Skip to content
turbodog

GET /api/auth/github/callback

Summary

Handles the GitHub OAuth callback by exchanging the authorization code for an access token, fetching the authenticated GitHub user’s identity, and redirecting to the onboarding page.

Intent

This endpoint exists to complete the GitHub OAuth 2.0 authorization code flow. After GitHub redirects the user back with a temporary code, this handler exchanges it for an access token, retrieves the user’s GitHub profile, and redirects them into the application onboarding experience.

Parameters

No parameters.

Request example

Terminal window
curl -X GET "https://maps.google.com/api/auth/github/callback?code=GITHUB_OAUTH_CODE" \
  -H "Authorization: Bearer YOUR_API_TOKEN"

Response example

{
  "note": "No JSON body is returned. The server issues an HTTP 302 redirect to the application onboarding URL, e.g.: /onboarding?customerId=12345678&login=octocat"
}

Error cases

  • 400 — The ‘code’ query parameter is missing from the request
  • 400 — GitHub’s token exchange did not return an access_token (e.g., the code was already used, expired, or invalid)
  • 501 — The server is not configured with a GITHUB_CLIENT_SECRET environment variable

Gotchas

  • This endpoint is not meant to be called directly by API clients — it is the redirect target registered with GitHub as the OAuth callback URI. GitHub will append the ‘code’ query parameter automatically after the user authorizes the OAuth app.
  • The ‘code’ parameter issued by GitHub is single-use and short-lived (typically valid for 10 minutes). Reusing or replaying the same code will result in a 400 error.
  • On success, the endpoint returns an HTTP 302 redirect, not a JSON body. Clients following redirects automatically (e.g., browsers) will land on the onboarding page with ‘customerId’ and ‘login’ as query parameters.
  • The identity is currently passed via redirect query parameters (customerId, login) rather than a session cookie. This is explicitly marked as a temporary implementation in the source code — do not rely on this behavior in production.
  • If GITHUB_CLIENT_SECRET is not set in the server environment, the endpoint returns 501 and the entire OAuth flow is unavailable.
  • The redirect destination is controlled by the server-side ‘appUrl’ configuration option, not by any client-supplied parameter, preventing open redirect vulnerabilities.