Skip to main content

Upstream provider callback

GET 
/oauth2/federation/callback

The provider redirects here after the user authenticates. The broker verifies the HMAC state against the flow, exchanges the upstream code server-side, validates the upstream id_token (iss/aud/nonce/exp/signature), resolves the verified contact to an ESP User account (JIT-creating it on first login), and 302s the browser to the client's redirect_uri with OUR single-use authorization code. Upstream tokens are discarded — refresh never touches the provider.

Request​

Responses​

Redirect to the client's redirect_uri with code (+ state).

Response Headers
    Location