---
title: "Complete the WorkOS AuthKit login flow."
method: GET
path: "/auth/callback"
tags: ["auth"]
---

# Complete the WorkOS AuthKit login flow.

`GET /auth/callback`

## Request

- Base URL: `http://localhost:8080`
- URL: `http://localhost:8080/auth/callback`
- Auth: none required

Verifies the CSRF state, exchanges the authorization code with WorkOS, JIT-provisions
the local user/org membership (first member becomes owner, later members editor), seals
the `dvt_session` cookie (AES-256-GCM, httpOnly), and redirects to the app.

## Query parameters

- `code` string, required
- `state` string, required

## Other responses

- `302`: Session established; redirect to the app.
- `400`: Missing/invalid OAuth state or authorization code.
- `429`: Per-actor API rate limit exceeded (SEC-2). All authenticated `/v1` routes apply a per-actor fixed-window default tier; selected compute-heavy routes (connection tests, column describe, data export) apply an additional tighter tier. Auth endpoints apply a per-IP tier. Problem type: `https://docs.dvt.dev/errors/rate-limited`. Wait for the `Retry-After` response header value (seconds) before retrying.
- `502`: The WorkOS code exchange failed.

---

[API](https://skmtc.dev/dvt/apis/dvt-rest-api.md) · [All operations](https://skmtc.dev/dvt/apis/dvt-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/dvt/apis/dvt-rest-api/revisions/00016f504165?raw)