---
title: "Social Callback"
method: GET
path: "/api/auth/social/callback"
tags: ["auth"]
---

# Social Callback

`GET /api/auth/social/callback`

## Request

- Base URL: `https://app.nerdit.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://app.nerdit.ai/api/auth/social/callback`
- Auth: none declared

Redeem one social code and mint this console's own session.

``state`` is required, and GoTrue delivers it by preserving the
query on the ``redirect_to`` it was handed. If a provider release
ever dropped it instead, every social sign-in would 401 here rather
than quietly losing its CSRF check — which is the direction this
whole flow is built to fail in.

## Query parameters

- `code` string, required
- `state` string, required

## Response `200`

Successful Response

- unknown

## Other responses

- `401`: Unauthorized
- `422`: Validation Error

---

[API](https://skmtc.dev/nerdit/apis/nerdit-cloud-web.md) · [All operations](https://skmtc.dev/nerdit/apis/nerdit-cloud-web/llms.txt) · [OpenAPI document](https://skmtc.dev/nerdit/apis/nerdit-cloud-web/revisions/06e3b44b58be?raw)