Handle OAuth provider callback
Browser-facing redirect target for OAuth 2.0 authorization code flows. The provider redirects here with code and state after the user grants permission. The state is an encrypted blob containing the provider identifier, user ID, and PKCE code verifier; the backend exchanges the code for tokens and stores them as the user’s credential. Returns an HTML result page (success or error) — not a JSON API. This endpoint is intentionally unauthenticated: the user’s identity comes from the encrypted state parameter, not from a session or API key.
Query Parameters
Authorization code returned by the OAuth provider.
Encrypted state blob generated when the OAuth flow was initiated.
OAuth error code returned by the provider on denial.
Human-readable error description from the OAuth provider.
Response
HTML result page. The page is shown to the user in the browser tab — it is not machine-readable. A success page includes the text "Connected" and instructs the user to close the tab.
The response is of type string.