---
title: "Authenticate a user with OpenID Connect"
method: POST
path: "/auth/openid/{provider}/callback"
tags: ["auth"]
---

# Authenticate a user with OpenID Connect

`POST /auth/openid/{provider}/callback`

After a redirect from the OpenID Connect provider to the frontend has been made with the authentication `code`, this endpoint can be used to obtain a jwt token for that user and thus log them in.

## Path parameters

- `provider` integer, required

## Request body

- OpenidCallback
  - `code` string
  - `redirect_url` string
  - `scope` string
  - `totp_passcode` string — TOTPPasscode is required when the resolved user has TOTP enabled. Clients must restart the OIDC flow and populate this field after receiving a 412 with error code 1017. See GHSA-8jvc-mcx6-r4cg.

## Response `200`

OK

- AuthToken
  - `token` string

## Other responses

- `412` — Invalid totp passcode.
- `500` — Internal error

## Changes

- **2026-04-09** `d3f800741adf` — 1 info
  - added the non-success response with the status `412`
- **2025-07-28** `d7c1f946dc48` — 1 info
  - removed the non-success response with the status `412`

[Change history](https://skmtc.dev/go-vikunja/apis/vikunja-api/changes/auth/openid/:provider/callback/post.md)

---

[API](https://skmtc.dev/go-vikunja/apis/vikunja-api.md) · [All operations](https://skmtc.dev/go-vikunja/apis/vikunja-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/go-vikunja/vikunja-api/revisions/120501835be2/schema)