v1

latestOpenAPI 3.1.02026-07-13632897.9 KB

Google OAuth

Google Oauth Callback

Handle Google OAuth callback.

Security (Increment 11): - Validates state exists in Redis (CSRF protection) - Retrieves user_id from Redis (not from query params) - Uses PKCE code_verifier from Redis in token exchange - State is single-use (deleted after verification) - Returns HTML error pages (user-facing redirect flow) - Never logs tokens

Args: request: FastAPI request object (provides access to app state) code: Authorization code from Google state: OAuth state token for CSRF protection error: Error code if Google authorization failed error_description: Human-readable error description session: Database session

Returns: HTML success page or HTML error page

get/auth/google/callback

Query parameters

codestring nullable

Authorization code from Google

statestring nullable

OAuth state token for CSRF protection

errorstring nullable

Error code from Google

error_descriptionstring nullable

Error description from Google

Response

Successful Response

{"stackTrail":"paths:/auth/google/callback:get:responses:200:content:application/json:schema","oasType":"schema","type":"unknown"}