Sign in
auth

Complete an OAuth2 transaction from the IdP redirect.

Changed on

Per-provider distinct callback path (mix-up defence leg 1): the path provider must equal the transaction's provider, refused BEFORE any token is fetched (A1). The transaction is consumed single-use, the code is exchanged only at the recorded provider, the numeric GitHub identity resolved, and the purpose wall is structural. Returns the minted or rotated session.

get/api/v1/auth/oauth2/{provider}/callback

Request

  • Base URL: / (relative, and the document was published on a file host, not at the API’s origin)
  • URL: /api/v1/auth/oauth2/{provider}/callback
  • Auth: HTTP bearer

Query parameters

codestring
statestring
issstring
errorstring

Response

The minted or rotated session.

session_tokenstring

The bearer value, returned exactly once. A replayable credential: cookie attributes constrain browsers, not an attacker holding the value, which is why lifetimes are short and revocation is a delete. OMITTED for a browser-artifact session: that token is delivered ONLY on the __Host-hikyo HttpOnly cookie so injected same-origin script cannot read it. A CLI-artifact session, which has no cookie channel, still carries it here.

Changes