---
title: "Google Redirect Callback"
method: POST
path: "/api/auth/google-redirect"
tags: ["auth"]
---

# Google Redirect Callback

`POST /api/auth/google-redirect`

## Request

- Base URL: `https://api.retirementlab.app` (the document declares no server; this is the origin it was published from)
- URL: `https://api.retirementlab.app/api/auth/google-redirect`
- Auth: none declared

Step 1 of the Google Sign-In redirect flow.

Google posts a form with ``credential`` and ``g_csrf_token`` fields.
We verify CSRF and the JWT, then 303-redirect to a same-origin GET
that completes the login.  The two-step approach is required because
``SameSite=Lax`` does not send the existing ``sim_session`` cookie on
the cross-site POST from Google, but *does* send it on the subsequent
same-origin GET — allowing anonymous-session promotion to work.

The verified credential is passed to step 2 via a short-lived
``SameSite=Lax; Secure; HttpOnly`` cookie so it never appears in URLs.

Emits ``auth_flow_event`` with stage=``google_redirect``.

## Response `200`

Successful Response

- unknown

---

[API](https://skmtc.dev/retirementlab/apis/income-simulator-api.md) · [All operations](https://skmtc.dev/retirementlab/apis/income-simulator-api/llms.txt) · [OpenAPI document](https://skmtc.dev/retirementlab/apis/income-simulator-api/revisions/b0f00a0333fd?raw)