NHnhost
authentication

Sign up with OAuth provider

Changed on

Initiate OAuth signup flow with the specified provider. Redirects to the provider's authorization page. Use this endpoint to explicitly register a new account. When AUTH_DISABLE_AUTO_SIGNUP is enabled, this is the only way to register through this method. If the user already exists at callback time, they are redirected with error=user-already-exists.

get/signup/provider/{provider}

Request

  • Base URL
    https://{subdomain}.auth.{region}.nhost.run/v1
  • URL
    https://{subdomain}.auth.{region}.nhost.run/v1/signup/provider/{provider}
  • Auth
    none declared

Path parameters

provider'apple' | 'github' | 'google' | 'linkedin' | 'discord' | 'spotify' | 'twitch' | 'gitlab' | 'bitbucket' | 'workos' | 'azuread' | 'entraid' | 'strava' | 'facebook' | 'windowslive' | 'twitter' required

The name of the social provider

Query parameters

allowedRolesstring[]

Array of allowed roles for the user

[
  "me",
  "user"
]
defaultRolestring
Example:user

Default role for the user

displayNamestring
Example:John Smith

Display name for the user

localestring
Example:en

A two or three characters locale

Additional metadata for the user (JSON encoded string)

redirectTostring uri
Example:https://my-app.com/catch-redirection

URI to redirect to

statestring

Opaque state value to be returned by the provider

connectionstring

(workos) Specifies the connection to use for authentication

organizationstring

(workos) Specifies the organization to use for authentication

Additional provider-specific parameters

upstreamParamsUpstreamAuthParams

Extra parameters forwarded to the upstream OAuth2 provider's authorization URL (e.g. Google's prompt or login_hint). Reserved OAuth2/OIDC parameters are rejected.

Extra parameters forwarded to the upstream OAuth2 provider's authorization URL. Reserved OAuth2/OIDC parameters are rejected.

codeChallengestring

PKCE code challenge (S256). When provided, the callback redirect will contain an authorization code instead of a refresh token.

Response

An error occurred while processing the request

statusinteger required

HTTP status error code

messagestring required

Human-friendly error message

error'default-role-must-be-in-allowed-roles' | 'disabled-endpoint' | 'disabled-user' | 'user-already-exists' | 'email-already-verified' | 'forbidden-anonymous' | 'internal-server-error' | 'invalid-email-password' | 'invalid-request' | 'locale-not-allowed' | 'password-too-short' | 'password-in-hibp-database' | 'redirectTo-not-allowed' | 'role-not-allowed' | 'signup-disabled' | 'unverified-user' | 'user-not-anonymous' | 'invalid-pat' | 'invalid-refresh-token' | 'invalid-ticket' | 'disabled-mfa-totp' | 'no-totp-secret' | 'invalid-totp' | 'mfa-type-not-found' | 'totp-already-active' | 'invalid-state' | 'oauth-token-echange-failed' | 'oauth-profile-fetch-failed' | 'oauth-provider-error' | 'invalid-otp' | 'otp-too-many-attempts' | 'cannot-send-sms' | 'provider-account-already-linked' required

Error code identifying the specific application error

Example response

{
  "status": 400,
  "message": "Invalid email format"
}

Changes