OAuth2 Callback
Complete the PKCE flow: exchange the code, then create-or-update the grant.
The identity provider redirects the end user's browser here after they
authorize (or deny) access, with no authenticated request context of
its own - the caller's identity and every other piece of context this
needs to complete the exchange travels entirely inside state,
decoded by _decode_state, and the browser proves it is the one that
started the flow with the nonce cookie set by initiate. A missing,
tampered or expired state, or a missing or mismatched nonce, is
rejected outright.
On success, the grant's credential is created (or, for a reconnect of the same provider account, updated in place) via oauth_credential_provider.upsert_grant - this is the only creation path for an oauth2_pkce credential, since the frontend never holds the real token to POST to the normal credential-create route. When the initiating request named a deployment/entry, the result is also auto-linked via bundle_deployment_provider.link_credential.
Args:
request: Carries the nonce cookie.
session: Database session.
state: Opaque value echoed back from initiate_oauth.
code: Authorization code issued by the provider; absent when the
provider reports an error instead.
error: Provider-reported error code, if the user denied access or
the request otherwise failed upstream.
error_description: Human-readable detail accompanying error.
Returns:
A redirect to the frontend's stored redirect_uri, with either
oauth_success=1 or oauth_error=<message> appended.
Query Parameters
Response Body
application/json
application/json
curl -X GET "https://example.com/v1/oauth2/callback?state=string"null{ "detail": [ { "loc": [ "string" ], "msg": "string", "type": "string" } ]}