> ## Documentation Index
> Fetch the complete documentation index at: https://docs.insforge.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Provider-specific OAuth callback (POST)

> OAuth callback endpoint for providers that use POST (e.g., Apple with form_post response mode).

Response varies based on the original OAuth initiation:
- With code_challenge (PKCE): Redirects with `insforge_code` for exchange endpoint
- Without code_challenge (web): Redirects with `access_token` and sets httpOnly cookie




## OpenAPI

````yaml https://raw.githubusercontent.com/InsForge/InsForge/main/openapi/auth.yaml post /api/auth/oauth/{provider}/callback
openapi: 3.0.3
info:
  title: Insforge Authentication API
  version: 2.0.0
  description: Authentication endpoints with separated auth and profile tables
servers: []
security: []
paths:
  /api/auth/oauth/{provider}/callback:
    post:
      tags:
        - Client
      summary: Provider-specific OAuth callback (POST)
      description: >
        OAuth callback endpoint for providers that use POST (e.g., Apple with
        form_post response mode).


        Response varies based on the original OAuth initiation:

        - With code_challenge (PKCE): Redirects with `insforge_code` for
        exchange endpoint

        - Without code_challenge (web): Redirects with `access_token` and sets
        httpOnly cookie
      parameters:
        - name: provider
          in: path
          required: true
          schema:
            type: string
            enum:
              - google
              - github
              - discord
              - linkedin
              - facebook
              - instagram
              - tiktok
              - apple
              - x
              - spotify
              - microsoft
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
                - state
              properties:
                code:
                  type: string
                  description: Authorization code from OAuth provider
                state:
                  type: string
                  description: JWT state with redirect URI and optional code_challenge
                id_token:
                  type: string
                  description: ID token (for Apple Sign In)
      responses:
        '302':
          description: >
            Redirect to application.

            - PKCE flow:
            redirect_uri?insforge_code={code}&user_id={id}&email={email}&name={name}

            - Web flow:
            redirect_uri?access_token={token}&user_id={id}&email={email}&name={name}&csrf_token={csrf}
          headers:
            Location:
              schema:
                type: string
                format: uri
                description: Redirect URL with authentication parameters

````