Callback

Where Stamps.com sends the administrator back.

IT REDIRECTS TO THE WEB APP, NOT TO ITSELF. The API and the web app are different hosts on Railway (api-staging-.up.railway.app vs web-staging-.up.railway.app), so a relative "/system" resolves against the API and answers {"detail":"Not Found"} -- which is exactly what the first successful connection did. The OAuth flow had worked perfectly and the only thing wrong was the door it opened. frontend_url is the same setting the Google login callback already redirects through, for the same reason.

UNAUTHENTICATED BY NECESSITY: the browser arrives here from Stamps.com, not from Roost, so there is no session to require. The single-use state nonce is what makes that safe -- it was minted for one admin-initiated flow, it is consumed in the same statement that checks it, and a missing, expired, replayed or unknown one is refused.

NOTHING FROM THE QUERY STRING IS LOGGED. code is a credential until it is exchanged, and OAuth error descriptions have been known to echo it.