---
title: "GET /v1/auth/oauth/{provider}/callback — handle OAuth provider callback."
method: GET
path: "/v1/auth/oauth/{provider}/callback"
tags: ["oauth"]
---

# GET /v1/auth/oauth/{provider}/callback — handle OAuth provider callback.

`GET /v1/auth/oauth/{provider}/callback`

Verifies CSRF state, exchanges code for access token, fetches user info,
finds or creates the user, links the OAuth provider, and creates a session.

## Path parameters

- `provider` string, required

## Query parameters

- `code` string, required
- `state` string, required

## Response `200`

Authenticated or TOTP required

- union — Successful authentication or a pending TOTP challenge.
  - object
    - `access_token` string, required
    - `expires_in` integer, required
    - `refresh_token` string, required
    - `status` 'authenticated', required
  - object
    - `challenge_token` string, required
    - `methods` MfaMethod[], required
    - `status` 'two_factor_required', required

## Other responses

- `400` — Invalid state or code
- `403` — Account suspended

---

[API](https://skmtc.dev/microsandbox/apis/microsandbox-api.md) · [All operations](https://skmtc.dev/microsandbox/apis/microsandbox-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/microsandbox/microsandbox-api/revisions/23f2a45cb09b/schema)