---
title: "Provider-specific OAuth callback (POST)"
method: POST
path: "/api/auth/oauth/{provider}/callback"
tags: ["Client"]
---

# Provider-specific OAuth callback (POST)

`POST /api/auth/oauth/{provider}/callback`

OAuth callback endpoint for providers that use POST (e.g., Apple with form_post response mode).

Response varies based on the original OAuth initiation:
- With code_challenge (PKCE): Redirects with `insforge_code` for exchange endpoint
- Without code_challenge (web): Redirects with `access_token` and sets httpOnly cookie

## Path parameters

- `provider` 'google' | 'github' | 'discord' | 'linkedin' | 'facebook' | 'instagram' | 'tiktok' | 'apple' | 'x' | 'spotify' | 'microsoft', required

## Other responses

- `302` — Redirect to application. - PKCE flow: redirect_uri?insforge_code={code}&user_id={id}&email={email}&name={name} - Web flow: redirect_uri?access_token={token}&user_id={id}&email={email}&name={name}&csrf_token={csrf}

---

[API](https://skmtc.net/insforge/apis/insforge-authentication-api.md) · [All operations](https://skmtc.net/insforge/apis/insforge-authentication-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/insforge/insforge-authentication-api/versions/a935bb49f932/schema)