> ## Documentation Index > Fetch the complete documentation index at: https://docs.intelligence-management-platform.com/llms.txt > Use this file to discover all available pages before exploring further. # Handle OAuth provider callback > Browser-facing redirect target for OAuth 2.0 authorization code flows. The provider redirects here with `code` and `state` after the user grants permission. The `state` is an encrypted blob containing the provider identifier, user ID, and PKCE code verifier; the backend exchanges the code for tokens and stores them as the user's credential. Returns an HTML result page (success or error) — not a JSON API. **This endpoint is intentionally unauthenticated**: the user's identity comes from the encrypted `state` parameter, not from a session or API key. ## OpenAPI ````yaml /openapi/openapi.json get /oauth/callback openapi: 3.1.0 info: title: IMP REST API version: 1.0.0 description: >- REST endpoints of the IMP backend. GraphQL covers entity CRUD; REST covers agent runs, media, files, and system utilities. All requests require authentication unless the agent is public. servers: - url: '{baseUrl}' variables: baseUrl: default: http://localhost:9001 description: >- Base URL of your IMP backend. Self-hosted deployments typically run on port 9001. security: - apiKey: [] - bearer: [] tags: - name: Agents description: Endpoints for running, compacting, and querying agent instances. - name: Sessions description: Endpoints for managing files attached to agent sessions. - name: Media description: Transcription, speech synthesis, and image generation. - name: System description: Platform health and configuration utilities. - name: Budgets description: >- LiteLLM tag-budget management for users, roles, teams, projects, agents, and routines. Access requires `super_admin` or a role with `budget_management` write scope. - name: Skills description: >- Skills are versioned bundles of files (markdown, scripts, assets) mounted into the agent sandbox. These endpoints manage the skill registry and individual skill files. - name: Uploads description: >- Uppy-compatible S3 companion routes for single-part and multipart file uploads. Accept the standard API key. The `internal-key` header (set to `INTERNAL_SECRET`) is accepted only on `/s3/delete`, `/s3/download`, `/s3/list`, and `/s3/object` — it does **not** work on `/s3/sign` or the `/s3/multipart` routes. - name: Compliance description: >- GDPR / DSGVO operator endpoints for data-subject access (export) and erasure. Both require `super_admin`. - name: Artifacts description: >- Shareable artifact links — create, list, and revoke share links for files stored in S3. - name: Credentials description: >- Tool-credential management — submit, list, and revoke per-user credentials for oauth and user_credentials-enabled tools. Values are stored encrypted and never returned through these endpoints. - name: Public Agents description: >- Unauthenticated endpoints for guest-published agent discovery. Only whitelisted metadata fields are ever returned; no instructions, tools, or model details are exposed. paths: /oauth/callback: get: tags: - Credentials summary: Handle OAuth provider callback description: >- Browser-facing redirect target for OAuth 2.0 authorization code flows. The provider redirects here with `code` and `state` after the user grants permission. The `state` is an encrypted blob containing the provider identifier, user ID, and PKCE code verifier; the backend exchanges the code for tokens and stores them as the user's credential. Returns an HTML result page (success or error) — not a JSON API. **This endpoint is intentionally unauthenticated**: the user's identity comes from the encrypted `state` parameter, not from a session or API key. operationId: oauthCallback parameters: - name: code in: query required: false description: Authorization code returned by the OAuth provider. schema: type: string - name: state in: query required: false description: Encrypted state blob generated when the OAuth flow was initiated. schema: type: string - name: error in: query required: false description: OAuth error code returned by the provider on denial. schema: type: string - name: error_description in: query required: false description: Human-readable error description from the OAuth provider. schema: type: string responses: '200': description: >- HTML result page. The page is shown to the user in the browser tab — it is not machine-readable. A success page includes the text "Connected" and instructs the user to close the tab. content: text/html: schema: type: string '400': description: >- HTML error page. Rendered when `code` or `state` are missing, the state is invalid or expired, or the provider rejected the authorization. content: text/html: schema: type: string '404': description: >- HTML error page. No OAuth configuration registered for the provider extracted from `state`. content: text/html: schema: type: string '500': description: Provider is registered but not an OAuth provider (misconfiguration). content: text/html: schema: type: string '502': description: HTML error page. Token exchange with the OAuth provider failed. content: text/html: schema: type: string security: [] components: securitySchemes: apiKey: type: apiKey in: header name: x-api-key description: >- Organisation API key. Format: `sk_/` — the secret portion, a literal slash, and the human-readable key name. The header `exulu-api-key` is accepted as an alias. A `Bearer ` prefix is tolerated and stripped. Keys with an agent scope are only valid for the scoped agent instance. bearer: type: http scheme: bearer bearerFormat: JWT description: >- NextAuth session JWT (HS256, signed with `NEXTAUTH_SECRET`). This is the token the IMP frontend uses automatically. ````