Callback

Exchange an authorization code and set the HttpOnly session cookie.

The session is bound to the identity the provider's account resolves to, exactly as a password sign-in binds one to the identity that authenticated, so every request it later authenticates resolves the same caller.

A refusal is counted like the other sign-in failures (record_auth_failure) and rendered by the tenancy error handler. Like the passkey route there is no separate post-failure throttle: this route is throttled unconditionally on the way in, because there is no legitimate caller here whose correct credential must never be blocked. An authorization code is single-use and minted by a redirect, not something a person retries by hand.

Maintenance mode freezes this the way it freezes the other two sign-ins. The freeze is on starting a session, not on a credential, so an OAuth sign-in has to answer to it or the switch is bypassable by anybody holding a Google account. Refused before the exchange, so a frozen deployment makes no outbound call, spends nobody's authorization code, and counts no auth failure: nobody failed to authenticate, the gateway declined to try.