---
title: "OAuth connect callback"
method: GET
path: "/credentials/oauth/callback"
tags: ["Credentials"]
---

# OAuth connect callback

`GET /credentials/oauth/callback`

Handle the OAuth callback from the IdP.

This endpoint is intentionally unauthenticated — it receives redirects
from external IdPs where the user has no session cookie. Security
binding is provided by the signed, time-limited state JWT which ties
the callback to a specific credential and caller.

Redirects the popup the SPA opened to a public SPA route
(``/app/oauth/connected``) that owns the user-facing "you can close this"
experience and self-closes. Two variants, distinguished only by a coarse
``status`` query param:

  * Success: ``?status=ok``.
  * Failure: ``?status=error`` — no protocol or provider detail is
    exposed in the redirect URL.

The parent SPA still learns the real outcome by polling
``GET /credentials/{id}`` — never from this redirect. The actual cause
(missing state, connect failure, provider error, etc.) is recorded via
structured logging for operators.

## Query parameters

- `code` string, nullable
- `state` string, nullable
- `error` string, nullable

## Response `200`

Successful Response

- unknown

## Other responses

- `400` — Bad Request
- `422` — Unprocessable Entity
- `500` — Internal Server Error
- `503` — Service Unavailable

---

[API](https://skmtc.net/jentic/apis/jentic-control-plane-api.md) · [All operations](https://skmtc.net/jentic/apis/jentic-control-plane-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/jentic/jentic-control-plane-api/revisions/25c23e262a29/schema)