---
title: "Cli Callback"
method: GET
path: "/auth/cli/callback"
tags: ["auth"]
---

# Cli Callback

`GET /auth/cli/callback`

WorkOS redirect target for the loopback flow.

Verifies the signed ``state`` (the loopback port is trusted only because it is
signed — never an attacker-chosen port). On success, mints a single-use
one-time code bound to the PKCE challenge and 302s it to the loopback. ANY
failure — a WorkOS error redirect (``?error=`` with no ``code``), the code
exchange, or minting — instead 302s an ``?error=`` to the loopback so the CLI
fails fast rather than hanging until its timeout.

## Query parameters

- `state` string, required
- `code` string, nullable
- `error` string, nullable

## Response `200`

Successful Response

- unknown

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.dev/nanocorp/apis/nanocorp-api.md) · [All operations](https://skmtc.dev/nanocorp/apis/nanocorp-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/nanocorp/nanocorp-api/revisions/04b208d3215b/schema)