NHnhost
authentication
excludeme

OAuth2 provider callback endpoint (form_post)

Changed on

Handles OAuth2 provider callbacks using form_post response mode. Used by providers like Apple that send data via POST instead of query parameters. Like the GET variant, this endpoint enforces the signin-vs-signup decision carried by the signed flow state claim and the AUTH_DISABLE_AUTO_SIGNUP gate.

post/signin/provider/{provider}/callback

Request

  • Base URL
    https://{subdomain}.auth.{region}.nhost.run/v1
  • URL
    https://{subdomain}.auth.{region}.nhost.run/v1/signin/provider/{provider}/callback
  • Auth
    none declared

Path parameters

provider'apple' | 'github' | 'google' | 'linkedin' | 'discord' | 'spotify' | 'twitch' | 'gitlab' | 'bitbucket' | 'workos' | 'azuread' | 'entraid' | 'strava' | 'facebook' | 'windowslive' | 'twitter' required

The name of the social provider

Request body application/x-www-form-urlencoded

codestring nullable

Authorization code provided by the authentication provider

id_tokenstring nullable

ID token provided by the authentication provider

statestring required

State parameter to avoid CSRF attacks

userstring nullable

JSON string containing user information (only provided on first authentication with Apple)

errorstring nullable

Error message if authentication failed

error_descriptionstring nullable

Detailed error description if authentication failed

error_uristring nullable

URI with more information about the error

Response

An error occurred while processing the request

statusinteger required

HTTP status error code

messagestring required

Human-friendly error message

error'default-role-must-be-in-allowed-roles' | 'disabled-endpoint' | 'disabled-user' | 'user-already-exists' | 'email-already-verified' | 'forbidden-anonymous' | 'internal-server-error' | 'invalid-email-password' | 'invalid-request' | 'locale-not-allowed' | 'password-too-short' | 'password-in-hibp-database' | 'redirectTo-not-allowed' | 'role-not-allowed' | 'signup-disabled' | 'unverified-user' | 'user-not-anonymous' | 'invalid-pat' | 'invalid-refresh-token' | 'invalid-ticket' | 'disabled-mfa-totp' | 'no-totp-secret' | 'invalid-totp' | 'mfa-type-not-found' | 'totp-already-active' | 'invalid-state' | 'oauth-token-echange-failed' | 'oauth-profile-fetch-failed' | 'oauth-provider-error' | 'invalid-otp' | 'otp-too-many-attempts' | 'cannot-send-sms' | 'provider-account-already-linked' required

Error code identifying the specific application error

Example response

{
  "status": 400,
  "message": "Invalid email format"
}

Changes

  • 0fc5fd589dbfRevision changes
    • warning

      added the new otp-too-many-attempts enum value to the response property for the response status

  • b39086c84b43Revision changes
    • warning

      added the new user-already-exists enum value to the response property for the response status

    • info

      removed the email-already-in-use enum value from the response property for the response status