---
title: "One-click sync return (public; authenticated by the signed state)"
method: GET
path: "/connect/dc/return/{state}"
tags: ["Connections"]
---

# One-click sync return (public; authenticated by the signed state)

`GET /connect/dc/return/{state}`

## Request

- Base URL: `https://api.customdomain.ai/v1`
- URL: `https://api.customdomain.ai/v1/connect/dc/return/{state}`
- Auth: none required

Where the DNS provider sends the browser after the user approves or cancels a one-click sync apply. It is the `redirect_uri` the signed `apply_url` carries, **not** a bearer-authenticated endpoint. The signed single-use `state` rides in the path because some providers (Cloudflare) drop the separate `state` parameter. It records a provider-reported `error` on the connection, runs the propagation check at once, and returns the same HTML finish page as the OAuth callback, which postMessages `{ type: "customdomain:oauth", payload }` to the origin vetted at start. A clean return never marks the connection live by itself: only the records appearing in public DNS do.

## Path parameters

- `state` string, required

## Query parameters

- `error` string
- `error_description` string

## Response `200`

HTML finish page (postMessages the outcome to the vetted return origin)

## Other responses

- `400`: Invalid, expired, replayed, or wrong-rail state
- `503`: The return is not configured on this server

---

[API](https://skmtc.dev/customdomain/apis/customdomain-control-plane-api.md) · [All operations](https://skmtc.dev/customdomain/apis/customdomain-control-plane-api/llms.txt) · [OpenAPI document](https://skmtc.dev/customdomain/apis/customdomain-control-plane-api/revisions/34d89cb7a7cd?raw)