---
title: "Validate social provider callback"
method: GET
path: "/api/auth/social/{provider}/callback"
tags: ["Auth"]
---

# Validate social provider callback

`GET /api/auth/social/{provider}/callback`

## Request

- Base URL: `https://demo.hitkeep.com`
- URL: `https://demo.hitkeep.com/api/auth/social/{provider}/callback`
- Auth: none declared

Consumes the state once, exchanges the code, validates the immutable provider identity and required claims, discards provider tokens, and redirects with a short-lived completion token in the URL fragment. Upstream responses are never exposed.

## Path parameters

- `provider` 'google' | 'github' | 'microsoft', required

## Query parameters

- `state` string, required
- `code` string
- `error` string

## Other responses

- `303`: Redirects to the bound local flow with a fragment completion token or stable error code

---

[API](https://skmtc.dev/hitkeep/apis/hitkeep-rest-api.md) · [All operations](https://skmtc.dev/hitkeep/apis/hitkeep-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hitkeep/apis/hitkeep-rest-api/revisions/bb2df36ab2a4?raw)