---
title: "OAuth redirect target (called by the provider)"
method: GET
path: "/api/v1/integration/oauth/{providerKey}/callback"
tags: ["OAuth"]
---

# OAuth redirect target (called by the provider)

`GET /api/v1/integration/oauth/{providerKey}/callback`

## Request

- Base URL: `https://api.sahha.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.sahha.ai/api/v1/integration/oauth/{providerKey}/callback`
- Auth: API key in header `Authorization`

Registered as the redirect URI in each provider's developer dashboard, per environment — which is why it keeps this unprefixed path and must not be moved. Not called by clients of ours, and carries no token of ours: the one-time `state` is what authenticates it.

Exchanges the code, stores the provider credential, creates or revives the connection, then redirects to the `redirectUrl` from the authorize call with `status=success`, or `status=error&error=<reason>` when any step fails. A failure after a consumed state still redirects, so the app always lands back.

## Path parameters

- `providerKey` string, required

## Query parameters

- `state` string, required
- `code` string
- `error` string

## Other responses

- `302`: Redirect to the whitelisted redirectUrl, carrying status and, on failure, error.
- `400`: state missing, unknown, or already consumed.
- `500`: Unexpected failure.

---

[API](https://skmtc.dev/sahha/apis/sahha-platform-v1.md) - [All operations](https://skmtc.dev/sahha/apis/sahha-platform-v1/llms.txt) - [OpenAPI document](https://skmtc.dev/sahha/apis/sahha-platform-v1/revisions/c7f918b46707?raw)