admin-vendors
Oauth Callback
Handle Google's callback — verify state, exchange code, persist tokens.
On success: redirects to /admin/vendors?connected={env}. On a forged state token: 401 + Sentry breadcrumb. On an expired state token: 400 with a friendly message linking to /admin/vendors to restart.
env is OPTIONAL: Google preserves only code + state across the redirect, not arbitrary query params on the registered redirect_uri. The canonical env source is the Redis state token (which stores {admin_id, env} at init time). If callers DO pass env (e.g. tests, or manual replay), we cross-verify it against the stored value as defense-in-depth.
get/api/v1/admin/vendors/oauth/callback
Request
- Base URLhttps://api.prototyping.io (the document declares no server; this is the origin it was published from)
- Authnone declared
- TypeScriptA function with typed inputs. Its response is checked against the schema.
Query parameters
codestring required
statestring required
env'staging' | 'prod' nullable
Response
Successful Response
unknown required
Changes
No recorded changes to this operation across all 1 revision of this API.