---
title: "GET /v1/auth/oidc/{org_slug}/callback — handle OIDC provider callback."
method: GET
path: "/v1/auth/oidc/{org_slug}/callback"
tags: ["oidc"]
---

# GET /v1/auth/oidc/{org_slug}/callback — handle OIDC provider callback.

`GET /v1/auth/oidc/{org_slug}/callback`

Verifies CSRF state, exchanges code for ID token, validates claims,
enforces allowed_domains, finds or creates the user, auto-provisions
org membership if configured, and creates a session.

## Path parameters

- `org_slug` string, required

## Query parameters

- `code` string, required
- `state` string, required

## Response `200`

Authenticated or TOTP required

- union — Successful authentication or a pending TOTP challenge.
  - object
    - `access_token` string, required
    - `expires_in` integer, required
    - `refresh_token` string, required
    - `status` 'authenticated', required
  - object
    - `challenge_token` string, required
    - `methods` MfaMethod[], required
    - `status` 'two_factor_required', required

## Other responses

- `400` — Invalid state or code
- `403` — Domain not allowed or account suspended
- `404` — Organization not found

---

[API](https://skmtc.dev/microsandbox/apis/microsandbox-api.md) · [All operations](https://skmtc.dev/microsandbox/apis/microsandbox-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/microsandbox/microsandbox-api/revisions/23f2a45cb09b/schema)