---
title: "Oauth Callback"
method: GET
path: "/api/mcp/oauth/callback"
tags: ["mcp-oauth"]
---

# Oauth Callback

`GET /api/mcp/oauth/callback`

## Request

- Base URL: `https://app.thinqos.com` (the document declares no server; this is the origin it was published from)
- URL: `https://app.thinqos.com/api/mcp/oauth/callback`
- Auth: none declared

Handle the OAuth authorization-server redirect back to thinqOS.

The ``state`` parameter is the authentication primitive - no session auth
is required here. Flow:

1. If ``error`` param present → redirect to error page.
2. Look up IdentityMcpOAuthState by ``state`` → 404 page on miss.
3. Check expiry → redirect to error page on expired.
4. Exchange the code for tokens.
5. Encrypt tokens via FernetEncryptor → INLINE: refs.
6. Persist token refs + expiry to the registration.
7. Delete the state row.
8. Redirect to success page.

## Query parameters

- `code` string, nullable
- `state` string, nullable
- `error` string, nullable
- `iss` string, nullable

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/thinqos/apis/thinqos-api.md) · [All operations](https://skmtc.dev/thinqos/apis/thinqos-api/llms.txt) · [OpenAPI document](https://skmtc.dev/thinqos/apis/thinqos-api/revisions/ce2c2ce318b1?raw)