---
title: "Finish the web's \"Continue with Google\" redirect: exchange the code (PKCE); sets the shared .ditto.audio session cookie"
method: POST
path: "/v1/auth/google/code"
tags: ["auth"]
---

# Finish the web's "Continue with Google" redirect: exchange the code (PKCE); sets the shared .ditto.audio session cookie

`POST /v1/auth/google/code`

## Request

- Base URL: `https://api.ditto.audio` (the document declares no server; this is the origin it was published from)
- URL: `https://api.ditto.audio/v1/auth/google/code`
- Auth: none declared

## Request body

- GoogleCodeAuthDto
  - `code` string, required: Authorization code from the redirect
  - `codeVerifier` string, required: PKCE code_verifier (RFC 7636: 43-128 unreserved characters)
  - `redirectUri` string, required: The redirect_uri the authorization request used
  - `nonce` string, required: The nonce the authorization request carried; must come back in the ID token

## Response `200`

JWT returned + cookie set (account created if new)

## Other responses

- `400`: Redirect URI is not one of ours
- `401`: Code refused by Google, nonce mismatch, or unverified email
- `503`: Google sign-in is not configured (no client secret)

---

[API](https://skmtc.dev/ditto/apis/ditto-audio-api.md) · [All operations](https://skmtc.dev/ditto/apis/ditto-audio-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ditto/apis/ditto-audio-api/revisions/30c8d7c218da?raw)