---
title: "Retrieve OAuth2 provider tokens from callback"
method: GET
path: "/signin/provider/{provider}/callback/tokens"
tags: ["authentication"]
---

# Retrieve OAuth2 provider tokens from callback

`GET /signin/provider/{provider}/callback/tokens`

After successful OAuth2 authentication, retrieve the provider session containing access token, refresh token, and expiration information for the specified provider. To ensure the data isn't stale this endpoint must be called immediately after the OAuth callback to obtain the tokens. The session is cleared from the database during this call, so subsequent calls will fail without going through the sign-in flow again. It is the user's responsibility to store the session safely (e.g., in browser local storage).

## Path parameters

- `provider` 'apple' | 'github' | 'google' | 'linkedin' | 'discord' | 'spotify' | 'twitch' | 'gitlab' | 'bitbucket' | 'workos' | 'azuread' | 'entraid' | 'strava' | 'facebook' | 'windowslive' | 'twitter', required

## Response `200`

Successfully retrieved provider session

- ProviderSession — OAuth2 provider session containing access and refresh tokens
  - `accessToken` string, required — OAuth2 provider access token for API calls
  - `expiresIn` integer, required — Number of seconds until the access token expires
  - `expiresAt` string, date-time, required — Timestamp when the access token expires
  - `refreshToken` string, nullable — OAuth2 provider refresh token for obtaining new access tokens (if provided by the provider)

## Other responses

- `default` — An error occurred while processing the request

---

[API](https://skmtc.net/nhost/apis/nhost-authentication-api.md) · [All operations](https://skmtc.net/nhost/apis/nhost-authentication-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/nhost/nhost-authentication-api/versions/a5c0d88b55c4/schema)