---
title: "Cloudflare OAuth return URL (called by Cloudflare)"
method: GET
path: "/api/v1/cf/callback"
tags: ["One-click flows"]
---

# Cloudflare OAuth return URL (called by Cloudflare)

`GET /api/v1/cf/callback`

## Request

- Base URL: `https://app.dodomain.io`
- URL: `https://app.dodomain.io/api/v1/cf/callback`
- Auth: none required

Cloudflare redirects the end user's browser here after consent. Not called by integrators. The session is found by its single-use `state` (an unknown or replayed `state` simply redirects home); the code is exchanged, the records are written through the user's own grant, verified, and the connection finalized.

## Other responses

- `302`: Redirect back to the hosted connect page with a `cf` notice — or to the app root when the `state` is unknown or replayed.
- `500`: `500 internal` — An unhandled server-side failure. Reported to our error tracker; safe to retry.

---

[API](https://skmtc.dev/dodomain/apis/dodomain-api.md) · [All operations](https://skmtc.dev/dodomain/apis/dodomain-api/llms.txt) · [OpenAPI document](https://skmtc.dev/dodomain/apis/dodomain-api/revisions/44cfb944de58?raw)