---
title: "Api Oauth Google Link Verify"
method: POST
path: "/api/oauth/google/link-verify"
---

# Api Oauth Google Link Verify

`POST /api/oauth/google/link-verify`

## Request

- Base URL: `https://sleipnir.tv` (the document declares no server; this is the origin it was published from)
- URL: `https://sleipnir.tv/api/oauth/google/link-verify`
- Auth: none declared

A15: complete the Google sign-in flow for an existing
password-protected Sleipnir user.

Flow:
  1. User clicks "Sign in with Google" on landing page.
  2. Google OAuth callback finds an existing Sleipnir account with a
     real password (not the Google-only sentinel).
  3. Callback creates a LoginPending(kind='oauth_link') row and
     redirects to /link-google?token=<pending_id> instead of
     issuing a session.
  4. User on /link-google enters their Sleipnir password (and TOTP
     if 2FA is enabled).
  5. /api/oauth/google/link-verify (this endpoint) verifies both
     factors, atomically deletes the pending row, creates a real
     session, sends a notification email.

Rate limits: DB-backed via rate_limiter module, per-IP and
per-user_id (the latter only after pending lookup resolves).

Defense-in-depth: if pending.kind != 'oauth_link' (e.g., someone
tries to use a 2FA pending_token here), reject. The endpoints have
different attack surfaces and must not be interchangeable.

## Request body

- OauthLinkVerifyBody: A15: body for /api/oauth/google/link-verify. pending_token comes from the oauth_link LoginPending row created by the Google OAuth callback. password is the user's Sleipnir password. If the user has 2FA enabled, code (and optionally use_backup_code) are also required.
  - `pending_token` string, required
  - `password` string, required
  - `code` string
  - `use_backup_code` boolean

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/sleipnir/apis/relay-control-plane.md) · [All operations](https://skmtc.dev/sleipnir/apis/relay-control-plane/llms.txt) · [OpenAPI document](https://skmtc.dev/sleipnir/apis/relay-control-plane/revisions/79829f6945a4?raw)