Skip to main content

Upstream provider callback

GET 
/oauth2/federation/callback

The provider returns here after login. Verifies state against the flow, exchanges the upstream code, validates the upstream id_token, finds or creates the ESP User account, and redirects to the client's redirect_uri with a single-use code. Upstream tokens are discarded.

Request​

Responses​

Redirect to the client's redirect_uri with code (+ state).

Response Headers
    Location
    Set-Cookie

    The __Host-esp_session cookie (Path=/; HttpOnly; Secure; SameSite=Lax) establishing the authorization server's own session, whose record inherits the upstream's auth_time. It stores no token — an opaque revocable identifier only. A session-layer failure never blocks the login itself.