---
title: "Google OAuth callback (sign-in or identity link)"
method: GET
path: "/oauth/google/callback"
tags: ["OAuth"]
---

# Google OAuth callback (sign-in or identity link)

`GET /oauth/google/callback`

## Request

- Base URL: `https://api.uptimemonitoring.com`
- URL: `https://api.uptimemonitoring.com/oauth/google/callback`
- Auth: none required

Handles the redirect from Google. In sign-in mode, behaves like
`/oauth/github/callback`: exchanges the code, fetches the Google
`sub`/`email`/`email_verified`/`hd` claims, resolves or creates the
account, and redirects to the frontend with a one-time auth code.
A genuinely first sign-in whose `email_verified` claim is the
literal `true` and whose address is `gmail.com`/`googlemail.com`,
or matches a Google Workspace/Cloud `hd` claim case-insensitively,
links onto whichever existing user already holds that address as a
verified email identity, but only when that holder has no Google
identity of their own (issue #392) — every other verified address
still creates a new user, exactly as an unverified one does, and so
does a holder who already has a DIFFERENT Google identity attached:
that case creates a separate Google-only user rather than linking.
Raw claims are never stored; only the narrowed, normalized address
is, and only on the row it attaches to.

In identity-link mode (an `oauth_google_link` cookie set by a prior
`POST /oauth/google/link`), redeems the ticket instead — every
outcome, success or failure, redirects to
`{FRONTEND_URL}/settings?linked=google` or
`{FRONTEND_URL}/settings?link_error=<code>`, and `SignInWithGoogle`
is never called. Every failure that happens before the ticket is
redeemed (invalid state, a missing authorization code, or a Google
token-exchange/userinfo failure) is normalized to the documented
link-mode codes — `link_invalid` or `internal_error` — rather than
leaking the raw sign-in error code.

## Query parameters

- `code` string, required
- `state` string, required

## Other responses

- `302`: Redirect to the frontend (sign-in) or settings page (link), success or error either way.
- `404`: Google sign-in not configured.

---

[API](https://skmtc.dev/uptimemonitoring/apis/uptimemonitoring-com-api.md) · [All operations](https://skmtc.dev/uptimemonitoring/apis/uptimemonitoring-com-api/llms.txt) · [OpenAPI document](https://skmtc.dev/uptimemonitoring/apis/uptimemonitoring-com-api/revisions/ddcb2a8bc70f?raw)