Callback
This endpoint gets called after the triggering the authorize flow.
Callback links need a state and code parameter to verify the validity of the request.
When an error occurs during the OAuth flow, providers will optionally include error parameters in the callback request instead of the code parameter.
When the authorize request was initiated with a nonce and CSRF protection is enabled for your account, the connection is left unconfirmed and this endpoint redirects back to your redirect_uri with a hash fragment containing the original nonce, a short-lived confirm_token, and the service_id: #nonce=<nonce>&confirm_token=<token>&service_id=<service_id>. Your application must verify the nonce matches the value it sent and then call POST /vault/connections/{unified_api}/{service_id}/confirm with the confirm_token to activate the connection. Without a nonce (or with CSRF protection disabled) the connection becomes callable immediately and no confirmation step is required.
Query parameters
An opaque value the applications adds to the initial request that the authorization server includes when redirecting the back to the application. This value must be used by the application to prevent CSRF attacks.
An authorization code from the connector which Apideck Vault will later exchange for an access token.
Error code returned by the OAuth provider when authorization fails
Human-readable description of the error from the OAuth provider
Response
Unexpected error
Example response
{
"status_code": 400,
"error": "Bad Request",
"type_name": "RequestHeadersValidationError",
"message": "Invalid Params",
"detail": "Missing Header: x-apideck-consumer-id",
"ref": "https://developers.apideck.com/errors#unauthorizederror"
}