Endpoint referenceAuth
/auth/callback
The OAuth redirect target.
The OAuth redirect target.
Everything about this endpoint ends in a redirect, including its failures — the caller is a browser mid-sign-in, and a JSON error would leave the user on a blank page. Failures go to /login with the reason in a query parameter.
The next parameter decides where a successful sign-in lands, and it comes
from the request. It is restricted to a site-relative path: without that
check, a crafted link could complete a real sign-in and then bounce the user
to an attacker's page with the session already established. The original does
not check it; this is a deliberate departure, and it only rejects values that
were never legitimate.
Response Body
application/json
application/problem+json
curl -X GET "https://example.com/api/v2/auth/callback"null