialCallbackResponse — Social login callback response model.
  - `access_token` string, required — JWT access token
  - `refresh_token` string, required — Refresh token
  - `expires_in` integer, required — Access token expiration time in seconds
  - `refresh_expires_in` integer, required — Refresh token expiration time in seconds
  - `token_type` string — Token type
  - `user_id` string, required — User ID from Keycloak
  - `is_new_user` boolean, required — Whether this is a newly registered user
  - `requires_profile_completion` boolean — True if the authenticated user still has to complete mandatory profile fields before using the app

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.dev/corabea/apis/corabea-api.md) · [All operations](https://skmtc.dev/corabea/apis/corabea-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/corabea/corabea-api/revisions/13c1bce1bdc4/schema)