Completes a login: validates the callback, exchanges the code, resolves

GET

/auth/callback

curl --request GET \
  --url http://localhost:3001/auth/callback \
  --header 'Authorization: Bearer <token>'

use reqwest;

#[tokio::main]
pub async fn main() {
    let url = "http://localhost:3001/auth/callback";

    let mut headers = reqwest::header::HeaderMap::new();
    headers.insert("Authorization", "Bearer <token>".parse().unwrap());

    let client = reqwest::Client::new();
    let response = client.get(url)
        .headers(headers)
        .send()
        .await;

    let status = response.unwrap().status();

    dbg!(status);
}

(or provisions) the principal, and mints a session.

Every failure path here ends in a clean ApiError and no session: a provider error, a missing/expired flow cookie, a state mismatch, an exchange/token failure, ClaimRejected, and SubjectNotAvailable (the latter two both map to 403 — see ResolveOutcome) all return before create_session is ever called.

Parameters

Path Parameters

code

required

string

nullable

state

required

string

nullable

error

required

string

nullable

Responses

302

400

Malformed callback, or a missing/expired/mismatched login flow

401

The provider rejected the login, or the exchanged token failed verification

403

The claim gate rejected the identity, or the subject belongs to a non-human or disabled principal

502

The identity provider was unreachable