---
title: "Mcp Oauth Callback"
method: GET
path: "/v3/integrations/mcp/oauth/callback"
tags: ["integrations-v3"]
---

# Mcp Oauth Callback

`GET /v3/integrations/mcp/oauth/callback`

Receive the OAuth provider's redirect, exchange the code, render HTML.

Has no session auth — that's by design. This endpoint is the public
OAuth ``redirect_uri``; the unguessable ``state`` parameter is the
defense (RFC 6749 §10.12). The endpoint stores the exchanged tokens
on the pending OAuth row keyed by ``state`` and returns an HTML page
that ``postMessage``s the opener and closes the tab.

Emits a per-response ``Content-Security-Policy: script-src 'nonce-…'``
header whose nonce whitelists exactly the inline ``postMessage``
script in the rendered body. The default app-wide CSP is
``script-src 'self'`` which would otherwise block the inline script.

## Query parameters

- `state` string, nullable
- `code` string, nullable
- `error` string, nullable
- `error_description` string, nullable

## Response `200`

Successful Response

- unknown

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.net/traversal/apis/fastapi.md) · [All operations](https://skmtc.net/traversal/apis/fastapi/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/traversal/fastapi/revisions/2134ebffd1ef/schema)