Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/eggarcia98/auth-backend/llms.txt

Use this file to discover all available pages before exploring further.

Complete the OAuth authentication flow by exchanging the authorization code received from the provider for a user session. On success, sets accessToken and refreshToken as HTTP-only cookies and returns the authenticated user and tokens in the response body.
This endpoint uses PKCE (Proof Key for Code Exchange). The backend calls exchangeCodeForSession with the authorization code, which Supabase validates against the stored code verifier. Each code can only be used once.

​
Request

POST /api/v1/auth/oauth/:provider/callback No authentication required.

​
Path parameters

​
provider
string
required
The OAuth provider the code was issued by. Accepted values: google, apple.

​
Body

​
code
string
required
The authorization code returned by the OAuth provider in the redirect URL query parameter code. Extract this from the callback URL on your frontend before sending it here.

​
Response

On success, the response sets two HTTP-only cookies:
  • accessToken — short-lived JWT for authenticating API requests.
  • refreshToken — long-lived token (7 days) for obtaining new access tokens.
​
success
boolean
required
Indicates whether the request succeeded. Always true on success.
​
message
string
Confirmation message. Value: "OAuth authentication successful, tokens set in cookies".
​
data
object

​
Examples

curl --request POST \
  --url https://your-api.com/api/v1/auth/oauth/google/callback \
  --header 'Content-Type: application/json' \
  --data '{
    "code": "4/0AX4XfWh..."
  }'

​
Success response

200
{
  "success": true,
  "message": "OAuth authentication successful, tokens set in cookies",
  "data": {
    "user": {
      "id": "usr_01h9...",
      "email": "user@example.com",
      "emailVerified": true,
      "provider": "google",
      "createdAt": "2024-01-15T10:30:00.000Z",
      "updatedAt": "2024-01-15T10:30:00.000Z"
    },
    "tokens": {
      "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
      "refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
      "expiresIn": 3600
    }
  }
}

​
Error responses

400
{
  "success": false,
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Authorization code is required"
  }
}
401
{
  "success": false,
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Failed to authenticate with OAuth provider"
  }
}

Build docs developers (and LLMs) love

Get started for freeTalk to us