---
title: "Verify Google identity and create a one-time auth handoff"
method: POST
path: "/auth/google/verify"
---

# Verify Google identity and create a one-time auth handoff

`POST /auth/google/verify`

## Request

- Base URL: `https://api.eurobase.dev`
- URL: `https://api.eurobase.dev/auth/google/verify`
- Auth: none declared

Provider-verified emails on new identities must be syntactically valid and permanent; no DNS check. Existing linked identities keep working. New accounts count toward the shared per-client UTC signup ceiling; provider flows are never challenged. Requires the server-issued nonce from /auth/google/start and its browser binding cookie; always verifies the signed token nonce and consumes the issued nonce once. Only that browser can exchange the handoff; verify never issues a binding cookie.

## Request body

- GoogleVerifyRequest
  - `credential` string, required
  - `nonce` string, required
  - `returnTo` string

## Response `200`

Provider handoff created

- AuthProviderHandoffResponse
  - `ok` boolean, required
  - `provider` 'google' | 'github', required
  - `handoffToken` string, required
  - `returnTo` string, required
  - `identity` AuthIdentitySummary, required
    - `provider` 'google' | 'github', required
    - `providerEmail` string, nullable, required
    - `providerEmailVerifiedAt` string, date-time, nullable, required
    - `providerLogin` string, nullable, required
    - `providerAvatarUrl` string, nullable, required
    - `linkedAt` string, date-time, nullable, required
    - `lastLoginAt` string, date-time, nullable, required

## Other responses

- `400`: New identity email is malformed or disposable
- `401`: Nonce missing, expired, replayed or mismatched, or browser binding mismatch
- `429`: Per-client UTC signup ceiling reached; existing provider accounts still sign in
- `503`: The client address could not be proven (ADR 0086); a counted auth request is never admitted uncounted

---

[API](https://skmtc.dev/eurobase/apis/eurobase-api.md) · [All operations](https://skmtc.dev/eurobase/apis/eurobase-api/llms.txt) · [OpenAPI document](https://skmtc.dev/eurobase/apis/eurobase-api/revisions/5266a299d18a?raw)