---
title: "Google Oauth Callback"
method: GET
path: "/auth/google/callback"
tags: ["Google OAuth"]
---

# Google Oauth Callback

`GET /auth/google/callback`

Handle Google OAuth callback.

Security (Increment 11):
    - Validates state exists in Redis (CSRF protection)
    - Retrieves user_id from Redis (not from query params)
    - Uses PKCE code_verifier from Redis in token exchange
    - State is single-use (deleted after verification)
    - Returns HTML error pages (user-facing redirect flow)
    - Never logs tokens

Args:
    request: FastAPI request object (provides access to app state)
    code: Authorization code from Google
    state: OAuth state token for CSRF protection
    error: Error code if Google authorization failed
    error_description: Human-readable error description
    session: Database session

Returns:
    HTML success page or HTML error page

## Query parameters

- `code` string, nullable — Authorization code from Google
- `state` string, nullable — OAuth state token for CSRF protection
- `error` string, nullable — Error code from Google
- `error_description` string, nullable — Error description from Google

## Response `200`

Successful Response

- unknown

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.net/priority-guard/apis/priority-guardian.md) · [All operations](https://skmtc.net/priority-guard/apis/priority-guardian/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/priority-guard/priority-guardian/revisions/8579218b716d/schema)