---
title: "Google Callback"
method: GET
path: "/v1/auth/google/callback"
---

# Google Callback

`GET /v1/auth/google/callback`

## Request

- Base URL: `https://api.quantradin.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.quantradin.com/v1/auth/google/callback`
- Auth: none declared

Verify state -> exchange code -> verify id_token (sig/aud/iss/exp via
google-auth, nonce + email_verified here) -> session cookie -> redirect.

  303  Google itself refused BEFORE issuing a code (?error=...): the user
       cancelled, or (far more common) the OAuth consent screen blocked the
       account — app still in "Testing" and the address isn't a test user,
       or the app is pending verification. Nothing our code can fix; we bounce
       the browser back to /login with a readable banner instead of a raw 400.
  400  missing/forged/expired state or cookie (CSRF / replayed callback)
  401  code exchange refused, or the id_token failed verification
  403  Google says the email is NOT verified (no account is created/linked)
  503  not configured

## Query parameters

- `code` string
- `state` string
- `error` string

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/quantradin/apis/vega-api.md) · [All operations](https://skmtc.dev/quantradin/apis/vega-api/llms.txt) · [OpenAPI document](https://skmtc.dev/quantradin/apis/vega-api/revisions/47add154ef38?raw)