---
title: "Provider-specific OAuth callback (GET)"
method: GET
path: "/api/auth/oauth/{provider}/callback"
tags: ["Client"]
---

# Provider-specific OAuth callback (GET)

`GET /api/auth/oauth/{provider}/callback`

OAuth callback endpoint for provider-specific flows (most providers use GET).

Response varies based on the original OAuth initiation:
- With code_challenge (PKCE): Redirects with `insforge_code` for exchange endpoint
- Without code_challenge (web): Redirects with `access_token` and sets httpOnly cookie

## Path parameters

- `provider` 'google' | 'github' | 'discord' | 'linkedin' | 'facebook' | 'instagram' | 'tiktok' | 'apple' | 'x' | 'spotify' | 'microsoft', required

## Query parameters

- `code` string
- `state` string, required
- `token` string

## Other responses

- `302` — Redirect to application. - PKCE flow: redirect_uri?insforge_code={code}&user_id={id}&email={email}&name={name} - Web flow: redirect_uri?access_token={token}&user_id={id}&email={email}&name={name}&csrf_token={csrf}

---

[API](https://skmtc.net/insforge/apis/insforge-authentication-api.md) · [All operations](https://skmtc.net/insforge/apis/insforge-authentication-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/insforge/insforge-authentication-api/versions/a935bb49f932/schema)