---
title: "Oauth Callback"
method: GET
path: "/api/v1/admin/vendors/oauth/callback"
tags: ["admin-vendors"]
---

# Oauth Callback

`GET /api/v1/admin/vendors/oauth/callback`

Handle Google's callback — verify state, exchange code, persist tokens.

On success: redirects to ``/admin/vendors?connected={env}``. On a
forged state token: 401 + Sentry breadcrumb. On an expired state
token: 400 with a friendly message linking to ``/admin/vendors`` to
restart.

``env`` is OPTIONAL: Google preserves only ``code`` + ``state`` across
the redirect, not arbitrary query params on the registered
``redirect_uri``. The canonical env source is the Redis state token
(which stores ``{admin_id, env}`` at init time). If callers DO pass
``env`` (e.g. tests, or manual replay), we cross-verify it against
the stored value as defense-in-depth.

## Query parameters

- `code` string, required
- `state` string, required
- `env` 'staging' | 'prod', nullable

## Response `200`

Successful Response

- unknown

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.dev/prototyping/apis/prototyping-io-api.md) · [All operations](https://skmtc.dev/prototyping/apis/prototyping-io-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/prototyping/prototyping-io-api/revisions/f4a0079fbb57/schema)