---
title: "Complete the \"Sign in with Google\" flow (DVT-39)."
method: GET
path: "/auth/google/callback"
tags: ["auth"]
---

# Complete the "Sign in with Google" flow (DVT-39).

`GET /auth/google/callback`

## Request

- Base URL: `http://localhost:8080`
- URL: `http://localhost:8080/auth/google/callback`
- Auth: none required

Verifies the CSRF state, exchanges the authorization code with Google, and maps the
verified-email identity onto an **existing** invited account that already holds an org
membership — a Google sign-in never provisions a new organization (the invitation gate,
DVT-32). On success it seals the same `dvt_session` cookie as the WorkOS flow and
redirects to the app. An unmatched identity gets the styled invitation-only 403.

## Query parameters

- `code` string
- `state` string, required
- `error` string

## Other responses

- `302`: Session established; redirect to the app.
- `400`: Missing/invalid OAuth state, declined consent, or missing authorization code.
- `403`: Authenticated with Google but not an invited org member (styled HTML page).
- `429`: Per-actor API rate limit exceeded (SEC-2). All authenticated `/v1` routes apply a per-actor fixed-window default tier; selected compute-heavy routes (connection tests, column describe, data export) apply an additional tighter tier. Auth endpoints apply a per-IP tier. Problem type: `https://docs.dvt.dev/errors/rate-limited`. Wait for the `Retry-After` response header value (seconds) before retrying.
- `502`: The Google code exchange failed.

---

[API](https://skmtc.dev/dvt/apis/dvt-rest-api.md) · [All operations](https://skmtc.dev/dvt/apis/dvt-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/dvt/apis/dvt-rest-api/revisions/00016f504165?raw)